conForm / Trust
Where your form data exists
Processed long enough to deliver. Stored never. This page states plainly where submission content lives during its life — including the parts most services leave vague — and everything here is checkable against the open-source engine, whose contract tests enforce it in CI.
Plaintext exists in exactly these places
- In your visitor's browser, before they submit.
- In TLS transit to the Worker.
- In Worker memory, for the duration of the delivery request — then it is gone.
- Inside Cloudflare's email pipeline while the message is sent.
- In the destination mailbox. Your inbox is the system of record.
- For routes with webhooks: in TLS transit to the receiver you configured, signed so it can be authenticated.
There is no step seven. No submission database, no admin inbox, no "archive" tier, no logs containing field content.
What is stored at rest
| Stored | Form |
|---|---|
| Route records | Form ID, your alias, verification status — plus the destination (email, and webhook URL if configured) sealed with AES-GCM. The alias is the only plaintext customer value. |
| Quota counters | Opaque HMAC inbox identifiers with month/used/limit numbers. Counters, not logs — they cannot reproduce a submission. |
Routes are yours to destroy: DELETE /v1/routes/{form_id} with the management token hard-deletes the record, encrypted destination included. Routes that never verify are deleted automatically after 30 days.
What we deliberately cannot do
- Recover or dedupe submissions — there is no history to consult. A retried request after a network timeout may deliver a duplicate email; we say so in the API docs rather than quietly keeping copies.
- Filter spam by content — conForm forwards blind. The hidden honeypot field catches naive bots without reading anything your visitors wrote.
- Read a "submissions dashboard" — none exists, for us or for you. Your inbox is it.
If our identity rules ever merge two real inboxes
Quota is shared per inbox identity (+tags and Gmail dots count as the same inbox). In the rare case two genuinely distinct mailboxes get merged — say a system where dev+ops@ is a real, separate mailbox — the operator can exempt the exact address via a hash-based exception list (no plaintext addresses in configuration), and you recreate the affected forms. The rules themselves are published code, not a heuristic we tune in private.
What we do not claim
No compliance acronyms appear on this site: we state facts about where data exists and let you judge them. The forwarding path is not end-to-end encrypted — the Worker and Cloudflare's email pipeline process plaintext to deliver it. For zero Centrst access today, self-host the same Worker; client-side encryption is planned as a free feature and will be announced only when it ships.