Encryption everywhere
Data is encrypted in transit with TLS 1.2 or higher, and at rest with AES-256. Backups are encrypted too.
Access you control
Two-step verification for every account, project roles and permissions on Team, and single sign-on on Enterprise.
A clear record
Automations log every action they take. Enterprise workspaces add an audit log of sign-ins, permission changes, and exports.
Careful integrations
Connected apps use OAuth with the narrowest permissions Forma needs. Disconnect an app and its access is revoked immediately.
Your data, portable
Export projects, tasks, and comments as CSV or JSON at any time. Delete your workspace and its data is removed from active systems.
Private by design
Forma does not sell your data or use the contents of your workspace to advertise to you. Staff access is limited and logged.
This page describes how Forma is designed to handle security. No third-party compliance certifications are claimed.