Security

Safe by default. Honest about the rest.

What AllBack does today to protect you and the people who answer your forms.

No passwordsSign in with an email code
Private filesLinks that expire
No trackersNo analytics, no ad pixels

Your account

Only you, and the AI apps you connect, can act for you.

Codes, not passwords

A 6-digit code by email. We store only a hash of it. It expires in minutes, and it stops working after 5 wrong tries.

Secure sessions

A sign-in cookie that scripts cannot read, sent only over HTTPS. It ends after 30 days, or when you sign out.

AI apps act as you

Claude, ChatGPT, and other apps sign in with OAuth. They get a token for your account, and nothing more.

Guest forms are locked

A form made before sign-up needs its secret key. It sends no email and takes at most 3 test answers, until you confirm your email.

The people who answer

They trust your link. We protect that trust.

Links nobody can guess

Each personal link has 144 random bits. It shows only that person's own prefilled answers.

Verify it is you

For private requests, the form opens only after a code sent to the person's own email.

Forms on their own domain

Forms live on allback.app, with one subdomain for each workspace, apart from our website and your account.

Stop and report

Every email has a link to stop reminders and a link to report the form. Three reports close a form at once.

Your data

Stored with care, shared with nobody who does not need it.

Encrypted

HTTPS for every request. Data and files are encrypted at rest by our host, Cloudflare.

Private files

Uploads are never public. Each download link is signed, and links in exports expire after 7 days.

No trackers, no training

No analytics or ad pixels. We do not sell your data, and we do not train AI on your forms or answers.

Deleted on time

Unclaimed guest forms go after 30 days. Demo answers go after 30 minutes. Your account goes when you ask.

Abuse protection

A form tool must not become a phishing tool.

Risky questions refused

AllBack refuses forms that ask for passwords, one-time codes, card numbers, or bank details.

Custom code in a sandbox

Fully custom forms run with no network access and no access to cookies. We check every answer on our server.

Strict page rules

Form pages run only our own scripts, and send data only to us. Other sites cannot embed them.

Rate limits

Limits on new forms, sign-in codes, and open-link answers stop scripts. We keep IP addresses only as a one-way hash.

Not yet

We are a young product. Here is what we do not have today, so you can decide with the full picture.

  • !
    No SOC 2 or ISO 27001 reportWe have not had an external audit yet.
  • !
    No single sign-on (SSO) yetIt is on the roadmap for Business and Enterprise.
  • !
    No public status page yetWe will add one before launch.
  • !
    No choice of data regionAll data is stored in [DATA REGION].

Questions

Where is my data stored?

AllBack runs on Cloudflare. The database and the uploaded files are stored in [DATA REGION]. Emails go through Resend. See the privacy policy for the full list.

Who can see the answers?

Only you. The people who answer see only their own link and their own answers.

What happens when I connect an AI app?

The app works as you, with your account. It can do what you can do, and nothing more. What you type in the app is handled by its provider, under its own terms.

Can I see the code?

The CLI and the skill for Claude are open source on GitHub. The service itself is not open source.

Found a security problem?

Please tell us first, and give us time to fix it. We read every report.

Report it →