Security and Subprocessors
How jpforms (https://jpforms.com) is run, where your data sits, and who else touches it.
Everything a buyer has to check before adopting the service is on this page, so that checking it costs no correspondence.
How the platform is built
These hold for every service we run. They are repository-wide rules rather than per-product decisions, and tests fail the build when one of them drifts.
- Every surface runs on Cloudflare's network. We operate no servers of our own.
- All traffic is served over TLS, with HSTS set.
- Card details never reach our code. The payment screen is hosted by Stripe.
- Session cookies carry the `__Host-` prefix, so no sibling subdomain can set one the console would read.
- Operator surfaces are separate from the customer console, sit behind Cloudflare Access, and are checked again in the Worker.
- A public ingress that parses what a stranger sent binds no database and holds no secret; it asks another surface for what it needs.
- Secrets are delivered at deploy time and never live in source. A log field shaped like a credential fails to compile.
- Migrations are expand-only, so a running Worker never meets a table it expects and cannot find.
- Data that re-running cannot rebuild is marked protected, so the infrastructure program cannot delete it.
Where your data lives
- Source documents, rendered pages and finished PDFs are stored in Cloudflare object storage; account, draft and usage records are in a Cloudflare database.
- Nothing is copied to a machine we operate, because we operate none.
- A draft is readable only through your authenticated session.
Controls specific to this service
- Everything is served over TLS and stored inside Cloudflare.
- A draft is readable only through your authenticated session.
- Your answers are never used to train models.
- A マイナンバー box is recognised and refused rather than stored, so the obligations of 番号法 never attach to us.
- The operator back-office is a separate surface behind Cloudflare Access and cannot read a draft through the customer console.
Subprocessors
The following processors handle data on our behalf, to the extent needed to run the service. Each is engaged under its own data protection terms.
| Cloudflare | Hosting, storage, the browser that renders a form's pages, and the model that reads what each box is for. Documents stay inside Cloudflare's network. Country: United States |
|---|---|
| Stripe (api.stripe.com) | Subscription billing: the account email, the amount and the plan. Card details never reach us — Checkout is hosted by Stripe. Country: United States |
| Resend (api.resend.com) | Transactional email: the recipient address and the message, including sign-in links, reminders and billing notices. Country: United States |
A new subprocessor is published here at least 30 days before it begins processing your data.
Independent attestations
We hold no third-party attestation — no SOC 2, no ISO 27001. We say so plainly rather than leaving the section out, because an omission reads like an oversight and a buyer deserves to know which it is.
- The platform and product controls above are what we can show today.
- A data processing agreement (/legal/dpa) is available and carries the information and audit clauses.
- If we obtain an attestation we will publish it here with its scope and issue date.
Reporting a vulnerability
If you find a vulnerability, tell us through the disclosure form (/legal/disclosure). We acknowledge a report promptly, and we will not pursue legal action over research carried out in good faith to investigate one.
Changes to this page
This page changes as the service does. A new subprocessor is posted in advance; any other material change is posted with the date it takes effect.
Last updated: 2026-09-07