How we protect your data

Every connection to OneForm — the dashboard, the public form pages, and every API route — is served over HTTPS/TLS via Cloudflare, so data in transit is encrypted end to end between your browser and our servers.

Your account data, forms and submissions are stored in a managed Postgres database (Supabase) that encrypts data at rest. Uploaded files and images go to Cloudflare R2 object storage, which likewise encrypts data at rest.

OneForm doesn't run its own separate login system. It uses the same authentication layer as the rest of the OneOS suite (oneos.in), backed by Supabase Auth: sign in with a password, a magic link, or Google OAuth. Passwords are never stored in plain text — they're salted and hashed before storage, so we can verify a password without ever holding a readable copy of it.

Sessions are validated on every request (not just trusted from a cookie), and the session cookie is scoped to the shared .oneos.in domain so signing in once carries you across OneOS products without re-entering credentials.

Your forms, submissions and settings are scoped to your organization. Team access is role-based — owner, admin and member — and only owners/admins can invite, change roles for, or remove teammates; the organization owner can't be removed. Inviting a teammate never means sharing your login: they get their own account scoped to the same organization.

API keys you generate under Settings are shown once at creation and can be revoked individually at any time if one is no longer needed or may have leaked.

OneForm runs on Cloudflare Workers at the edge, sitting in front of Cloudflare for DDoS protection, TLS termination and routing. Application data lives in a managed Postgres database (Supabase); files and images live in Cloudflare R2. This keeps the same infrastructure pattern used across the OneOS suite.

We rely on a small set of trusted providers, each scoped to what it needs to do its job:

• Supabase — database, authentication and file storage for your account, forms and submissions.
• Cloudflare — edge network, DDoS protection, TLS, and object storage (R2) for uploaded files.
• Payment providers — process subscriptions and payments; we don't store full card numbers ourselves.
• Integration providers you enable — such as Google Sheets, Slack, Mailchimp, Klaviyo, HubSpot, Zapier or n8n. Data only flows to these when you turn the integration on.

See the Privacy Policy for the full picture of what we collect and why.

You can delete individual submissions, bulk-delete a form's submissions (type-to-confirm), or delete a form entirely at any time from your dashboard. If you close your account, your data is removed within a reasonable period, except where we're required to retain certain records (for example billing) to meet legal obligations.

If we become aware of a security incident that affects your account data, we'll notify affected customers without undue delay, describe what happened and what data was involved, and outline the steps we're taking in response — consistent with our obligations under applicable law.

Found a security issue in OneForm? Please report it to support@pixelperfect.co.in with a description and steps to reproduce. Give us a reasonable amount of time to investigate and fix the issue before disclosing it publicly, and avoid accessing or modifying data that isn't your own while testing. We appreciate responsible disclosure and will acknowledge valid reports promptly.