Intellistack

United States

Formstack retains customer data only for as long as it is necessary to fulfill the purposes outlined in our agreement or as required by law. Customers can configure data retention settings within their account, and we support automated deletion policies where applicable. Once a customer relationship ends, data is deleted from production systems within a defined time frame, typically 30 days (effective September 2025), and removed from backups per our data destruction policy.

Formstack acts primarily as a data processor on behalf of our customers, who are the data controllers. As such, we generally do not have direct access to, nor visibility into, identifiable end-user data unless it is explicitly shared with us through support interactions or system-level metadata. When Formstack receives a data deletion request directly from an end user, we typically refer the requestor to the appropriate customer (the data controller) to evaluate and respond, in line with their legal obligations under frameworks like GDPR or CCPA. However, in limited cases where the end user is a direct Formstack account holder (for example, through individual use of our Forms or Sign products), we will process deletion requests internally in accordance with our privacy policy, applicable laws, and standard operating procedures. This includes secure deletion from active systems and eventual purging from backups in accordance with our retention schedules. In addition, Formstack customers may initiate deletion of their own data through in-app functionality or by submitting a formal request through our support channels. Upon such a request, we delete customer data from production systems promptly and ensure it is removed from backups according to our data retention and destruction policies.

All customer data is stored in secure, access-controlled environments hosted by leading cloud service providers (e.g., AWS) in U.S.-based data centers unless contractually agreed otherwise. Data is encrypted in transit and at rest using industry-standard protocols.

United States, Canada, Australia

Cloud hosted

AWS

yes

no

Formstack acts primarily as a data processor on behalf of our customers, who are the data controllers. As such, we generally do not have direct access to, nor visibility into, identifiable end-user data unless it is explicitly shared with us through support interactions or system-level metadata. When Formstack receives a data deletion request directly from an end user, we typically refer the requestor to the appropriate customer (the data controller) to evaluate and respond, in line with their legal obligations under frameworks like GDPR or CCPA. However, in limited cases where the end user is a direct Formstack account holder (for example, through individual use of our Forms or Sign products), we will process deletion requests internally in accordance with our privacy policy, applicable laws, and standard operating procedures. This includes secure deletion from active systems and eventual purging from backups in accordance with our retention schedules. In addition, Formstack customers may initiate deletion of their own data through in-app functionality or by submitting a formal request through our support channels. Upon such a request, we delete customer data from production systems promptly and ensure it is removed from backups according to our data retention and destruction policies. Contact us at security@intellistack.com to request deletion of data.

yes

2025-05-19

no

Google SSO

no

yes

security@intellistack.com

yes

yes

no

no

Google Workspace, Prismatic, AWS

no