Encryption

hootform encrypts respondents' identifying answers before storing them. Encryption is on for every new form, and it's free on every plan.

What's encrypted

When encryption is on, these are stored encrypted:

• Answers to Email, Phone number, Link, Date, Date range, Date & time, Time, Contact info and Address questions.
• Uploaded files and signatures: the files themselves and their names.
• Numbers from a Number question marked as Personal data.
• Text typed beside Other on a choice question.
• Hidden field values.
• Follow-up questions and replies.
• The respondent's browser and the page they came from.
• AI insights reports and response summaries, which quote respondents.

In the builder, a lock beside a question means its answers are encrypted. Settings → Privacy lists every question on the form as Encrypted or Not encrypted.

What stays readable, and why

• Choices, Yes / No, ratings, scales, rankings, matrices, consent and ordinary numbers stay readable so Insights can count and average them. They say little about who someone is on their own.
• Short text and long text stay readable. Free text is where people write names and details, but it's also what you search, read and export most, so hootform doesn't guess. If you're asking for a name, an email and a phone number, or a postal address, use a Contact info or Address question, which are always encrypted, rather than text questions.

Who can read encrypted answers

Encryption protects what's stored. It doesn't hide answers from people who are allowed to see the form: workspace members still read every answer in the dashboard, exports, email notifications and webhooks, decrypted.

What it protects against is someone who gets hold of the stored data itself, such as a database backup: without the form's key, encrypted answers are unreadable.

The one thing that changes for you is searching and filtering responses: hootform doesn't decrypt answers to look through them, so search skips encrypted answers and filters can only check whether they were answered.

How it works

Each form has its own key, and every value is encrypted with AES-256-GCM. The form's key is itself encrypted with a master key that's kept outside the database. Deleting a form deletes its key, so any copy of its responses that survives anywhere, such as in an old backup, can never be read again.

Turning encryption on or off

Open the form's Settings tab, choose Privacy, and switch encryption. It applies straight away, without publishing, and hootform re-writes the responses you've already collected to match:

• Turning it on encrypts existing responses' identifying answers and files.
• Turning it off writes them back in plain text, and stores new ones the same way, so anyone who can read the database can read them. AI insights reports are deleted when encryption is switched either way, and summaries are re-written to match.

Only workspace editors can change it.

Requiring encryption across an organization

Organization owners and admins can require encryption under Organization settings → General → Response privacy. Every form in the organization is then encrypted, and editors can't turn it off for a single form.

Respondents can see it's on

While a form is encrypted, its welcome screen says "Personal answers are encrypted". It's worded that way because free text isn't encrypted.