Trust, security & compliance
This page is maintained by All Web Forms to answer common security, privacy, and accessibility questions. It describes controls that are enabled today and how you can exercise your rights. It is not a certification.
HIPAA-aligned workflows
All Web Forms provides workflow controls that help form owners handling protected health information (PHI) reduce exposure. Enabling HIPAA mode on a form applies the following:
- •Notification emails and webhooks send a generic "New submission received" message — no field values leave our infrastructure by email.
- •Every view, export, and download of that form's submissions is written to a per-form audit log visible to the form owner.
- •Public forms display a visible PHI-handling notice so respondents know their answers may contain health information.
- •Only the form owner (and admins they invite) can read submission content — respondents cannot see other respondents' data.
HIPAA compliance is a shared responsibility. To handle PHI in production you must also sign a Business Associate Agreement (BAA) with All Web Forms and follow HIPAA administrative, physical, and technical safeguards inside your own organization. Contact us to request a BAA.
How to turn it on
Open any form's Settings tab and toggle HIPAA mode. Existing submissions are not modified; the change applies to new notifications and audit log entries.