By default, all plans (free and paid) are served over a 128-bit, SSL-encrypted connection which ensures that your data collected through forms, and viewed with reports, is protected.

Because emails sent from Wufoo are not encrypted, data sent via the email notifications should not be considered secure. Depending on the sensitivity of the information, you may want to stick to viewing data solely through our secure RSS feeds or API.

All our forms are served over SSL and are secure. Wufoo offers the ability to encrypt up to 5 fields for secure accounts on the Professional plan and higher. In addition to storing the data securely on our servers, encrypted fields will not be sent out in email notifications. This offers a good alternative if you absolutely need emails, but do not want certain data to be seen.

The best way to view your Wufoo account is at home or work using a secure connection to the internet. This isn’t always possible with travel, so when you are viewing your data from a public internet connection, be informed that your data is at risk.

Files will be transmitted securely to your Wufoo account. When it comes to downloading the file at a later date, there are a few notes you should take into consideration. All files are given a public URL — this means that if someone types in the URL, the file begins downloading. That said, the URL is encrypted and extremely difficult (if not impossible) to guess. This URL is available to you in the Wufoo Entry Manager and to anyone who receives email notifications for each form submission. Only share this URL with those you trust. When it comes to public reports, files are given a separate URL. This is so that when you delete the report, the files are no longer accessible. To sum up file downloads, there is an encrypted URL that will never change that you should share with those you wish to have permanent permission to a file, and then public URL’s for reports that only work as long as the report is available.

Wufoo's servers are managed in-house and located in a SOC 2, Type II audited facility that is located in the United States. The data center includes high-end surveillance equipment, security guards, visitor logs and passcards/biometric recognition. With fully redundant IP connections, independent connections to T1 access providers, redundant external and internal power supplies, daily security scans and encrypted offsite backups, you can rest assured that we are doing everything we can protect your valuable data.

We have an outside routing layer that provides basic filtering to handle and manage any potential denial of service attacks. All network traffic then has to pass through one of our redundant firewalls, which are heavily locked down and allow only specific services to be made publicly available. Additionally, we perform periodical scans, including quarterly PCI scans by McAfee, to look for any potential vulnerabilities in our network or publicly accessible software. In regards to employees, we force outside access to the servers to use a 128-bit encrypted connection along with a strong password strength.

We follow a large list of best practices to ensure server security. These include only installing needed services, diligent application of security updates/patches, detailed monitoring and file system integrity checking. We also have a very limited set of people authorized to access the servers (except through the public-facing services), with administrative access restricted to Momentive staff.

In addition to implementing features the increase security, we have to maintain best practices on the backend to ensure your account remains secure. We monitor sessions to restrict access of your account appropriately, and have constructed Wufoo in a way that every account is isolated. Safeguards are in place to try and detect common attacks such as SQL injection and cross site scripting. Most importantly, we actively review our code for potential security (in addition to evaluating all user feedback) so that we can address any issues as quickly as they arise.