Data Protection & Security
At ExForms, we understand that your templates and data may contain sensitive information. This page explains the comprehensive security measures we implement to protect your data at every stage.
Our Security Principles
🔒 Zero Trust Architecture
We assume all data is sensitive and apply maximum protection by default. Your credentials, templates, and generated documents are protected using industry-standard encryption and security practices.
We assume all data is sensitive and apply maximum protection by default. Your credentials, templates, and generated documents are protected using industry-standard encryption and security practices.
| Principle | Implementation |
|---|---|
| Encryption at Rest | All uploaded templates are encrypted using AES-256 with Azure Key Vault managed keys |
| Encryption in Transit | All connections use TLS 1.2+ (HTTPS) |
| Minimal Data Retention | Generated documents are deleted immediately after download |
| Credential Isolation | Connection credentials are stored in Azure Key Vault, never in our database |
| Container Isolation | Each service runs in isolated Docker containers |
Template & File Encryption
How Your Files Are Protected
When you upload a template (PDF, Word, or PowerPoint), the file is immediately encrypted before being stored:
┌─────────────────────────────────────────────────────────────────┐
│ FILE UPLOAD PROCESS │
├─────────────────────────────────────────────────────────────────┤
│ │
│ 1. You upload a template file │
│ │ │
│ ▼ │
│ 2. File is encrypted using AES-256 │
│ • Unique encryption key generated per file │
│ • Key is wrapped using Azure Key Vault RSA key │
│ │ │
│ ▼ │
│ 3. Encrypted file stored in database │
│ • Only ciphertext is stored │
│ • Original plaintext never persisted │
│ │ │
│ ▼ │
│ 4. When you generate documents: │
│ • File is decrypted in memory │
│ • Processing occurs in isolated container │
│ • Decrypted data never written to disk │
│ │
└─────────────────────────────────────────────────────────────────┘
Encryption Technology
We use envelope encryption, the same approach used by major cloud providers:
| Layer | Technology | Purpose |
|---|---|---|
| Data Encryption Key (DEK) | AES-256-CBC | Encrypts your actual file content |
| Key Encryption Key (KEK) | RSA-OAEP (Azure Key Vault) | Protects the DEK |
| Key Management | Azure Key Vault (HSM-backed) | Secure key storage with access logging |
Why this matters:
- Each file has its own unique encryption key
- Even if the database were compromised, encrypted data is useless without the Key Vault
- Azure Key Vault provides hardware security module (HSM) protection
- All key access is logged and auditable
Immediate Data Deletion
Generated Documents
When you click "Send Data to Templates" and download the filled documents:
- Processing occurs in memory - Your data and templates are processed in RAM
- Temporary ZIP created - The output ZIP file is created temporarily
- Download begins - File streams directly to your browser
- Immediate cleanup - The ZIP file is deleted from the server immediately after download
┌─────────────────────────────────────────────────────────────────┐
│ DOCUMENT GENERATION LIFECYCLE │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Generate Documents │
│ │ │
│ ▼ │
│ ┌─────────────────┐ │
│ │ Process in RAM │ ← Templates decrypted in memory only │
│ │ (never on disk) │ │
│ └────────┬────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────┐ │
│ │ Create ZIP │ ← Temporary file, unique random name │
│ │ (temp folder) │ │
│ └────────┬────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────┐ │
│ │ Stream download │ ← Direct to your browser │
│ └────────┬────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────┐ │
│ │ DELETE FILE │ ← Immediately after download completes │
│ │ (automatic) │ │
│ └─────────────────┘ │
│ │
│ ⏱️ Total time on server: seconds, not stored │
│ │
└─────────────────────────────────────────────────────────────────┘
API Downloads
For API users, download URLs are:
- Time-limited - Valid for 1 hour maximum
- Single-use - Can only be downloaded once
- Auto-deleted - Cleaned up automatically on expiration or after download
Connection Credential Security
When you configure connections to databases, SharePoint, Salesforce, or other services, your credentials require special protection.
The Problem We Solve
"I need to connect to my company's MySQL database, but I don't want my password stored in a way that could be compromised."
Our Solution: Azure Key Vault
We never store credentials in our application database. Instead:
┌─────────────────────────────────────────────────────────────────┐
│ CREDENTIAL STORAGE ARCHITECTURE │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Our MySQL Database Azure Key Vault │
│ ┌─────────────────────┐ ┌─────────────────────┐ │
│ │ │ │ │ │
│ │ ✓ Connection name │ │ ✓ Actual password │ │
│ │ ✓ Host/port │ │ ✓ OAuth tokens │ │
│ │ ✓ Database name │ │ ✓ API keys │ │
│ │ ✓ Secret REFERENCE │────────▶│ ✓ SSH certificates │ │
│ │ (not the secret) │ │ │ │
│ │ │ │ HSM-backed │ │
│ │ ✗ NO passwords │ │ Access logged │ │
│ │ ✗ NO tokens │ │ RBAC controlled │ │
│ │ ✗ NO certificates │ │ │ │
│ │ │ │ │ │
│ └─────────────────────┘ └─────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Azure Key Vault Benefits
| Feature | Benefit |
|---|---|
| HSM-backed storage | Cryptographic keys protected by hardware security modules |
| Access logging | Every credential access is logged and auditable |
| RBAC permissions | Fine-grained access control |
| Automatic rotation | Support for credential rotation without code changes |
| Compliance | SOC 2, ISO 27001, HIPAA, and other certifications |
How It Works
- You configure a connection - Enter database host, username, password
- Password sent to Key Vault - Encrypted in transit, stored securely
- Reference stored locally - We only keep a pointer (like
conn-123-cred) - When connection is used - We retrieve the credential from Key Vault just-in-time
- Credential never cached - Retrieved fresh each time, used in memory only
Infrastructure Security
Docker Container Isolation
Our application runs in isolated Docker containers:
┌─────────────────────────────────────────────────────────────────┐
│ CONTAINER ARCHITECTURE │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────────────┐ │
│ │ NGINX │ │ WebApp │ │ MySQL │ │
│ │ (reverse │──▶│ (.NET 10) │──▶│ (database) │ │
│ │ proxy) │ │ │ │ │ │
│ │ │ │ Processes │ │ Stores encrypted │ │
│ │ SSL/TLS │ │ templates │ │ templates only │ │
│ │ termination │ │ in memory │ │ │ │
│ └─────────────┘ └─────────────┘ └─────────────────────┘ │
│ │ │ │ │
│ └──────────────────┴────────────────────┘ │
│ Isolated Docker Network │
│ (no external access to MySQL) │
│ │
└─────────────────────────────────────────────────────────────────┘
Network Security
- MySQL not exposed - Database only accessible from within Docker network
- NGINX reverse proxy - All traffic goes through hardened proxy
- TLS 1.2+ only - Modern encryption for all connections
- HTTPS enforced - HTTP automatically redirects to HTTPS
Server Security
- Regular updates - Ubuntu LTS with automatic security patches
- Firewall configured - Only ports 80 (HTTP→HTTPS redirect) and 443 (HTTPS) open
- SSH key authentication - No password-based SSH access
- Fail2ban protection - Automatic blocking of suspicious activity
What We Don't Store
To be completely transparent, here's what we explicitly do not store:
| Data Type | Stored? | Notes |
|---|---|---|
| Your Excel data | ❌ No | Sent for processing, never persisted |
| Generated PDFs/Word/PPT | ❌ No | Deleted immediately after download |
| Connection passwords | ❌ No | Stored in Azure Key Vault only |
| OAuth tokens | ❌ No | Stored in Azure Key Vault only |
| API keys for services | ❌ No | Stored in Azure Key Vault only |
| Your original template (unencrypted) | ❌ No | Only encrypted version stored |
What We Do Store
| Data Type | Stored? | Purpose |
|---|---|---|
| Template files (encrypted) | ✅ Yes | So you can reuse templates |
| Field mappings | ✅ Yes | Remember how fields connect to Excel |
| Connection settings (non-sensitive) | ✅ Yes | Host, port, database name |
| Usage logs | ✅ Yes | For billing and troubleshooting |
| Account information | ✅ Yes | Email, company name, subscription |
Compliance & Certifications
Azure Key Vault Certifications
Our credential storage uses Azure Key Vault, which is certified for:
- SOC 1, SOC 2, SOC 3
- ISO 27001, ISO 27017, ISO 27018
- HIPAA
- FedRAMP
- PCI DSS
Our Practices
- GDPR compliant - Data export and deletion on request, minimal data retention
- Security audit logging - All sensitive actions (template operations, data exports, credential access) are logged
- 72-hour incident notification - Committed to notifying affected users within 72 hours of a security incident
- Encryption by default - No opt-in required, all templates encrypted at upload
Audit & Compliance
Security Audit Logging
All security-sensitive actions are logged to an audit trail, including:
| Action Type | What's Logged |
|---|---|
| Template Operations | Upload, delete, access to encrypted templates |
| Data Exports | GDPR data export requests |
| Credential Access | Every time connector credentials are retrieved from Key Vault |
| Incident Management | Security incident creation and notifications |
Audit logs include:
- Timestamp
- User ID and Company ID
- IP address
- Action type and target
- Success/failure status
Data Retention
| Data Type | Retention Period |
|---|---|
| Generated documents | Deleted immediately after download |
| Sync operation logs | 90 days |
| Error logs | 30 days |
| Security audit logs | 1 year |
Best Practices for Users
While we protect your data, here are additional steps you can take:
Template Security
- Remove unnecessary sensitive data - If test data is in your template, clear it before uploading
- Use field placeholders - Don't embed real SSNs or account numbers in templates
Connection Security
- Use least-privilege accounts - Database users should only have necessary permissions
- Enable SSL for databases - Always use SSL/TLS for database connections
- Rotate credentials regularly - Change passwords periodically
Account Security
- Use strong passwords - Or better, use Microsoft/Google sign-in
- Review team access - Periodically audit who has access to your templates
- Monitor usage - Check the usage logs for unexpected activity
Questions?
If you have questions about our security practices or need additional documentation for compliance purposes, please contact us:
- Email: [email protected]
- Support: [email protected]
We're happy to provide additional information for your security review or compliance requirements.