Security by Design
How Forma safeguards your proprietary design decisions, assets, and authentication credentials.
AES-256-GCM Token Encryption
All OAuth integration tokens (Figma, Notion, Google Drive, Slack, GitHub) are encrypted at rest using AES-256-GCM authenticated cipher before reaching the database.
Encrypted Cloud Asset Storage
Uploaded prototype screenshots, wireframes, and design assets are hosted in secure encrypted cloud storage with signed URLs and fast edge delivery.
Zero Training on User Work
Your discovery notes, client case studies, and proprietary Figma frames are never used for public model training or shared with third parties.
Argon2id Password Security
User passwords are treated with state-of-the-art argon2id memory-hard hashing algorithms with automatic rate-limited lockout protection.
If you have identified a potential security vulnerability or have compliance inquiries, please email our engineering team: