Security, made clear.

HTTPS protects information sent between your browser and Klarstig. Connection encryption is separate from encryption of stored data.

A form mode using customer-held decryption keys is not currently available. Existing connection and storage protections are described separately.

Rate limits and automated-abuse checks help reduce unwanted submissions. These protections do not guarantee that every spam submission will be blocked.

Access controls protect private submissions and files. Sharing a public form must not expose the responses submitted by other people.

Connection encryption and encryption of stored form data protect different parts of the service. Customer-held encryption keys are a separate capability.

CAPTCHA availability is under review. Existing spam controls should not be interpreted as proof that a CAPTCHA challenge is enabled.

Klarstig provides tools for privacy requests and data export. GDPR responsibilities also depend on your use, the applicable agreements, and how information is processed.

Privacy-request tools support handling of California privacy requests. Applicable rights and responsibilities depend on the processing activity and each party’s role.

A FERPA-specific offering has not yet been verified. Education-record use requires a review of the institution’s requirements, permitted processing, and applicable terms.

Security features work alongside the applicable privacy notices, service terms, and data-processing agreements. Requirements vary with your location and use of the service.

Review the privacy controls available for your account and forms. Collection choices, sharing settings, and retention should match your intended use.

An EU data-residency option is not currently available. We do not promise that all storage, processing, support access, or backups remain within the EU.

Location-data features are under review. A visitor’s location does not determine where their data is stored.

Two-factor authentication adds a verification step to account sign-in. Protect recovery methods as carefully as your password.

OpenID Connect (OIDC) single sign-on is available to organizations. An organization owner or admin configures the connection and enables it only after verifying an email domain and passing a connection test; each organization keeps password sign-in until it opts in. SAML 2.0 single sign-on is also available, using the same admin-configured, domain-verified, opt-in flow. Only service-provider-initiated sign-in is supported; identity-provider-initiated sign-in and federated single logout are not offered, so signing out ends your Klarstig session locally.

Account protections include authentication, permissions, session controls, and security records. Keep your credentials and recovery methods private.

Organization administrators can manage supported session and IP-access policies within platform safeguards. Available settings do not remove the platform’s baseline protections.

Organization owners can download a scoped backup using a time-limited private link. Downloadable archives are separate from platform disaster-recovery backups.

A contractual service-level commitment has not been verified for this page. Availability monitoring alone is not an uptime guarantee.

Hosting and data-center details are under review. Any provider assurance must be distinguished from an assessment of Klarstig’s own service.

Platform backup and recovery details are under review. Retention, recovery targets, and restore capabilities will be described only for verified operations.

Secure development includes input validation, access checks, and controlled changes. These practices reduce risk but do not guarantee vulnerability-free software.

Security testing, independent penetration testing, and assurance audits are different activities. This page will identify only assessments supported by current evidence.

Network protections complement application access controls. Available protections depend on the hosting configuration and the responsibilities assigned to each provider.

Klarstig’s PCI DSS validation status is under review. A payment provider’s validation does not establish Klarstig’s own compliance.

HIPAA-enabled forms and a customer BAA offering are not currently available. Do not use Klarstig to collect protected health information requiring that arrangement.

Klarstig does not currently offer a StateRAMP/GovRAMP-verified service. A hosting provider’s status does not extend automatically to Klarstig.

An independent SOC 2 report for Klarstig is not currently available. We will identify the report type and scope if an examination is completed.

An evidence-backed HECVAT response is being prepared. A completed, reviewed questionnaire is not currently available.

ISO/IEC 27001 certification for Klarstig is not currently available.