How fenfill protects your forms and your clients' answers

For a law firm, an accountant or anyone else handling client details, the useful question isn't whether a tool calls itself secure. It's which of your clients' details end up on someone else's servers, and for how long. With fenfill, the answers your clients type end up on none.

If you're deciding whether client forms belong in fenfill, start with what we actually keep. fenfill stores the blank form you set up, and what it needs to show that form to you and to the people you send it to. What your clients type, and the filled PDF they make, never reach our servers. Here are the main pieces, and how each one is handled.

The last step is worth spelling out. When your client finishes, they download the filled PDF: the same document, with their answers stamped on. They send it to you themselves, by email or however they usually send you files, and fenfill shows you that they've completed it. That signal carries no content. fenfill learns that the form was completed, never what it says.

So the return trip travels however your client chooses to send it. fenfill keeps the answers off our servers from the first keystroke to the download. It doesn't replace the way a finished document reaches you, and we won't pretend it does.

A form makes three stops between the moment you upload it and the moment your client sends the finished PDF back. Here is what each stop sees, and what it never does.

The data flow

Three stops, and what each one sees

Your upload, field detection, your client's browser.

1. 1

   You upload the blank form

   It's encrypted in your browser before it leaves, then stored in Stockholm.

2. 2

   fenfill finds the fields

   Page images of the blank form go to field detection, only when you run it. Forms that already have fillable fields skip it. Answers never go.

3. 3

   Your client fills it in their browser

   The answers and the filled PDF stay on their device until they download it and send it to you.

Encryption starts before the file leaves your computer. Your browser creates a new key for each PDF and encrypts the file with AES-256-GCM, so what travels to our storage is already encrypted.

That file key is then protected ("wrapped") on our server with a master key that's kept apart from the storage. The encrypted file sits in one place, and the key that opens it is locked with a key kept somewhere else. Someone who got hold of the stored PDF files alone would find only encrypted data, without the keys to open them.

Not everything gets that in-browser encryption. The page previews, the field layout and the form's text rely on our storage provider's disk encryption instead. Every connection to fenfill uses TLS, with HSTS switched on.

If you'd rather not upload a PDF at all, Quickfill fills a PDF in your browser without uploading it. You place the fields by hand, fill it and download it, and the file stays on your device.

Your data is stored and processed in the EU, with two exceptions: payments, handled by Stripe in the US, and field detection, which runs on Google's Gemini (more on that below).

Your database, files and sign-in live in Stockholm, with Supabase (eu-north-1). Processing runs in Helsinki, at Hetzner, and the site's web functions run in Stockholm, on Vercel.

The site's pages themselves are delivered through a global content delivery network. Your documents are stored in the places above. So when a client asks where their form is kept, you have a short answer: the blank form in Stockholm, and their answers nowhere but their own device.

fenfill is an EU-hosted business, governed by the GDPR. Each of our subprocessors works under a data processing agreement: Supabase, Hetzner, Vercel, Google (for field detection), Sentry (for error monitoring, in the EU) and Postmark (for our service emails). Payments are the exception: Stripe sells our paid plans as merchant of record and is responsible for that data itself. You'll find the full list on our privacy page, with what each one does.

fenfill uses AI to find the fields on flat and scanned forms. Detection runs only when you choose to run it, on the pages you pick. You can also set up a flat form entirely by hand, and then nothing goes to detection at all. If you run detection on a page a second time, that page is sent again.

Forms that already have fillable fields are read directly, and detection doesn't run on them. What detection finds becomes part of the template's field layout, stored as described above, and you can check and change every field in the editor before anyone fills the form.

Field detection runs on Google's Gemini under Google's paid API terms: page images are not used to train models. Google may process them outside the EU, under the Standard Contractual Clauses.

Detection sees whatever is on the pages you upload, so upload the blank form. If a PDF already has someone's details typed on it, those details are part of the page images too. If all you have is a filled copy, download a fresh blank one from wherever the form comes from.

Your account comes first. You sign in with Google or Microsoft, so fenfill has no passwords to store. Other workspaces are kept apart by rules enforced in the database itself (row-level security), and we test that isolation, including with a second real workspace trying to reach the first one's forms.

Then there are your share links. A public link can be opened by anyone who has it. A private link is made for one person. It works for whoever holds it, so send each one only to its person, and you can revoke it at any time. Revoking stops that person opening the form again, and cuts off its page images too. A public link suits a form many people fill, like a general intake sheet. It doesn't suit a form about one client's matter.

Private links are on Pro and up, and each one shows whether it's pending, opened or completed. Here's how private links work, step by step.

In your browser

fenfill runs no analytics, ad or tracking scripts, and no session recording. The only outside script is the payment provider's, and it loads on the checkout step only.

Every page carries a strict script policy: a nonce-based Content Security Policy. It tells the browser to run only scripts that fenfill's own pages start, which makes it much harder for code slipped into a page to run.

If your client stops halfway through a form, their answers are saved on their own device, encrypted, and cleared after they download the PDF or after 30 days of inactivity. That draft never reaches us.

Your documents stay in fenfill until you delete them. Everything else has a set lifetime:

• forms frozen after a plan change are deleted after 60 days
• unfinished answers on a filler's device clear after 30 days of inactivity
• remembered signatures clear after 30 days

Delete a template and the PDF, its page previews and the template are removed. Delete your account and everything in your workspace goes with it.

You delete your account from Settings in the dashboard. If you have an active paid subscription, cancel it first: the account can't be deleted while a subscription is running.

Deleting reaches what fenfill holds, not your clients' devices. A PDF a client has already downloaded stays with them, like any file you've sent by email.

Security pages often open with a row of badges. Here is our list of what we don't have yet. fenfill has no SOC 2 report and no ISO 27001 certification.

fenfill isn't HIPAA compliant and doesn't sign business associate agreements, so it isn't the place for patients' health information. If your work requires any of these, fenfill isn't the right fit yet, and we'd rather you knew that now than after you've set up your forms.

fenfill isn't end-to-end encrypted. Our servers can decrypt the PDFs you upload, for the reasons set out above.

Not everything happens in the EU. Payments are handled in the US, field detection runs on Google's Gemini and may be processed outside the EU, and the site's pages are delivered through a global network.

Signatures in fenfill are simple electronic signatures: a drawn, typed or uploaded image placed on the document. Whether one is enough depends on the document and who receives it, so check what they accept.

When any of this changes, this page changes first, and the date at the top moves with it.

Found a security problem? Email security@fenfill.com. Our contact details are also published at /.well-known/security.txt.

Tell us enough to reproduce it: the page or request involved, what you did and what you saw. Please don't access or change other people's data while you look, and give us a chance to fix the problem before you share it.