AI Agents

Jotform Secure AI Agents

At Jotform, our reputation rests on our ability to provide all of our users with the highest form security.

Jotform Secure AI Agents

AI Agents Security

At Jotform, your security and privacy are our top priorities. We are committed to protecting your data and providing a secure environment for all users. Our AI Agents are designed with robust security measures to ensure your information remains safe, confidential, and compliant with global standards.

AI Data Security

Jotform AI Agents are protected by Jotform’s comprehensive security standards, including adherence to robust enterprise security measures and secure data storage within Jotform’s SOC 2–compliant infrastructure. Learn more about Jotform’s security protections by reviewing our security features.

For AI processing, we use OpenAI technology. OpenAI does not store any data and automatically deletes all information after generating responses. Learn more about how OpenAI protects partners’ data by reviewing its security policies and features.

AI Model Security

We leverage the advanced capabilities of OpenAI’s GPT-4o technology to power Jotform AI Agents via OpenAI’s API Platform. OpenAI is committed to data privacy and security. OpenAI stores API Platform user data for 30 days for abuse-identification purposes, after which data is removed from OpenAI systems. OpenAI doesn’t use API Platform user data for training purposes.

To learn more about OpenAI’s comprehensive security practices, review its security policies and features.

Model Training

We leverage OpenAI’s GPT-4 technology to power intelligent and responsive AI agents. While we use your form and form field content to personalize and optimize your AI agent experience, your data is not used to train or improve our underlying AI systems.

OpenAI is committed to data privacy and security. Although all data is processed in real-time, please note that, for debugging and monitoring purposes, OpenAI retains user data for up to 30 days. More details can be found in the "How does OpenAI handle data retention and monitoring for API usage?" section on their Enterprise Privacy page.

Model Accuracy

Errors in AI-generated content are uncommon but remain an inherent risk in generative AI systems. Jotform proactively addresses this challenge through a twofold approach:

Retrieval-Augmented Generation (RAG): Jotform utilizes the RAG technique to ensure all generated responses and search results are based on accurate, verified information from an agent’s knowledge base, significantly reducing the chances of incorrect or misleading outputs.

Continuous monitoring and improvement: Jotform’s development team regularly reviews AI-generated responses flagged by users for negative feedback. This continuous analysis helps us enhance detection tools and implement safeguards to automatically identify and prevent inaccurate or unreliable responses in the future.

Why is Jotform Secure?

Ensuring the privacy and security of your data is a top priority for us. You can rest easy knowing that we take every precaution to provide an online form service with high grade security.

PCI Certification
Jotform is PCI DSS Service Provider Level 1 compliant, the highest security attainment you can have as a business that collects payments from and integrates with credit cards. Read more
GDPR Compliance
Jotform complies with the European Union’s General Data Protection Regulation (GDPR), which governs businesses that collect personally identifiable information from or on EU citizens. Read more
CCPA Compliance
Jotform complies with the California Consumer Privacy Act (CCPA), which, among other things, prohibits the selling of personal information of California residents without their consent. Read more
HIPAA-Friendly Agents
We utilize Google's Gemini Models via Vertex AI for our HIPAA-compliant accounts, as it provides a Business Associate Agreement (BAA) to ensure compliance with HIPAA regulations. Learn how Jotform enables HIPAA compliance. Read more
StateRAMP
Jotform Government has been built and is being managed according to security controls common to both FedRAMP and StateRAMP, as documented in NIST Special Publication 800-53 Revision 5. Jotform is currently in the security snapshot Program of StateRAMP. Read More
SOC 2 Compliance
Jotform is committed to upholding all five SOC 2 Trust Service Principles: security, confidentiality, availability, privacy, and processing integrity. We offer a SOC 2 compliance solution to our Enterprise customers. Learn more about how Jotform Enterprise protects your organization’s data. Read More
FERPA Compliance
We work with educational organizations to provide transparency about the handling and processing of students’ personal information in our forms, apps, and other products to aid customers in achieving compliance with FERPA. Read More
Agent Privacy
In the Agent Builder’s share settings, you can make agent access public or invite-only, or limit it to your company.
HECVAT
Jotform has used the Higher Education Community Vendor Assessment Toolkit, also known as HECVAT, to assess our Enterprise product and ensure the security and safety of our higher education partners. Read More
G-Cloud 14
Jotform Enterprise is now an approved supplier on the Crown Commercial Service’s G-Cloud 14 framework. Our platform ensures top-tier security for public sector organizations with enhanced data protection, local data residency, and stringent security measures to meet the highest UK government standards. With G-Cloud 14 approval, Jotform Enterprise ensures secure data collection and management for government agencies and public sector bodies. Read More
How can you make your forms even safer?

How can you make your agents even safer?

Jotform AI Agents offer different privacy settings. These settings let you choose your preferred level of privacy.

Set the privacy of your agents and data
Access to agent conversations is protected and requires a login to the account that set up the agent. However, you can grant access to the people in your organization or make your data completely public. Since you have total ownership of how your agents are used as well as forms, submissions, and conversations, third-party access to your data requires your specific permission when you use an integration or widget. Rest assured that we treat your data with the utmost confidentiality. For more information, see our AI policy.
Two-factor Authentication (2FA)
Enhance the security of your Jotform account with our two-factor authentication (2FA) feature. With 2FA enabled, your account gains an extra layer of protection by requiring a second form of verification alongside your password. Safeguard your data and prevent unauthorized access with this advanced security measure.
Keep your European user data in EU servers

You can store your data in the European Union (EU) by enabling the appropriate option in the Data window of your account settings. After confirmation, your data will be moved to our European servers in Frankfurt, Germany, which are run by Google. Once the transfer is complete, you’ll be automatically redirected to eu.jotform.com upon login. There’s no need to worry about the safety of your data. Jotform complies with the EU’s General Data Protection Regulation (GDPR).

With Jotform Enterprise, you can use geolocalization to host form and agent data on servers in almost any part of the world. Since many countries — including Australia — have laws requiring this, it can be an invaluable tool for global businesses.

Service level agreements
Jotform has a near-perfect uptime ratio of 99.9 percent, so you should always be able to access your data. You can check Jotform’s operational status in real time. Our Jotform Enterprise service promises to meet the error response rates, resolution times, and uptime ratios outlined in your specific service level agreement (SLA). If these goals aren’t met as an Enterprise customer, you will receive a credit for a period of free use of our platform, as specificed in your agreement.
What other measures do we take to protect your data?

What other measures do we take to protect your data?

When it comes to form security, availability, and high performance, we go the extra mile. We do our homework to keep our services secure.

Data centers

Jotform servers are colocated in a cloud-based architecture with Google Cloud and Amazon Web Services (AWS). Google Cloud data centers are hosted in Iowa (US) and Frankfurt (Germany, EU). AWS data centers are located in Virginia (US) and Frankfurt (Germany, EU).

Google Cloud servers host our redundant application and data servers in active-active configuration, and all data is replicated to AWS servers on an hourly basis for backup purposes. This provides platform-level redundancy in addition to the redundancy obtained with multiple servers within a single platform. In case we need to switch from the primary platform (Google Cloud) to the secondary platform (AWS), this architecture helps us recover from a platform-level outage. All data remains in-region, so EU data always resides in the EU.

Hosting Jotform on these major cloud platforms also provides us with some extra benefits through implementation of security best practices in areas like hardware life-cycle management, physical security, and network infrastructure. Our servers are regularly updated and patched.

Local data residency center locations
If you’re a Jotform Enterprise user, you can choose the physical location of your local cloud data residency center and host your data from any number of places in the world. This is especially important for complying with data privacy rules and location requirements in places such as Australia, Canada, the UK, and the EU. Whether you choose to keep your data server close to home or to your audience, you’ll enjoy better security, reliability, and site latency. Only users and admins within your Enterprise account will be able to access your data server.
Backup policy/business continuity
We continuously replicate your data between multiple servers hosted by our primary service provider, Google Cloud (backup in real time). Additionally, all data is replicated to AWS (our secondary platform) by way of hourly snapshots. Each snapshot is stored for 30 days in the cloud environment. All data remains in-region, so EU data always resides in the EU zone.
Single Sign-On (SSO)

With an Enterprise account, you can enable single sign-on (SSO) to boost security while making it easier for your employees to work together to run your business. Choose from multiple login methods, track user actions, and maintain control of your account’s security.

Jotform Enterprise supports SAML user authentication and popular SSO solutions such as Active Directory, Okta, Google, and OneLogin. Multi SSO allows you to authenticate users through multiple identity providers simultaneously, such as Google and Microsoft. This enhances flexibility and security for dispersed teams and organizations with various authentication needs.

Use SSO to protect internal forms with Jotform Enterprise. With SSO, users must be authenticated before viewing or filling out forms, ensuring sensitive employee data is securely collected.

Encouraging best coding practices

In addition to implementing features that increase security, we maintain best practices on the backend to ensure that your account remains secure. We monitor sessions to restrict access to your account appropriately, and have constructed Jotform so that every account is isolated.

We have safeguards in place to detect common attacks, such as SQL injection and cross-site scripting. Most importantly, we actively review our code for potential security concerns (in addition to evaluating all user feedback) so that we can address any issues as they arise. Our privacy statement speaks to our level of commitment in ensuring your data isn’t misused.

All developed code is deployed to the production environment only after certain procedures, including test runs on staging systems. Our continuous deployment system and development process allow us to rapidly update and patch our system whenever needed.

Security audits

PCI scans are regularly performed to detect any kind of vulnerability in our publicly available interfaces. Each quarter, internal and external Approved Scanning Vendor (ASV) tests are performed for PCI. In addition to these PCI scans, penetration tests are performed periodically.

We also have a bug bounty program for which we pay outside parties to report vulnerabilities. This ensures that we are the first to know about any bugs. We fix all high-priority issues reported to our bug bounty program as quickly as possible.

Network security

We have an outside routing layer from CloudFlare that provides basic filtering to handle and manage any potential DDoS (denial of service) attacks. Security scans are performed periodically as described in the audits/VA/PT chapter. Our servers are configured to allow only the absolute minimum level of access needed to maintain them.

All unnecessary users, protocols, and ports are disabled and monitored. Our employees are able to access the servers only through a virtual private network using a 2048-bit encrypted connection with private keys. In addition to third-party security services, our experienced development operations team continuously monitors any suspicious behavior for the entire system.

Account security
All account information is automatically encrypted when transferred. Only you have access to your agents, forms, and submissions. You may add multiple users to your account with Jotform Enterprise.
Customizable security options
No matter what industry you work in, Jotform wants to help you create the ideal security controls for your needs. As an Enterprise user, you can easily request to enable, disable, or add specific security settings to your local data residency center. Contact our Enterprise team to learn more.

FAQ

  • Is my data safe with Jotform AI Agents?

    Our AI agents use advanced security measures, including end-to-end encryption, secure data storage, and strict access controls to ensure your information is always protected. Data is encrypted both in transit and at rest to prevent unauthorized access.

  • How does Jotform use the data collected through AI Agents to improve its services?

  • What compliance standards do your AI agents meet?

  • Does the AI service store my data?