Govform.com
Skip to article
DocumentationGuides & reference

Search across guides and reference articles. Try “email”, “API” or “conditions”.

Security & assurance

How is data stored and protected?

Govform protects service data with encryption, UK hosting, scoped access controls and configurable retention—giving your team practical control over sensitive information.

Protection runs through the service: who can sign in, who can see live responses, where evidence is stored and how long information is kept. You can align those choices with the purpose and risk of each journey.

Protection throughout the data lifecycle

  • Encrypted connections and storage. Service data is encrypted in transit and at rest.
  • UK hosting today. Current application and platform storage hosting is in the UK. EU, USA and Canada regional options are planned.
  • Library-scoped access. Service libraries form the tenant and permissions boundary, with membership and role checks governing access.
  • Separate live-data permissions. Teams can design services and view summary analytics without being granted access to individual Production submissions.
  • Configurable retention. Set service-data retention to reflect how long the information is needed, with platform cleanup handling expiry.
  • Traceable activity. Audit records support investigation of journey events, validation, uploads and workflow activity.

Choose where uploaded evidence belongs

Files can use Govform storage or your configured SharePoint, Amazon S3, Google Cloud Storage or Azure Blob Storage connection. Choose the protection around your evidence and storage requirements:

  • Govform-managed storage: configured antivirus scanning processes files in place.
  • Your own supported store: choose Govform scan-first, parallel scanning or no Govform AV where your destination supplies the agreed controls. Parallel transfer can reach the destination before scanning finishes.
  • Document and image privacy: CDR scans first before reconstructing supported single-file uploads; JPEG/PNG processing can resize images, remove metadata and blur detected faces through CDR.

General uploads support up to 20 GB per file where configured, while current external-store Govform AV transfers support up to 5 GB and CDR defaults to 50 MB. Lower configured limits can apply. Compare storage choices, scanning modes and processing limits.

External storage keeps its own access and retention policies. For example, files stored in SharePoint are retained and removed through your SharePoint arrangements, so the service and file-store policies should work together.

Our Security & Trust Centre brings hosting, security controls, certifications and data protection information together for your assurance review.