Your clients trusted you with their information. We built the walls to match.

The promise that stands alone

Your clients stay your clients. We never market to your clients. Client information is never shared with another agency. The book you build here is yours. Our job is the software, not your relationships.

Verified on November 11, 2026.

The walls, one at a time

Your agency is its own locked room. Every agency on AllOneForm works inside its own separate space. Your client records are stored under your agency and opened only under your agency. A sign in from another agency cannot pull up your clients, because every record carries its agency with it and the system checks that match before it shows anything.

Verified on November 11, 2026.

Password guessing stops fast. Five wrong tries at a sign in locks the account. The wait grows with every try after that, up to a full hour. Twenty wrong tries from one address locks that address too. The lock answers the same way whether the name was real or invented, so guessing learns nothing.

Verified on November 11, 2026.

Document links carry a signature and an expiry. When a client sends you a dec page, the link it travels on is signed by our server and expires in 15 minutes. A link that was not signed by the server does not work at all. Our server will not even start in production without its signing secret in place.

Verified on November 11, 2026.

Driver invites live seven days and work once. When another driver gets a link to fill in their own part, that link expires in seven days. The moment it is used, it is done. An old link found in an inbox months later opens nothing.

Verified on November 11, 2026.

Social Security numbers stay optional and mostly out of sight. A client can skip the Social Security number and finish the intake without it. When a number is provided, your screens show the last four digits only. The same goes for license numbers. Your team sees what it needs to quote, and nothing more.

Verified on November 11, 2026.

Stored information is encrypted at rest, twice over. The database and the disks that hold intake records are encrypted at rest by our hosting provider, Render, with AES 256 encryption, covering the live database, its replicas, and its backups. On top of that, Social Security numbers and driver license numbers are encrypted a second time inside the application itself, with AES 256 encryption under a key that lives outside the database, so a copy of the database alone cannot read them. Your screens still show the last four digits only.

Verified on November 12, 2026.

A second step guards sign in. After the password, an account confirms it is really them with a 6 digit code, sent by email to the address on the account or read from an authenticator app for accounts that use one. The platform owner account requires this second step, and so does every agency head account by default. Producers can turn it on in Settings.

Verified on November 12, 2026.

Your data, in plain words

Your clients give their answers to you, through your link, under your brand. Their records live in your agency space inside our database. You can open them, work them, and export them for your rater. A client can skip the Social Security number and still finish. Your screens show the last four digits of Social Security and license numbers, and nothing more.

Verified on November 11, 2026.

How the product uses AI on client files

The product you sign in to today makes no AI calls on your client files. Document reading by AI is a designed step that arrives with the closed beta. When it arrives, the company that runs it joins the list below with a date, and this section will say exactly what it reads and what it never keeps. Our own company agents work under a hard rule: client data never enters them.

Verified on November 11, 2026.

Who else touches the data

Render runs the application and the database where intake records live. Cloudflare runs the network edge, the public site, and mail routing for our domain. Google holds the company mailbox that routed company mail lands in. GitHub holds our source code, and it never holds client data. Resend sends our platform email, such as sign in codes and password reset links, so it handles email addresses and those codes, never intake answers. That is the whole list today. When a new name joins it, the name appears here with a date before it touches any data.

List verified on November 12, 2026.

Status

The platforms we run on publish their own live status. Render status: status.render.com. Cloudflare status: cloudflarestatus.com. Our own health address answers at app.alloneform.com/api/health. This page prints no uptime figure. A figure appears only after 90 days of measured monitoring history exist, and it will be the measured figure.

Verified on November 11, 2026.

The incident log

This log starts today, November 11, 2026. Every outage and every security event that touches agency data gets an entry here with a date, what happened, and what we changed. An empty log with a start date is the honest version. We will never backfill one.

No entries yet.

What lands next, stated as a timeline

Today: the protections on this page, verified in our own code audit, with the dates shown. At the closed beta on January 11, 2027: the paid firewall tier, the monthly scan schedule with dated reports, and the backup restore rehearsal, each published here when it is done and not before. Later, funded by revenue: an outside penetration test at a stated revenue trigger, and formal compliance certification when agency buyers ask for it in procurement. We publish each step when it happens. We do not print badges for work that has not happened.