Security overview
How FormBridge isolates every organization, signs you in without passwords, logs every agent decision, and encrypts long-lived secrets.
FormBridge holds some of the most sensitive records a company has — its incorporation documents, its EIN, its bank connection, its books, and its tax packets. The platform is built so that this data stays yours, stays isolated from every other customer, and stays auditable. This page explains the security model in plain terms; you can read the summary for teams on the security page.
Strict organization isolation
Every company on FormBridge belongs to an organization, and every database query and server action is scoped to the organization you're signed into. There is no shared view: an agent run, a filing, a document, or a transaction is only ever reachable from within the org that owns it. This multi-tenant isolation is enforced on the server for every request, not just hidden in the interface.
Sign-in without passwords
FormBridge never stores a password. You sign in one of two ways: a magic link sent to your email, or Google single sign-on. Both prove you control an account you already trust, and there's no password for an attacker to guess, reuse, or leak in a breach.
Because sign-in is tied to your email, the security of your email account is the front door to FormBridge. Turn on two-factor authentication with your email or Google provider to protect it.
An auditable trail of every decision
Every action an autopilot takes is recorded as an AgentRun — an append-only log entry capturing the prompt, the tools it called, what it cost, and the outcome. Records are never silently rewritten; new events are appended and derived state is recomputed. That means you can always answer "what did the agent do, and why?" after the fact. Read more in how the autopilots work.
Encryption and signed access
- Long-lived secrets are encrypted at rest. Sensitive credentials like your bank connection token are stored with AES-256-GCM encryption, not in plain text.
- Document links are signed and expire. Every file in your vault is served through a signed, HMAC-based URL that can't be forged and doesn't stay valid forever.
- Bank connections are read-only. The Bookkeeping agent reads transactions through Plaid; it can never move money.
Want to see who can access what inside your company? That's governed by roles — see roles and permissions.