Security & privacy
This page lists protections that are built into Client Form Portal today. We have not completed a third-party security audit or certification, and we don't claim one.
Banking information
- Banking details are encrypted on our servers (AES-GCM) before they are stored. They are never sent to the agent's browser until the agent re-enters their password to reveal them.
- Each request uses a private, expiring link plus a one-time code sent to the client. Links can be revoked or replaced at any time.
- Banking details can't be revealed while a screen share is active, and they are never sent through the screen-sharing stream.
- Stored banking details are purged automatically after a retention period, and agents can delete them sooner.
- Reminder emails and texts never contain links or codes.
Screen sharing
- View-only. No remote control, recording, microphone, camera or system audio.
- The agent chooses exactly which tab, window or screen to share in the browser's own picker.
- Clients need no account or download, and must be let in by the agent. Ending a session invalidates the link.
- No screen recordings are made or stored.
Accounts and access
- Every tool checks the agent's plan, seat and permissions on our servers, not just in the app.
- Each agency's data is kept separate by database access rules; removing a seat ends access immediately.
- Billing changes come only from verified payment-provider events.
Privacy
- Usage analytics are first-party and record only page paths and plan type — never client names or banking data.
- Provider secrets stay on our servers; the Chrome extension holds no secrets.
Questions? See our privacy notice and terms.