Your leads are yours.
Download every lead as a spreadsheet, any time, from your Leads screen.
RULE & FORM TRUST CENTER
Trust & security
Your business runs on its reputation. Here is exactly how we protect it.
Our promises
Your domain stays in your name.
We connect to the domain you own. We never register it for you or hold it.
We never contact your customers.
Every lead goes to you and nobody else.
We never sell your data,
or your customers' data. Not to advertisers, not to anyone.
Leave whenever you want.
Close your account in Settings. Your site goes offline and we delete your business details, website and leads within 30 days.
We tell you if something goes wrong.
If a security problem ever affects your data, we email you directly.
How we protect your business
01
Your data
- Stored in the United States, encrypted while it travels and while it is stored.
- Backed up every day.
- Each business's information is walled off from every other business inside the database itself, not only in our app.
02
Your account
- You sign in with a one-time code sent to your email. There is no password to steal or reuse.
- Your account pages cannot be shown inside another website, which blocks a common trick for getting people to click things they did not mean to.
03
Your website
- Every page is served over a secure connection.
- Lead forms are protected from bots by Cloudflare.
- Your site changes only when you approve it.
04
Payments
- Payments run through Stripe's secure checkout. We never see or store card numbers.
05
AI
- We do not use your data to train AI models. Our AI provider does not train on data we send it.
- AI-written words are checked before they reach a page, and you see your site before it goes live.
06
How we build
- Every change is tested automatically before it is released.
- Passwords and keys for our systems are never kept in our code.
- Every outside building block is locked to an exact version and checked automatically for known problems.
- Only Rule & Form's founding team can reach our production systems.
Who handles your data
| Company | What it does for us |
|---|---|
| Supabase | Database, sign-in and file storage (United States) |
| Vercel | Hosting for our app and your website |
| Stripe | Payments |
| OpenAI | AI writing |
| Cloudflare | Bot protection on forms |
| Resend | Email delivery |
| Textbelt | Text message alerts to you |
| Firecrawl | Reading public websites when we build or update your site |
| DataForSEO | Search data |
| PostHog | Product analytics |
| Proton | Our company email |
Only if you connect them: HighLevel and Jobber receive your leads when you turn on that connection.
Is Rule & Form SOC 2 certified?
Not yet. Our database, hosting and payment providers are independently audited (SOC 2 Type II), and we follow the same practices. If your company needs our security overview or a completed security questionnaire, email security@ruleandform.com and we will send it.
Security log
Locked every automated build step to an exact version. Turned on automatic alerts for known problems in outside code. Stopped our account pages being shown inside other websites. Removed an unused web address and an old review link. Added lead downloads and account closing.
REPORT A SECURITY PROBLEM
Report a security problem
If you think you have found a security problem in Rule & Form, email security@ruleandform.com. Tell us what you found and how to reproduce it.
If you act in good faith, avoid harming our customers or their data, and give us a fair chance to fix the problem before telling anyone else, we will not take legal action against you, and we will thank you here if you would like.
STATUS