Data Processing Agreement
Effective Date: February 11, 2026 | Last Updated: October 8, 2026
This Data Processing Agreement ("DPA") is entered into by and between QuikForms, LLC, an Oregon limited liability company ("Processor" or "QuikForms"), and the customer that has agreed to the QuikForms Terms of Service ("Controller" or "Customer"), each a "Party."
This DPA supplements and forms part of the Terms of Service and any Order under them (together, the "Principal Agreement"). It applies automatically when the Customer accepts the Principal Agreement, without a separate signature. A signed copy is available on request to privacy@sfquikforms.com. If this DPA conflicts with the Principal Agreement, this DPA prevails with respect to the processing of Personal Data. If this DPA conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail.
1. Definitions
Capitalized terms not defined here have the meanings given in the Principal Agreement.
- "AI Gateway" means the service the Processor operates on the Cloudflare Workers platform of Cloudflare, Inc., at
https://ai-gateway.sfquikforms.com, through which AI requests that use the AI included in the Controller's plan pass to the AI Sub-processor, as described in Annex V. - "AI Sub-processor" means Anthropic PBC.
- "Applicable Data Protection Law" means all laws and regulations that apply to the processing of Personal Data under this DPA, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection ("FADP"), the CCPA, and other U.S. State Privacy Laws.
- "CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its regulations.
- "Controller" means the Customer, which, alone or jointly with others, determines the purposes and means of processing Personal Data. Where the Customer processes Personal Data as a processor for its own customer, "Controller" refers to the Customer in that capacity.
- "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.
- "GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as it forms part of the law of the United Kingdom.
- "Managed Package" means the QuikForms software distributed through the Salesforce AppExchange as a managed package, which is installed in and runs within the Controller's Salesforce organization ("Org").
- "Personal Data" means any information relating to a Data Subject that the Processor processes on behalf of the Controller under the Principal Agreement, as further described in Annex I.
- "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed by the Processor or its Sub-processors.
- "Processing" (and "Process") means any operation performed on Personal Data, whether or not by automated means.
- "Processor" means QuikForms, LLC, which processes Personal Data on behalf of the Controller.
- "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries annexed to Commission Implementing Decision (EU) 2021/914.
- "Sub-processor" means any third party the Processor engages to process Personal Data on behalf of the Controller.
- "Supervisory Authority" means an independent public authority responsible for monitoring the application of Applicable Data Protection Law.
- "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
- "U.S. State Privacy Laws" means the CCPA and the comprehensive consumer privacy laws of other U.S. states, to the extent they apply to the Processing.
2. Scope and Roles
2.1 Roles of the Parties
With regard to the Processing of Personal Data under this DPA, the Customer is the Controller (or a processor acting for its own controller) and QuikForms is the Processor (or sub-processor). QuikForms shall Process Personal Data only on behalf of the Controller and in accordance with its documented instructions.
2.2 Nature of Processing
The Managed Package's code runs inside the Controller's own Org and performs the following Processing there:
- (a) receiving form field values submitted by Data Subjects, through the Managed Package's REST endpoint for forms on Salesforce Sites or its Apex controller for forms on Experience Cloud sites;
- (b) validating submitted values against the form's required fields, validation patterns, and blocking rules;
- (c) where the Controller has configured Cloudflare Turnstile, sending the CAPTCHA token from the Controller's Org to Cloudflare for verification, under the Controller's own Turnstile keys;
- (d) creating Salesforce records in the Controller's Org, and storing uploaded files and signatures as Salesforce files linked to them;
- (e) computing a keyed hash (HMAC-SHA256) of the visitor's IP address and the date, with a key held in the Controller's Org, to count unique visitors, and recording device category, browser type, referrer domain, and engagement counts for analytics;
- (f) where the Controller enables it for a form, writing the visitor's IP address and user agent to the record the submission creates;
- (g) writing exception logs, which may include the visitor's IP address, user agent, and page address, after redacting sensitive keys from structured data;
- (h) on the Professional plan, publishing Platform Events in the Controller's Org that carry submitted values, and the visitor's IP address only where the Controller has enabled the recording described in (f) for the form, for the Controller's own automations;
- (i) keeping the values a visitor has typed in the visitor's own browser tab (session storage) so they survive a reload, unless the Controller turns this off for the form; and
- (j) where the Controller uses the AI features, sending the data described in Annex V to the AI Sub-processor in response to an action by one of the Controller's administrators: through the AI Gateway when the Controller uses the AI included in its plan, or directly where the Controller uses its own Anthropic API key.
2.3 Processing Architecture
All Personal Data the Managed Package processes is stored in the Controller's Org and is subject to the Controller's own Salesforce security and access controls. The Processor does not maintain separate infrastructure for storing it, and the Managed Package sends no usage telemetry to the Processor. Outside the Controller's Org, the Processor operates one service in the Processing path: the AI Gateway, which carries AI requests that use the AI included in the Controller's plan, holds their content only while a request is in transit, and does not store or log it (Annex V).
2.4 Processor Access
The Processor has no standing access to the Controller's Org. Its personnel can access Personal Data in the Controller's Org only if the Controller grants login access through Salesforce for a support request, and then only for as long as the Controller allows and only to provide the support requested. Personal Data the Controller chooses to include in a support request (for example, a screenshot or a log excerpt) is Processed under this DPA.
2.5 Data Outside This DPA
The Processor processes, as a controller, information about the Customer's own account, licensing, billing, AI entitlement and usage totals, and correspondence, as described in its Privacy Policy. That processing is not governed by this DPA.
3. Controller's Instructions
3.1 Documented Instructions. The Processor shall Process Personal Data only on the documented instructions of the Controller, including with regard to transfers of Personal Data to a third country, unless required to do otherwise by law to which the Processor is subject, in which case the Processor shall inform the Controller of that requirement before Processing unless the law prohibits it.
3.2 Scope of Instructions. The Controller's instructions are set out in this DPA (including Annex IV), the Principal Agreement, and the Controller's configuration of the Managed Package, including the forms and fields it defines, the target objects, the optional features it turns on or off, its retention settings, and its use of the AI features. Additional instructions require the Processor's written agreement.
3.3 Unlawful Instructions. The Processor shall promptly inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law. The Processor is not required to assess the legality of every instruction.
4. Processor's Obligations
- 4.1 Compliance: comply with Applicable Data Protection Law in Processing Personal Data.
- 4.2 Confidentiality: ensure that every person authorized to Process Personal Data is bound by a duty of confidentiality, which survives the end of this DPA.
- 4.3 Security: implement and maintain the technical and organizational measures in Annex II, appropriate to the risk.
- 4.4 Sub-processors: engage Sub-processors only as permitted by Section 8.
- 4.5 Data Subject Rights: assist the Controller as described in Section 9.
- 4.6 Assistance: taking into account the nature of the Processing and the information available to it, assist the Controller with its obligations on security of Processing, Personal Data Breach notification, data protection impact assessments, and prior consultation (Articles 32 to 36 of the GDPR).
- 4.7 Deletion or Return: delete or return Personal Data as described in Section 11.
- 4.8 Audit: make information available and allow audits as described in Section 10.
- 4.9 Notice of Inability to Comply: notify the Controller if it can no longer meet its obligations under this DPA or Applicable Data Protection Law.
5. Controller's Obligations
The Controller warrants that it has, and will maintain, a lawful basis for the Processing it instructs, and that its instructions comply with Applicable Data Protection Law. The Controller is responsible for:
- (a) limiting the Personal Data its forms collect to what is necessary for its purposes;
- (b) providing privacy notices to Data Subjects and obtaining any consent the law requires;
- (c) deciding whether to turn on optional collection, such as recording the visitor's IP address and user agent on records, and per-field analytics;
- (d) setting retention periods appropriate to its purposes;
- (e) deciding whether to protect its forms with CAPTCHA, and its own agreement with Cloudflare for Turnstile;
- (f) deciding whether and how its administrators use the AI features, including whether to send exception logs for AI explanation; and
- (g) the accuracy, quality, and legality of the Personal Data it collects.
6. Personnel
The Processor shall ensure that access to Personal Data is limited to personnel who require it to perform the Principal Agreement and this DPA, that those personnel are trained on their data protection obligations, and that reasonable steps are taken to ensure their reliability, including background checks where legally permissible and appropriate.
7. Security Measures
7.1 Measures. The Processor has implemented and shall maintain the technical and organizational measures described in Annex II. The Processor may update them, but shall not materially reduce the overall level of security they provide.
7.2 Platform Security. Because the Managed Package runs within the Controller's Org, the Personal Data it stores is protected by Salesforce's platform security, which is governed by the Controller's agreement with Salesforce. The Controller is responsible for the security configuration of its Org, including the guest user access of its public sites.
8. Sub-processors
8.1 Authorized Sub-processors
The Controller gives the Processor general written authorization to engage Sub-processors. The Controller authorizes the following Sub-processors as of the date of this DPA:
| Sub-processor | Address | Description | Data Processed | Location of Processing |
|---|---|---|---|---|
| Cloudflare, Inc. (Workers) | 101 Townsend Street, San Francisco, CA 94107, USA | Hosts the AI Gateway, which the Processor operates on Cloudflare's Workers platform. Engaged only for AI requests that use the AI included in the Controller's plan, which is the default: each such request passes from the Controller's Org through the AI Gateway to the AI Sub-processor and is metered against the Controller's allowance. Not engaged where the Controller has switched AI off or uses its own Anthropic API key. | AI request and response content (see Annex V), in transit only and never stored or logged. Operational log metadata, retained for seven (7) days. The per-tenant record described in Annex V. No form data and no records from the Controller's Org are stored. | Cloudflare's global network, which may include data centers in multiple jurisdictions. |
| Anthropic PBC | 548 Market Street, PMB 90375, San Francisco, CA 94104, USA | Provides the language model behind QuikForms AI, for requests that use the AI included in the Controller's plan, under the Processor's account, in a workspace of that account that also serves other customers of the Processor with the same kind of subscription (trial or paid). Engaged only in response to a deliberate action by one of the Controller's administrators; never engaged during form rendering or submission. | Form configuration metadata, the form field library, Salesforce schema metadata, the administrator's own messages and descriptions, aggregate analytics counters, and administrator-selected exception logs. No form submission values, except as described in Annex V, Section V.3. | United States. Governed by Anthropic's Commercial Terms of Service and data processing addendum. Data submitted through Anthropic's commercial API is not used to train models. |
8.2 Notification of Changes
The Processor shall give at least thirty (30) days' prior notice before engaging a new Sub-processor or replacing one, by email to the Controller's contact address on file and by updating this DPA.
8.3 Objection Right
The Controller may object to a new Sub-processor on reasonable data protection grounds by notice to privacy@sfquikforms.com within the notice period. The Parties shall discuss the objection in good faith. If no resolution is reached, the Controller may, as applicable, stop using the feature that relies on that Sub-processor (for example, by switching AI off or using its own Anthropic API key), or terminate the affected services without penalty within thirty (30) days after the Processor's notice and receive a refund of prepaid fees for the remainder of the Subscription Term.
8.4 Sub-processor Agreements and Liability
The Processor shall impose on each Sub-processor, by written agreement, data protection obligations that provide at least the same level of protection as this DPA, to the extent applicable to the services it provides. The Processor remains liable to the Controller for each Sub-processor's performance of those obligations.
8.5 Services the Controller Engages Directly
The following providers process Personal Data under the Controller's own agreements with them, not as Sub-processors of the Processor:
- Salesforce, Inc., which hosts the Controller's Org and all Personal Data the Managed Package stores, under the Controller's agreement with Salesforce.
- Cloudflare, Inc. (Turnstile), where the Controller protects its forms with Cloudflare Turnstile using keys from its own Cloudflare account. Turnstile receives the visitor's IP address, browser characteristics, and the CAPTCHA token.
- Anthropic PBC, where the Controller uses its own Anthropic API key. Requests then go directly from the Controller's Org to Anthropic under the Controller's own account; the AI Gateway is not involved and the Processor is not part of the Processing chain for those requests.
- Any Plugin, integration, or other service the Controller chooses to use with the Managed Package.
9. Data Subject Rights
9.1 Assistance. Taking into account the nature of the Processing, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as possible, to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Law, including access, rectification, erasure, restriction, portability, and objection.
9.2 Requests Received by the Processor. If the Processor receives a request from a Data Subject about Personal Data it Processes for the Controller, it shall promptly forward it to the Controller where it can identify the Controller, and shall not respond to it except to direct the Data Subject to the Controller, unless the Controller authorizes it or the law requires it.
9.3 Controller's Direct Access. Because Personal Data is stored in the Controller's Org, the Controller can fulfil most requests with standard Salesforce tools without action by the Processor. The Processor shall provide additional assistance where a request requires information available only to it.
10. Audit Rights
10.1 Information. The Processor shall make available to the Controller, on reasonable request, the information necessary to demonstrate its compliance with this DPA and Article 28 of the GDPR, including written answers to reasonable security questionnaires and documentation of the measures in Annex II.
10.2 Audits. Where that information is not sufficient to demonstrate compliance, or where a Supervisory Authority requires it, the Processor shall allow for and contribute to audits, including inspections, by the Controller or an independent auditor it mandates, subject to the following: (a) at least thirty (30) days' prior written notice; (b) during regular business hours, without unreasonable interference with the Processor's operations; (c) at the Controller's cost, unless the audit reveals a material breach of this DPA by the Processor; (d) the Controller and its auditor are bound by confidentiality obligations; (e) no access to other customers' data; and (f) no more than one audit in any twelve (12) month period, unless a Supervisory Authority requires it or it follows a Personal Data Breach.
10.3 Salesforce. The security of the Salesforce platform is outside the scope of audits of the Processor and is governed by the Controller's agreement with Salesforce.
11. Data Deletion and Return
11.1 Personal Data in the Controller's Org. The Controller's Org is the primary repository of Personal Data, and the Controller can export, modify, or delete it at any time without action by the Processor. At the end of the Principal Agreement it remains in the Controller's Org under the Controller's control, so it is returned by remaining there. Uninstalling the Managed Package permanently deletes the data held in the Managed Package's own objects and fields, so the Controller should export anything it wishes to keep first.
11.2 Personal Data the Processor Holds. Within thirty (30) days after the end of the Principal Agreement, or after the Controller's written request, the Processor shall, at the Controller's choice, return or delete any Personal Data it holds outside the Controller's Org (such as Personal Data included in support correspondence), unless the law requires it to keep that data, in which case it shall keep it confidential and Process it only for that purpose. The Processor shall certify deletion in writing on request. The AI Gateway holds no AI request content, and its operational logs are deleted after seven (7) days.
11.3 Automated Retention in the Controller's Org. The Managed Package deletes the following automatically, after periods the Controller can change:
- (a) analytics records: 365 days by default;
- (b) exception logs: 30 days by default;
- (c) AI conversation history: 90 days by default; and
- (d) survey links: expire after 30 days by default.
Form submission data persists until the Controller deletes it.
12. Personal Data Breach
12.1 Notification. The Processor shall notify the Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach.
12.2 Content. The notification shall include, to the extent then known: the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects and records concerned; a contact point for more information; its likely consequences; and the measures taken or proposed to address it and mitigate its effects. Information not available at first may be provided in phases.
12.3 Cooperation. The Processor shall take reasonable steps to contain, investigate, and remediate the Personal Data Breach and shall cooperate with the Controller in meeting its own notification obligations.
12.4 Records and Communication. The Processor shall keep a record of each Personal Data Breach, and shall not notify Data Subjects or third parties of a Personal Data Breach affecting the Controller's Personal Data without the Controller's consent, unless the law requires it. Notification is not an admission of fault or liability.
13. International Data Transfers
13.1 Transfers. The Processor shall not transfer Personal Data from the EEA, the United Kingdom, or Switzerland to a country without an adequacy decision unless an appropriate safeguard under Applicable Data Protection Law applies. The Personal Data the Managed Package stores remains in the Controller's Org, whose location the Controller's Salesforce instance determines. The transfers the Processor makes are of AI request content to the AI Gateway and the AI Sub-processor in the United States, as described in Annex V, and of Personal Data the Controller includes in support requests.
13.2 Standard Contractual Clauses. For a transfer of Personal Data subject to the GDPR to the Processor, or by the Processor to a Sub-processor, in a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows: (a) Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor; (b) the Customer is the data exporter and the Processor the data importer; (c) Clause 7 (docking clause) applies; (d) under Clause 9, Option 2 (general written authorization) applies, with the notice period in Section 8.2; (e) the optional language in Clause 11 does not apply; (f) under Clause 13, the competent supervisory authority is that of the Member State where the data exporter is established or, if it is not established in the EU, where its EU representative is appointed or, if none, Ireland; (g) under Clause 17, the SCCs are governed by the law of Ireland; (h) under Clause 18, disputes are resolved by the courts of Ireland; and (i) Annexes I and II of the SCCs are completed by Annex I and Annex II of this DPA, and Annex III of the SCCs by Section 8.1.
13.3 United Kingdom. For transfers subject to the UK GDPR, the UK Addendum applies, completed with the information in Section 13.2 and the Annexes of this DPA; in Table 4, either Party may end the UK Addendum as set out in its Section 19.
13.4 Switzerland. For transfers subject to the FADP, the SCCs apply as set out in Section 13.2, with these changes: references to the GDPR are to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; "Member State" includes Switzerland so that Data Subjects in Switzerland can bring claims where they habitually reside; and the SCCs protect the data of legal entities to the extent the FADP does.
13.5 Onward Transfers. The Processor shall ensure that an appropriate safeguard is in place for each transfer to a Sub-processor, such as the Sub-processor's own Standard Contractual Clauses.
14. U.S. State Privacy Laws
To the extent U.S. State Privacy Laws apply, the Processor is a "service provider," "contractor," or "processor" as those laws define them, and it shall: (a) not sell or share Personal Data, as those terms are defined in the CCPA; (b) not retain, use, or disclose Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in this DPA and the Principal Agreement, or outside the direct business relationship with the Customer; (c) not combine Personal Data with personal information it receives from or on behalf of others or collects itself, except as those laws permit; (d) comply with those laws and provide the same level of privacy protection they require; (e) notify the Customer if it can no longer meet its obligations under them; and (f) allow the Customer to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data. The Processor certifies that it understands and will comply with these restrictions.
15. Data Protection Impact Assessment
The Processor shall provide reasonable assistance to the Controller with any data protection impact assessment required under Article 35 of the GDPR, and any prior consultation with a Supervisory Authority under Article 36, in relation to the Processing under this DPA, taking into account the nature of the Processing and the information available to the Processor. Annex V and the Processor's Security & Trust page describe the Processing in detail for that purpose.
16. Liability
16.1 Limitations. Each Party's liability arising out of or relating to this DPA, whether in contract, tort, or otherwise, is subject to the limitations and exclusions of liability in the Principal Agreement, and counts toward the same aggregate cap, except to the extent Applicable Data Protection Law or the SCCs do not permit it. Nothing in this DPA limits a Party's liability to Data Subjects under the SCCs.
16.2 Controller Responsibility. The Controller is responsible for data protection liabilities arising from its form configuration, the categories of Personal Data it chooses to collect, the optional features it turns on, its retention settings, its use of the AI features, and any failure to provide privacy notices or obtain consents.
17. Term and Termination
This DPA remains in force for as long as the Processor Processes Personal Data on behalf of the Controller under the Principal Agreement. Obligations that by their nature should survive, including confidentiality, deletion and return, and liability, survive its end. A material breach of this DPA is a material breach of the Principal Agreement.
18. General Provisions
18.1 Governing Law. This DPA is governed by the law that governs the Principal Agreement (the law of the State of Oregon), except that the SCCs are governed as set out in Section 13.2 and except where Applicable Data Protection Law requires another law.
18.2 Disputes. Disputes are resolved under the dispute resolution provisions of the Principal Agreement, except as the SCCs provide.
18.3 Changes. The Processor may update this DPA, including Annex II and the list of Sub-processors, by posting an updated version and, for material changes, giving the Customer at least thirty (30) days' notice by email, provided the update does not materially reduce the overall protection of Personal Data. Section 8.2 governs new Sub-processors.
18.4 Severability and Third Parties. If a provision of this DPA is invalid or unenforceable, the rest remains in effect. This DPA confers no rights on third parties, except the rights Data Subjects have under the SCCs or Applicable Data Protection Law.
18.5 Notices. Notices to the Processor under this DPA must be sent to privacy@sfquikforms.com. Notices to the Controller are sent to its contact address on file under the Principal Agreement.
Contact Information
QuikForms, LLC
Email: privacy@sfquikforms.com
Website: www.sfquikforms.com
Annex I: Details of Processing
A. List of Parties
Data exporter (Controller): the Customer identified in the Principal Agreement, whose contact details are those on file with the Processor. Activities relevant to the transfer: use of the Managed Package and its AI features. Role: controller (or processor, under Module Three).
Data importer (Processor): QuikForms, LLC, an Oregon limited liability company. Contact: privacy@sfquikforms.com. Activities relevant to the transfer: provision of the Managed Package, the AI Gateway, and support. Role: processor.
Each Party's acceptance of the Principal Agreement is its signature of this Annex.
B. Description of Processing and Transfer
| Element | Description |
|---|---|
| Categories of Data Subjects | End-users who view or submit the Controller's forms, surveys, and chat forms; the Controller's administrators who use the Managed Package and its AI features; and any other individuals whose data the Controller chooses to collect. |
| Categories of Personal Data | Form field values, as the Controller defines them (for example, name, email address, phone number, postal address, or any other data the Controller chooses to collect); file uploads and signatures; visitor keys (keyed hashes of IP address and date); device category, browser type, and referrer domain; IP address and user agent where the Controller turns on recording them for a form (the IP address then also appears in that form's Platform Events), and in exception logs; submission timestamps; CAPTCHA tokens; administrators' AI conversation history; and the AI request content described in Annex V. |
| Sensitive data | The Managed Package does not require or solicit special categories of Personal Data. The Controller decides which fields its forms contain and may configure forms that collect such data; the Controller is responsible for its lawful basis and for appropriate safeguards. The Managed Package's own safeguards are described in Annex II. |
| Frequency of the transfer | Continuous for Processing in the Controller's Org; for transfers to the Processor and its Sub-processors, each time an administrator uses an AI feature or the Controller sends a support request. |
| Nature of the Processing | As described in Section 2.2. |
| Purpose of the Processing | To provide the Controller with a form builder for Salesforce that collects, validates, and stores data submitted through its forms, surveys, and chat forms, with analytics, bot protection, AI features, and support, as the Controller configures them. |
| Retention | As configured by the Controller in its Org (Section 11.3); AI request content is held only in transit; AI Gateway logs for seven (7) days; support correspondence as described in Section 11.2. |
| Transfers to Sub-processors | As listed in Section 8.1, for the purposes and durations stated there. |
C. Competent Supervisory Authority
As determined under Section 13.2(f).
Annex II: Technical and Organizational Security Measures
These measures apply to the Managed Package code the Processor authors, to the AI Gateway, and to the Processor's own handling of Personal Data. Salesforce's platform security, including encryption at rest and in transit, authentication, and infrastructure security, is documented in Salesforce's own trust and compliance materials and is governed by the Controller's agreement with Salesforce.
1. Access Control
| Measure | Description |
|---|---|
| Field-Level Security and CRUD | The Managed Package enforces Salesforce object and field permissions, using user-mode queries (WITH USER_MODE) and describe-based permission checks where they apply. |
| Forbidden Objects | Form submissions cannot write to a blocklist of sensitive objects, including users, profiles, permission sets, groups and sharing, sessions and login history, credentials, organization settings, Apex and other code, and the Managed Package's own configuration objects. |
| Guest User Context | Public forms run as the site's guest user, with only the permissions the Controller grants that user. |
| Server-Controlled Values | Hidden and read-only field values are applied by the server, and a link can set them only for fields the Controller marks as link-settable. |
| No Record IDs in the Browser | The ids of records a submission creates are not returned to the browser; uploads are tied to their record by an encrypted, signed, time-limited grant. |
| Administrator-Only AI | AI features are available only to users holding the QuikForms_Admin permission set, and the Controller can switch them off for its whole Org. |
| Processor Access | The Processor has no standing access to the Controller's Org; access requires the Controller to grant login access through Salesforce. |
2. Input Validation and Content Safety
| Measure | Description |
|---|---|
| Server-Side Validation | Required fields, the Controller's validation patterns, and blocking rules are enforced on the server for every submission; Salesforce's own field validation applies when the record is saved. |
| File Checks | Uploaded files are checked on the server for type and size. |
| HTML Sanitization | Administrator-authored HTML is sanitized with DOMPurify, which removes scripts and event-handler attributes, before it is displayed. |
| Safe Redirects | Post-submission redirects are limited to https addresses. |
3. Bot and Abuse Protection
| Measure | Description |
|---|---|
| Cloudflare Turnstile CAPTCHA | Optional per form, with server-side token verification through a Salesforce Named Credential and a five (5) second timeout. |
| Honeypot Protection | Hidden fields that people never see. A submission that fills one receives the same checks and an ordinary-looking reply, and no record is created. |
| Rate Limiting | Per-visitor limits (20 per minute by default) on submissions and other requests that create a record or reach an external system, on Salesforce Sites and Experience Cloud forms alike, with a separate limit on browser logs and analytics beacons. |
| Referrer Validation | An optional allowlist of the sites from which submissions are accepted. |
4. Data Minimization and Pseudonymization
| Measure | Description |
|---|---|
| Visitor Keys | Unique visitors are counted with an HMAC-SHA256 hash of the IP address and the date, keyed with a secret held in a protected setting in the Controller's Org. The raw IP address is not stored for analytics. |
| Aggregated Analytics | Analytics are stored as daily counts per form and, where the Controller turns it on, per field. No submitted values are stored in analytics records. |
| Optional Collection Off by Default | Recording the IP address and user agent on records, and per-field analytics, are off until the Controller turns them on. |
| No Telemetry | The Managed Package sends no usage information to the Processor. |
| AI Data Minimization | AI requests carry configuration, schema, administrator input, aggregate counts, and selected logs only, as listed in Annex V. |
5. Sensitive Data Protection in Logs
| Measure | Description |
|---|---|
| Key-Based Redaction | Values in log context whose keys contain password, pwd, passwd, apikey, api_key, token, secret, secretkey, ssn, social_security, cardnumber, cvv, ccn, or creditcard are replaced with ***REDACTED***. |
| Configurable Log Levels | Logging can be set from None through Critical, Error, Warning, and Info to Debug (default: Error). |
| Truncation | Messages, stack traces, and context values are truncated to fixed maximum lengths. |
| No Raw Errors to Visitors | Visitors see generic messages; the details go only to the Controller's exception log. |
6. Data Retention and Deletion
| Measure | Description |
|---|---|
| Analytics Cleanup | Analytics records are deleted automatically after the configured period (default: 365 days). |
| Exception Log Cleanup | Logs are deleted automatically after the configured period (default: 30 days). |
| AI Conversation Cleanup | AI assistant conversations are deleted automatically after the configured period (default: 90 days). |
| Survey Link Expiry | Survey links expire after the configured period (default: 30 days). |
| Batch Deletion | Cleanup runs in batches of up to 2,000 records to stay within Salesforce governor limits. |
| Session Resume | Values kept in the visitor's browser tab are cleared on successful submission and when the tab closes, and never include files, signatures, or masked fields. |
7. Secure Communications and Secrets
| Measure | Description |
|---|---|
| Encryption in Transit | Communications between browsers and the Controller's Org, and between the Controller's Org, the AI Gateway, and the AI Sub-processor, use HTTPS/TLS. |
| Named and External Credentials | Turnstile, AI Gateway, and Anthropic credentials are held in Salesforce Named and External Credentials in the Controller's Org and are never exposed in source code or to the browser. |
| Signed Tokens | Preview links, upload grants, visitor tickets, and AI undo snapshots are signed with keys derived from a per-Org secret held in a protected setting. |
8. Resilience
| Measure | Description |
|---|---|
| Error Isolation | Failures in analytics, Platform Event publishing, and logging do not prevent a submission from completing. |
| AI Independence | Forms, submissions, file uploads, analytics, and all other non-AI functions operate without the AI Gateway or the AI Sub-processor, and continue to operate if either is unavailable. |
9. AI Gateway
| Measure | Description |
|---|---|
| Tenant Authentication | Each Controller's Org authenticates with a token issued to that Controller and stored in a Salesforce External Credential in its Org. After collection, the AI Gateway keeps only a SHA-256 hash of the token. |
| No Content Storage or Logging | Request and response content is held in memory only while a request is in transit and is never stored or logged, at any log level. An automated check on every change to the AI Gateway's code enforces this. |
| Metadata-Only Logs | Logs contain only operational metadata, such as the time, tenant identifier, event, response status, token counts, outcome, and duration. Cloudflare retains them for seven (7) days. |
| Per-Customer Metering | The AI Gateway identifies each Controller by its own token and meters and limits its requests against its own allowance. The AI Sub-processor processes the requests in a workspace of the Processor's account that also serves other customers with the same kind of subscription (trial or paid), and each response returns only to the Org that sent the request. |
| Allowance Enforcement | Each request is checked against the Controller's allowance before it is forwarded. |
| Activation Protection | The one-time activation token is deleted when collected or after twelve (12) hours, and failed attempts are counted by a keyed hash of the requesting IP address. |
10. Organizational Measures
| Measure | Description |
|---|---|
| Least Privilege | Access to the Processor's systems and to any Personal Data is limited to personnel who need it. |
| Confidentiality | Personnel are bound by confidentiality obligations (Section 6). |
| Secure Development | Changes to the Managed Package and the AI Gateway are tested before release, including automated checks for the security rules in this Annex. |
| Incident Response | Personal Data Breaches are handled and notified as described in Section 12. |
Annex III: Sub-processors
The Sub-processors the Controller authorizes are listed in Section 8.1. Providers the Controller engages directly are listed in Section 8.5.
Annex IV: Controller's Instructions
The Controller's instructions to the Processor, as contemplated by Section 3, include the following:
- Form data collection: receive, validate, and store Personal Data submitted through the Controller's forms, creating Salesforce records as the form configuration specifies.
- CAPTCHA verification: where the Controller has configured Turnstile and has not disabled CAPTCHA for a form, send the CAPTCHA token to Cloudflare for verification.
- Analytics: record the analytics described in Section 2.2(e), unless the Controller turns analytics off, and per-field analytics where the Controller turns them on for a form.
- Optional browser information: where the Controller turns on "Log User Browser Info" for a form, write the visitor's IP address and user agent to the record each submission creates.
- Exception logging: log errors at the level the Controller configures, applying the redaction in Annex II.
- Platform Events: on the Professional plan, publish submission and validation-failure events in the Controller's Org for its own automations, including the visitor's IP address only where "Log User Browser Info" is on for the form.
- Surveys: generate survey links and tokens, validate survey submissions, and store responses, as the Controller configures.
- File uploads: store uploaded files and signatures as Salesforce files linked to the submission's record.
- Session resume: keep typed values in the visitor's browser tab, unless the Controller turns this off for a form.
- AI features: where the Controller has not switched AI off, send the data described in Annex V when one of its administrators uses an AI feature, through the AI Gateway when the Controller uses the AI included in its plan.
- Retention: apply the retention periods the Controller configures.
- Deletion and return: as described in Section 11.
Annex V: AI Feature Processing
This Annex describes the Processing carried out by the AI features of the Managed Package ("QuikForms AI"). Every plan includes QuikForms AI. Where the Controller has switched AI off (AI_Enabled__c), none of this Processing occurs and no data reaches the AI Gateway or the AI Sub-processor.
V.1 Trigger and Control
Every AI request results from a deliberate action by one of the Controller's administrative users, such as sending a message to the form-building assistant or choosing to explain an exception log. No AI request is triggered by a Data Subject, by a form submission, or by opening a page. No AI Processing occurs in the form rendering or submission path. Access is restricted to users holding the QuikForms_Admin permission set.
V.2 What Is Transmitted
| Category | Transmitted | Notes |
|---|---|---|
| Form configuration metadata | Yes | Field names, labels, descriptions, tooltips, messages, validation rules, layout, settings, styling, and languages of the draft form, and the form field library. For translation, the form's own labels and messages. Authored by administrators, not by Data Subjects. |
| Salesforce schema metadata | Yes | Field names and types of the form's target object, available to the requesting user. |
| Administrator input | Yes | Messages sent to the form-building assistant and the conversation so far; for the pattern helper, the administrator's description, the field's label and type, and any existing pattern. |
| Aggregate analytics counters | Yes | Counts only (views, completions, drop-off, per-field reach and abandonment), with the form's structure. No submitted values, no identifiers, no per-person records. |
| Exception log records | On request | Only those an administrator selects. For an explanation: error code, severity, source, type, component, method, object type, message text, stack trace, additional context, and governor limit usage. For a digest: time, severity, error code, source, type, component, method, and message text. |
| Form submission values | No | Not transmitted by any AI feature, except where an exception log's text quotes such a value (see V.3). |
| Records created by forms | No | Never transmitted. |
| File uploads and signatures | No | Never transmitted. |
| Survey answers and chat hand-off data | No | Never transmitted. |
| Per-visitor analytics records | No | Never transmitted. |
| IP addresses and user agents | No | Never transmitted as part of an AI request. |
| Keys, tokens, and passwords | No | Never included in the content of an AI request. |
V.3 Residual Risk in Exception Logs
Exception log message text and context are generated by the runtime rather than authored by the Controller. The Managed Package redacts sensitive keys from structured data before writing a log, but it cannot guarantee that an arbitrary error message or context contains no Personal Data: a validation error may quote the value that failed. Where an administrator requests an AI explanation or digest of exception logs, Personal Data may therefore be transmitted incidentally to the AI Sub-processor and, when the Controller uses the AI included in its plan, pass through the AI Gateway in transit, where it is not stored or logged. This is the only AI feature carrying that risk, and the Controller may avoid it by not using those two features or by switching AI off.
V.4 Model Training
The Processor does not use AI request content, AI output, or any other Personal Data to train artificial intelligence models. Data sent through Anthropic's commercial API is not used to train Anthropic's models; this is a term of Anthropic's Commercial Terms of Service, not a configuration option.
V.5 Where Requests Go
The AI included in the plan (the default). The Controller's Org sends each AI request, through a Salesforce Named Credential, to the AI Gateway at https://ai-gateway.sfquikforms.com, a service the Processor operates on the Cloudflare Workers platform of Cloudflare, Inc. The AI Gateway authenticates the Org with a token issued to the Controller and stored in a Salesforce External Credential in the Controller's Org, checks the Controller's remaining allowance, and forwards the request to the AI Sub-processor's API under the Processor's account. The AI Sub-processor processes it in a workspace of that account that also serves other customers of the Processor with the same kind of subscription (trial or paid). The AI Gateway authenticates, meters, and limits each Controller separately, by the Controller's own token. The response returns by the same route only to the Org that sent the request. The AI Sub-processor retains and deletes request content in accordance with its Commercial Terms of Service and its data retention policies.
Content in transit only. The AI Gateway holds the content of a request and its response in memory only while the request is in transit. It never stores or logs prompts, responses, or other request or response content, at any log level. Its logs contain only operational metadata, such as the time, the Controller's tenant identifier, the event, the response status, token counts, outcome, and duration, and the Controller's Org ID for activation events; Cloudflare retains them for seven (7) days.
Per-tenant record. For each Controller, the AI Gateway stores a tenant identifier, the identifier of the AI Sub-processor workspace that serves the Controller, the subscription tier, a SHA-256 hash of the Controller's token (never the token itself once it has been collected), allowance settings and usage counters for the current period, and the times of registration, collection, usage, and any revocation. During the one-time activation step it also holds the token awaiting collection, which is deleted when collected or after twelve (12) hours, and counts of failed attempts, each identified by a keyed hash (HMAC) of the requesting IP address from which the address cannot be recovered. The token, its nonce, and these counts are deleted together. It stores no form data, no names or email addresses, and no records from the Controller's Org.
The Controller's own Anthropic API key. Where the Controller uses its own Anthropic API key instead, the Controller's Org sends AI requests directly to the AI Sub-processor's API (https://api.anthropic.com). The AI Gateway is not involved, no request content transits or is stored on the Processor's systems, the Controller contracts with Anthropic directly, and the Processor is not part of the Processing chain for those requests.
Availability. The AI Gateway and the AI Sub-processor are used only by AI features. Forms, submissions, file uploads, analytics, and all other functions of the Managed Package continue to operate if either is unavailable.
V.6 Conversation History
The form-building assistant's conversation history is stored in the Controller's Org, not by the Processor or the AI Gateway. It is deleted automatically after the configured retention period (AI_Chat_Retention_Days__c, default: 90 days).