Security

Every forum is served through Cloudflare, whose global edge absorbs denial-of-service attacks and filters malicious traffic before it reaches your site. Our servers accept web traffic only from Cloudflare’s network — a request sent straight to the server, bypassing the edge, is dropped before anything answers it. The connection between the edge and your forum is additionally validated by certificate at both ends.

Every hosted forum is scanned twice a day for malware, web shells, and tampered files. If a scan turns up something suspicious we’re alerted so we can investigate quickly — before it becomes your problem.

Scanning catches bad files; it doesn’t catch bad behavior. So we also watch what actually runs. Every forum container is monitored at the kernel level, and activity that has no business happening inside a forum — an unexpected shell, a reconnaissance tool, a process reaching somewhere it shouldn’t — raises an alert for us to look at, whether or not any file on disk ever changed.

Each forum runs in its own container with user-namespace remapping between tenants, so a process that gains root inside a forum is not root on the host. Each forum also gets its own database and its own database user, permitted to reach that one database and nothing else. A problem inside one forum stays inside it — it cannot reach yours.

Traffic to and from your forum is encrypted in transit with TLS. Backups run in layers: your files and database are backed up nightly, encrypted before they leave the server, and stored off-site — and on top of that we snapshot the database hourly and ship its transaction log every few minutes.

That layering is the point. A nightly backup alone means a bad day can cost you a day; this means a recovery lands within minutes of the moment things went wrong, not back at last night. Restores have been rehearsed, including onto a different server, so recovery is a practiced procedure rather than a hopeful one.

Every forum is served over HTTPS. Access to our production systems is restricted, your forum’s database is scoped so it can only ever reach its own data, and our servers receive automatic security updates so known vulnerabilities are patched without you lifting a finger. Deleting a forum is reversible for 7 days, so a mistake — or someone else’s mistake — isn’t final.

We continuously monitor our fleet and invest in new protections as threats evolve. No system is perfectly secure, but we take the responsibility seriously — and we will notify you and the relevant authorities of a security incident affecting your data as and when required by law.

Found a potential security issue? We want to hear about it. Email security@buildformstudio.com with the details and clear steps to reproduce, and we will acknowledge your report and work with you on a fix.

We ask that you give us a reasonable chance to remediate before disclosing an issue publicly, and that you never access, modify, or delete data that isn’t yours while testing. Acting in good faith under these guidelines, you won’t face legal action from us.

For how we collect and handle your data, see our Privacy Policy; for the agreement that governs the service, our Terms.