Skip to main content
Flex Forms runs inside your own Laravel application and database — respondent submissions, Contacts, and Insights events are rows in your database, not data sent to a third-party SaaS. You are the data controller for anything your forms collect; Flex Forms is the software you use to collect and process it.

Stays in your database

Submissions, Contacts, Insights events, uploaded files, and Insights share tokens.

Leaves your app only when you configure it to

Email notifications, webhooks, and any integration feed you explicitly enable.
1

Set data retention per form

Turn on Data retention in Form settings and choose a value/unit (days/weeks/months/years) to automatically age out old submissions.
2

Review what you export

CSV / Excel exports (Submissions, Contacts) and webhook payloads are exactly what you configure them to send — audit field selection before wiring a feed to a third party. Encrypted forms still export decrypted values to authorized Studio users.
3

Restrict access to raw files

Submission uploads are private and signed by default — see Upload disks and the Multi-tenancy recipe for uploads.authorize.
4

Honor deletion requests

Since data lives in your own database, fulfilling a respondent’s deletion request is a normal delete against your flex_form_submissions / Contacts rows — no separate vendor process required.
Flex Forms itself only calls out to the license server to validate your domain/plan. It does not transmit form submissions, contacts, or files to any third-party service unless you explicitly configure an integration or webhook to do so.
Last modified on September 7, 2026