Security

Your forms, and your respondents' answers, are only useful if they are safe. This page explains, in plain words, how we protect them.

In transit and at rest

• Every connection to AskBell — the website, form pages, the phone app and our servers — uses TLS, the encryption behind the padlock in your browser.
• Data at rest is encrypted by Cloudflare, which hosts AskBell.

Signing in

• AskBell never uses passwords to sign you in. You get a one-time code by email or SMS, or you sign in with Google.
• A sign-in code expires after 10 minutes and allows 5 tries.

Private forms

• A business can protect a form with a password or an email code.
• Form passwords are stored salted and stretched (PBKDF2), so they cannot be read back, even by us.
• Email codes are stored hashed. Each lasts 15 minutes and allows 5 tries.

Backups

• Every response is archived as it arrives.
• Databases are backed up every day, and backups are kept for 30 days.

Who can reach your data

Access to production systems is limited to named staff who need it for their work. Nobody, including our team, can edit a respondent's answer.

If a personal data breach affects your data, we tell the businesses affected without undue delay, as our Data processing terms say.

Reporting a vulnerability

If you find a security weakness, please write to hello@askbell.app with Security in the subject line. Tell us what you found and how to reproduce it. We will reply and work with you to fix it.

While you look, please:

• don't test against other customers' data or accounts — use your own;
• don't run tests that slow down or disrupt the service for others.

Who we are

AskBell is operated by Newtact Lab Private Limited (OPC), 12th Floor, Manjeera Trinity Corporate, Geek Space Business Centre, Near Lulu Mall, KPHB Phase 3, Hyderabad, Telangana 500072, India.

Grievance Officer: Naveen Davuluri, Director and Grievance Officer Email: hello@askbell.app

We answer every message to that address. If you are writing about your own data — to see it, correct it, or have it erased — say so in the subject line and we will treat it as a formal request under the Digital Personal Data Protection Act, 2023.