Forma Studio · Security
Your client list is the most valuable thing your studio owns. Here is where it lives, who can reach it, and what keeps everyone else out, in plain language.
For studio owners. Updated November 2026.
Where Forma runs
Forma runs on Render, a hosting company that runs websites and apps for businesses of every size. Instead of a computer sitting in your back office, Forma runs in Render's data centers in the U.S., and Render keeps the machines, updates and network running.
Each studio gets its own Render account, in the studio's name. Forma sets it up and hands it over. You own it, Render bills you directly, and your client data is never pooled with another studio's. If you ever leave Forma, everything stays with you.
Think of a bank building. Render runs the building. Forma builds your safe-deposit box inside it, fits a strong lock, and hands you the key. The box, and everything in it, is yours.
Guards the building
Data centers, hardware, network, and protection from attack floods.
Builds the box and the lock
Encryption, sign-in, staff roles, backups, alerts.
Hold the key
Own the account, decide who gets access, and act on alerts.
Protection
Everything between a browser and Forma is encrypted: the padlock in the address bar.
Only your Forma app can reach your database, over a private connection. The stored data and its backups are encrypted.
Clients and staff sign in with Google or a one-time code sent to their email. Codes expire in 15 minutes and stop working after 5 wrong tries.
Instructors see what instructors need. Money, exports and settings are for managers and admins only.
Render absorbs attack floods automatically. Forma limits how many sign-in codes anyone can request, how many guesses they get, and how heavily the assistant can be used.
It can't change anything until a staff member clicks Approve, and every action is logged. It runs on a paid AI plan that does not use your data to train AI.
Cards are stored by Stripe, in your studio's own Stripe account. Forma never sees or saves full card numbers.
Your database can be rolled back to any point in the last 7 days, so a bad day is undone instead of lost.
Your part
Forma builds the lock. These three habits keep the key in the right hands.
If an alert arrives: forward it to your developer, paste it into an AI assistant, or send it to Forma for a paid review.
Technical details
What each security control does, and where it stands today.
| Area | Control | Status |
|---|---|---|
| Isolation | One Render workspace per studio, owned by the studio. Every setup is created from the same Blueprint (render.yaml), so they are identical and repeatable. | Standard setup |
| Network | App reaches the database over Render's private network. External database access disabled at setup (it is open to any IP with the password by default). | Standard setup |
| Encryption | In transit: automatic TLS certificates, and an HSTS header so browsers only ever use https. At rest: AES-256 for the database and its backups. | Included |
| Sign-in & sessions | Passwordless: Google (OIDC + PKCE, verified email only) or emailed link + 6-digit code, stored hashed, single use, 15-min expiry, burned after 5 wrong guesses. Signed httpOnly/secure cookies; staff sessions 30 days, clients 180. | Built |
| Access | Server-enforced staff roles (admin, manager, instructor), checked on every action. Read-only database login for reports. A separate front-desk role, custom roles, and an app database role that cannot alter or drop tables. | Roles builtFront desk, custom roles, DB role: building |
| Attack protection | Render DDoS protection (Cloudflare network) on every web service. App-level limits on sign-in emails (5 per account per 15 minutes), code guesses, new accounts and assistant use. Security headers (frame-ancestors 'none', nosniff, Referrer-Policy, HSTS). Limits on the API and a full script policy (CSP). | DDoS: includedLimits, headers: builtAPI limits, script policy: building |
| Secrets | Keys stored as Render environment variables, never in code; repo history scanned clean. Email, AI and Stripe accounts are in the studio's name. | Standard setup |
| Backups | Database point-in-time recovery (7 days on Render's Pro workspace, the standard setup) plus on-demand exports. Photos are stored in the database, so the same backups cover them. | Included |
| Alerts | Render emails the owner when a deploy fails or the app becomes unhealthy. Spending cap set on the AI key. | Standard setup |
| Account security | 2-step login enforced for every member of the Render workspace. Forma's support access is a team seat the owner can remove at any time. | Standard setup |
| AI assistant | Every change needs a human Approve; full audit log; an hourly limit per staff member. Runs on the studio's own paid AI key (Anthropic Claude by default, Google Gemini optional): prompts not used for training. Studio documents and waivers stored as text, not files. | Built |
| Payments | The studio's own Stripe account. No card numbers stored (brand, last 4, expiry only), keeping card handling within Stripe's PCI scope. | Built |
Building items are finished before any studio goes live. Render holds SOC 2 Type 2 and ISO 27001 certifications (render.com/docs/certifications-compliance).
Questions
Bring your questions to a demo. I'll answer every one.