Security

Self-hosted by design, with layered spam and abuse protection.

Your data, your infrastructure

HigherStack runs on your own stack, so submission data stays within your data residency. There's no third-party form vendor holding your respondents' answers.

Spam & abuse protection

Honeypot — bots that fill the hidden trap field are silently dropped.
Rate limiting — repeated submissions from the same source are throttled.
Optional CAPTCHA — turn on a challenge for high-risk forms.
Origin allow-listing — forms only accept submissions from domains you approve.

Reporting an issue

Found a vulnerability? Please email info@higherstack.ca and we'll respond promptly. Last updated June 2026.