Security you can verify yourself.
We don't ask you to trust our word. Here is exactly how each protection works — and how to confirm it without relying on us.
subscriber records exposed in the Substack breach, Feb 2026
of your encrypted drafts that Forme can decrypt — ever
of independent security — each verifiable without trusting us
Your drafts are locked before they leave your browser.
When you encrypt a draft, it's scrambled in your browser before anything is sent. The result that reaches our server looks like random noise. We don't have the key that would unscramble it. We couldn't open your draft even if someone asked us to — not because of a policy, but because of how the math works.
DevTools → Application → IndexedDB → forme-crypto → keys. Your key is there. Save an encrypted draft, then check the Network tab — you'll see a blob, not your text.
A subpoena gets us an unreadable blob.
We comply fully with legal process. We hand over everything we have. What we have on an encrypted draft is a scrambled blob and nothing else — no key, no plaintext, no way to decrypt. A court order pointed at Forme cannot produce your unpublished work.
Sources reach you from any browser — no downloads, no accounts.
Anyone can submit a tip through your publication's secure intake page. The message is scrambled in their browser before it leaves their device. We receive a sealed package we can't open. You're the only person who can read it — with a key that's stored in your browser and nowhere else.
Your subscriber list is yours, not ours.
Your readers' payment relationships run directly through your own Stripe account. We store three things per subscriber: their email, their subscription status, and when they joined. No payment data, no location, no reading history, no behavioral tracking. A breach of Forme exposes limited data — and nothing financial.
Check your Stripe dashboard — your readers' payment records appear there, not in Forme. Forme's cut on every transaction: $0.00.
Photos arrive with the identifying information removed.
Smartphone photos contain more than pixels. They contain GPS coordinates, the exact device model, a serial number, and a timestamp accurate to the second. A person can be identified and located from a single photo. Forme strips all of this in your browser before upload — the identifying data never reaches our server.
Download an image you uploaded via Forme. Run: exiftool filename.jpg — you'll see no GPS, device model, or timestamp metadata.
The warrant canary — proof we haven't been silenced.
We publish a signed statement confirming we haven't received any government orders requiring us to modify our systems or keep silent. The signature uses a cryptographic standard that anyone can verify independently. If we receive such an order and are gagged, we stop signing. The absence of a valid signature is the signal.
Any Ed25519 library verifies the signature against our published public key. The math either works or it doesn't.
If you go dark, trusted contacts can act.
Your encryption key is split into multiple pieces using a mathematical technique called secret sharing. You distribute those pieces to trusted people — colleagues, lawyers, family. If you miss your check-in schedule, those people receive their pieces and can combine them to access or publish your materials. No single person holds complete control.
What forme actually stores.
We don't ask for your trust. We offer verification.
Every claim on this page can be checked with freely available tools — open source libraries, browser developer tools, your own Stripe dashboard. The math is public. The code is inspectable. That's the only honest kind of security.