If you collect information through a form on your Rocketspark website, you'll want to know how that data is protected. This guide explains how form submissions are kept secure, from the moment someone hits submit to where the data is stored, who can see it, and the one place you need to watch: your notification emails. It applies to every form on your site, including those collecting sensitive details like health or sensitive information.
Protected in transit (HTTPS and TLS)
"In transit" means while the data is travelling between the visitor's browser and Rocketspark.
Every Rocketspark page and form, including forms collecting health information, is served only over HTTPS. This uses current Transport Layer Security, or TLS (the standard that encrypts the connection so no one can read it along the way). We use TLS 1.2 and above, and TLS 1.3 where the visitor's browser supports it.
Connections use strong, industry-standard cipher suites (the methods used to scramble the data) and modern key exchange.
Because this setup is independently observable, you're welcome to check it yourself at any time using a tool like Qualys SSL Labs: SSL Server Test.
Protected at rest (encryption and storage)
"At rest" means once the submission has arrived and is stored.
Form submissions are encrypted before they're stored, using modern authenticated encryption of a strength equivalent to AES-256 (a widely used, high-strength encryption standard). This is built on libsodium, a well-audited cryptography library.
We use an envelope-encryption model, which works in two layers:
Each website's submission data is encrypted with its own dedicated key.
That key is then protected by a master key held securely on our systems and never stored in the database itself.
Two things follow from this. The stored data can't be read from the database on its own, and each website's data is cryptographically isolated from every other website's. Your data stays separate from everyone else's.
Who can see your form submissions
Only an authenticated user with one of the following roles can view the original content of a submission:
Owner
Admin
Form Manager
Rocketspark staff and any third-party design partners see redacted data, not the raw values people submitted. That means our team can help you with your site without seeing the actual contents of your form submissions.
Important: form details in notification emails
This is the one part worth reading carefully, especially if you collect sensitive information.
When a form is submitted, the details are included in the notification email sent to the recipient or the website owner. From that point on, the information sits within your own email system in plain text, outside Rocketspark's encrypted storage.
For highly sensitive information such as prescription data, we recommend checking two things:
Where these notification emails are being sent.
How well that inbox is protected. For example, a strong password and two-factor authentication (2FA).
⚠ Note: Rocketspark's encryption protects submissions inside your website's storage. It does not extend to your email inbox once the notification email has been delivered. Securing that inbox is worth doing if your forms collect sensitive data.
Tips and things to watch out for
If you collect sensitive data, treat your notification inbox with the same care as the data itself. Strong password, 2FA on.
You can verify Rocketspark's TLS setup yourself at any time. You don't have to take our word for it.
Keep the list of people with Owner, Admin, or Form Manager roles current, since those are the roles that can view raw submissions.
Frequently asked questions
Is my form data encrypted? Yes. It's encrypted in transit over HTTPS using TLS 1.2 and above, and encrypted at rest before it's stored, at a strength equivalent to AES-256.
Can Rocketspark staff see what people submit through my forms? No. Rocketspark staff and third-party design partners see redacted data, not the raw values. Only users with the Owner, Admin, or Form Manager role can view the original submission content.
Is it safe to collect health or medical information through a Rocketspark form? The submission itself is encrypted in transit and at rest. The main thing to check is your notification emails, since those arrive in your inbox in plain text. Make sure that inbox has a strong password and 2FA.
Can other Rocketspark websites access my form data? No. Each website's data is encrypted with its own dedicated key and is cryptographically isolated from every other website's data.
How can I check the security of my site's connection myself? Run your site through a tool like Qualys SSL Labs. It shows you the TLS configuration independently.
Where does the risk sit with sensitive form data? Inside Rocketspark, the data is encrypted. The point to watch is the notification email, because once it lands in an inbox it's in plain text and protected only by that inbox's own security.
Need more help?
If you've still got questions about how your form data is handled, flick us a message at support@rocketspark.com. We're happy to talk it through.
Related help guides
How do I set up a contact form? — the natural starting point for anyone collecting form submissions.
How do I add team members and set their roles? — explains the Owner, Admin, and Form Manager roles referenced here.