# formcel Trust Center

> formcel runs every customer on dedicated, isolated infrastructure in the region they choose, encrypts all data at rest and in transit, and builds toward formal attestation in the open. This page lists exactly what we have in place today, what is self-attested, and what is still on the roadmap.

Every claim here is a legal statement about formcel, Inc. (formcel.com). Status values are exact: "Certified" means a third party issued a report, "Compliant" means we assess ourselves as meeting the framework, "In progress" and "Planned" mean no claim of compliance is made. formcel holds no SOC 2, ISO 27001 or HIPAA attestation today. Last updated 2026-09-02.

## Pages

- [Overview](https://trust.formcel.com/index.md): Security and compliance posture at a glance: frameworks, control counts, documents and FAQ.
- [Controls](https://trust.formcel.com/controls.md): Every security control live in production today, grouped by category, with a plain-English description.
- [Subprocessors](https://trust.formcel.com/subprocessors.md): Complete list of third parties that may process customer data, with purpose, data category and location.
- [Resources](https://trust.formcel.com/resources.md): Policies, legal agreements and security reports, marked public or available on request.
- [Data residency](https://trust.formcel.com/residency.md): Regions where customer data can be stored and processed.
- [FAQ](https://trust.formcel.com/faq.md): Answers to the questions asked most often in security reviews.

## Contact

- [Security](mailto:security@formcel.com): vulnerability reports and security questionnaires
- [Privacy](mailto:privacy@formcel.com): data subject requests, DPAs and privacy inquiries