- Encrypted connections. Every page and every request uses HTTPS, with TLS 1.2 or newer; browsers are told to use HTTPS only (HSTS).
- Servers in the EU. Our servers run at Hostinger in Lithuania. Access is restricted, the web server sends security headers, and repeated failed logins are blocked automatically.
- Passwords. Microcity Labs accounts store passwords as one-way hashes (bcrypt). FormFillPilot has no passwords at all: a key identifies you, and our logs show only its last four characters.
- Payment details never reach us. Stripe and Paddle take the payment as merchants of record; we keep only their transaction id.
- Little kept, short-lived files. A FormFillPilot PDF form is deleted within 30 minutes; the text of your FormFillPilot files stays in your browser; uploaded catalog files are deleted after 30 days (see the retention page).
- Limits against abuse. Requests are rate-limited per minute and AI spending is capped per key per day.
- FormFillPilot acts only on your click. It never submits a form, never creates accounts, never types passwords or payment details and does not solve CAPTCHAs.
Reporting a problem
If you find a security problem, write to contact@microcitylabs.com with "Security" in the subject. Please give us a reasonable time to fix it before telling anyone else. If a breach puts your data at risk, we tell the ICO within 72 hours and tell you without undue delay, as the UK GDPR requires.