Status
What is running, and what has not been checked against a real service.
Live health check: /api/health. It returns {"status":"ok"} with HTTP 200 when the database answers, and 503 otherwise.
Not verified against live services
Automated tests use injected fake responses. Treat each item below as untested until you have run it in a sandbox account.
| Area | State |
|---|---|
| Stripe (Connect, restricted key, subscriptions, portal, refunds) | Mocked-fetch tests only. No live or test-mode account has been run. |
| PayPal (orders, capture, webhook verification, refunds) | Mocked-fetch tests only. PayPal subscriptions are not implemented. |
| Integrations (CRM, spreadsheets, chat, analytics adapters) | Every adapter ships as unverified until someone runs scripts/verify-integrations.ts and a sandbox action test. |
| Data sources (Airtable, Google Sheets, Notion) | Written against provider documentation; not run against real accounts. |
| SMS verification codes (Twilio) | Not sent through Twilio by this project. |
| Address suggestions (Google Places, Mapbox) | Not called live by this project. |
| Captcha (Turnstile, hCaptcha) | Not verified against the live providers. |
| Custom domains and automatic TLS (Caddy) | The proxy setup has not been run against a live ACME CA or production DNS. |
| SDK packages (npm, PyPI, pub.dev) | Source, CI and signed build provenance are public under github.com/formizeflow. Registry publishing turns on per repo once the npm, PyPI and pub.dev trusted publishers are set up. |
| Zapier and Make apps | Written from public documentation. Not validated, not submitted, not reviewed by either company. |
| Docker compose file | The production image is built from Dockerfile.prebuilt; docker-compose.yml has not been started. |
| E-signature | Tamper evidence only. No legal or compliance certification is claimed. |
What does not exist
FormFlow holds no SOC 2, HIPAA, PCI DSS or ISO certification and makes no claim of compliance with them. Storage is SQLite on a single node: there is no Postgres option and no regional hosting or data-residency choice. High availability and horizontal scaling are not supported.