Your data, under your control
Most "AI form fillers" send your personal information to a model in the cloud. FillOnce doesn't. Here's exactly how we keep your data private.
Never sent to any AI
Your stored vault values — names, IDs, addresses, your family's details — are never sent to an AI model, ours or anyone else's. They are never used to train anything. The optional field-matcher only ever sees a form's labels (its structure), never your data, and only if you turn it on.
Vault values: end-to-end encrypted
Vault values are encrypted in your browser before upload using a key derived from your passphrase. FillOnce stores only ciphertext and the wrapped key material — without your passphrase or recovery key, even our database admins cannot decrypt your vault. Data is encrypted in transit with TLS.
Documents: server-processed, then encrypted at rest
To detect form fields, run OCR on scans, and fill PDFs, our servers handle the document bytes in memory. Source files and exported (filled) outputs are stored in encrypted-at-rest object storage, scoped per account at the database layer, and retained until you delete them. We don't analyze documents or share them. After each export we wipe the plaintext field values from our database (the encrypted vault values remain available for future fills). You can delete any individual document at any time, or delete your account to remove everything in one step.
You stay in control
Confidential and restricted fields require your review before they are written into an exported document. The extension never submits a form for you. Export or delete your vault, documents, and account at any time. Self-hosting is supported if you want data to stay on your own infrastructure.
Built for families, schools, and anyone handling sensitive paperwork
Camp forms, school registrations, medical intake, legal and job paperwork — the documents that ask for the most personal details are exactly the ones you shouldn't hand to an AI. We designed FillOnce so you never have to.