Skip to content
New AI Custom Form BuilderDescribe the intake form. It ships branded and end-to-end encrypted.AI Custom Form Builder is here See it build
All case studies
Online groceryDropzone APIWith the White House

Instacart protected a national sweepstakes with end-to-end encrypted web forms.

For the Get Vaxxed For Snacks Sweepstakes, run with the White House to encourage more Americans to get their first vaccine shot, Instacart collected entries through its own web form. SendSafely’s Dropzone API encrypted every submission in the participant’s browser.

Download the PDF Request a demo
Get Vaxxed For Snacks campaign artwork
The Get Vaxxed For Snacks campaign
200Sweepstakes winners, each awarded a $500 Instacart gift card
E2EEvery submission encrypted on the participant’s device
APIDropzone embedded in Instacart’s own form
The challenge

A public form, collecting personal and vaccination details

If you need to collect sensitive data from customers, a web form is an attractive option. Used without protection, however, web forms present a serious exposure to both you and your customers: submissions sit in plaintext wherever the form provider stores them.

The sweepstakes entry form asked for each participant’s name, email address, city and state, along with the date of their first vaccination and the clinic that gave it. For a national campaign run with the White House, Instacart needed that data protected from the moment a participant hit submit, without asking anyone to install anything or create an account.

The requirement: A public web form that encrypts on the participant’s device.

End-to-end encryption applied to form submissions, with no accounts, no plug-ins, and no plaintext copies sitting in a form vendor’s database.

Encrypted · Get Vaxxed For Snacks entry form
The Get Vaxxed For Snacks Sweepstakes entry form, asking for name, email, city, state, first vaccination date and vaccination location

The sweepstakes entry form. Entries were encrypted in the browser before they were sent.

The solution

The Dropzone API behind a custom web form

Instacart used the SendSafely Dropzone API to encrypt sweepstakes submissions in the participant’s browser before they ever reached a server.

Participant’s browserThe entry is encrypted on submit
SendSafelyStores ciphertext and half the key. It can’t read entries on its own
Instacart’s teamAuthorized staff decrypt and review entries

Because the Dropzone API sits inside Instacart’s own page, participants saw Instacart’s form and nothing else: no accounts, no plug-ins. SendSafely holds ciphertext and half the key, so nobody, not even SendSafely, can read a submission on its own.

The impact

A national campaign, no plaintext exposure.

Protected Data

Every submission was encrypted on the participant’s device, removing plaintext exposure across the collection pipeline.

Developer Friendly

The Dropzone API dropped into an existing custom form without changing the participant experience.

Ready to Scale

A public campaign with national reach ran on the same infrastructure that protects enterprise file exchange.

If you collect sensitive data through a web form, encryption belongs on the sender’s device, not in a vendor’s database.

SendSafely · on encrypted web forms
More customer stories

See how others protect what matters.

MercuryFrom agent to customer, Mercury delivers secure file exchangeFintechRead the story FreshBooksFreshBooks secures sensitive customer data in ZendeskAccountingRead the story
Get started

Protect every file. Every exchange. Every time.

Find out why companies across the globe use SendSafely to protect the security and privacy of their confidential data.

Request a demo