Heronix Forms
A self-hosted form engine for K-12 districts, clinics, and front offices. Staff build forms in a browser-based designer and publish them by QR code, kiosk, or private link. People fill them out on any phone or computer, in English or Spanish, with no account and no app. Every answer is stored encrypted on a server you own.
Runs entirely on your server
One Windows server runs the whole product: the designer, delivery, records console, and database. No cloud, no telemetry, no vendor access. Heronix never receives your data.
Paperwork without the paper
26 ready-made bilingual templates across school, medical, office, HR, and facilities categories: registration, permission slips, intake, incident reports, releases, applications, and more.
Records-grade storage
AES-256-GCM encryption at rest, a tamper-evident audit chain, append-only amendments, retention rules with secure purge and legal hold, and a PDF of record for every submission.
What Heronix Forms does
Build, deliver, sign, and keep. All of it on your own server.
Visual form designer
20 field types, from text and dates to file and photo uploads, drawn and typed signatures, consent checkboxes, and computed scores. Conditional show/hide rules, multi-page forms, and reusable building blocks like guardian and emergency-contact sections. Draft and publish with versioning.
Publish anywhere
Post a QR code, run a kiosk in the front office, or send private links that expire and can be revoked. Only a hash of each link token is ever stored on the server. Respondents need nothing but a phone or a browser.
Packets
Bundle several forms (registration, permissions, releases) into one packet a family completes in a single sitting, with save-and-finish-later and a single receipt at the end.
Invitations and reminders
Email invitations and automatic reminders go out through your own mail account, and optional text-message invitations through a provider you configure. Messages carry your organization's name and a private link, not form data. Nothing routes through Heronix.
Electronic signatures
Drawn or typed signatures with a proper e-sign disclosure ceremony, captured in the PDF of record for every submission.
Records back office
A submissions console with search and detail views, CSV export with injection defense, printable copies and receipts, and an accounting-of-disclosures report covering every view, download, export, and push.
Security and administration
Per-form staff permissions with default deny, offline two-factor authentication with recovery codes, account lockout, operating-hours access schedules, maintenance mode, and PII redaction in server logs.
Backups and recovery
Encrypted nightly and on-demand backups to destinations you choose, key escrow with offline recovery tools, and break-glass owner recovery. Signed outbound webhooks can push submissions to systems you run, with a full delivery log.
Deployment model
Self-hosted on one Windows server. A guided installer runs pre-flight checks, generates the encryption key, sets up the database, opens the firewall port, and can register auto-start. The package carries its own Java runtime, so there is nothing else to install.
Scales with you. An embedded database covers a single building; PostgreSQL covers district scale. The schema is migration-managed in both.
The client is a browser. Staff and respondents need nothing but a web browser or a phone. Pages are served by the district server with zero external assets, so the product works on a closed network.
In scope today (v1.0.0-beta.1)
- Visual designer & 26 bilingual templates
- QR, kiosk & private-link delivery
- Multi-form packets
- Email & SMS invitations with reminders
- Electronic signatures
- Encrypted storage & tamper-evident audit chain
- Retention, secure purge & legal hold
- Encrypted backups & key escrow
- Offline USB license activation
- English & Spanish throughout
Privacy & compliance posture
Built for organizations that answer to records law, on infrastructure they control.
FERPA posture for schools
Completed forms are education records that stay on district servers under district control. Retention rules, secure purge, and the audit trail support the district's own records obligations.
Architected to support HIPAA-compliant deployment
For clinic use: encryption at rest, minimum-necessary permissions, a tamper-evident audit trail, accounting of disclosures, and retention with secure purge. Because the product runs entirely on your premises and Heronix never has access to your data, there is no vendor data relationship to manage.
Egress you control
No cloud, no telemetry, no vendor access. Optional integrations (your mail relay, your SMS provider, your webhook endpoints) send only what you configure, to destinations you choose, guarded against server-side request forgery.
Under the hood
The engineering behind the form engine.
Server
- Java 25 on Spring Boot 4
- Server-rendered pages, zero external assets, no CDN calls
- PostgreSQL at scale or an embedded database for one building, both migration-managed
- Permissively licensed dependencies only; copyleft PDF libraries are banned by a build-time gate
Security
- AES-256-GCM encryption at rest for submissions and attachments
- HMAC tamper-evident audit chain, verified nightly and on demand
- Outbound URL guard with DNS-rebinding protection on every operator-supplied destination
- Rate limiting, strict session cookies, sanitized respondent input
- 249 automated tests, including full backup-restore and database-migration integration tests
Licensing & pilot
- Offline USB license activation; no license server, works on a closed network
- Perpetual license with the standard Heronix annual upkeep agreement
- 90-day pilot package: the complete product with an evaluation clock
- Activating a full license converts the same install in place, data intact
Status & availability
Heronix Forms is v1.0.0-beta.1 and available as a 90-day pilot package: the complete product, installed by a guided installer on one Windows server, with an evaluation clock. When the evaluation ends, the server locks to the license page and your data stays intact.
Interested in evaluating it at your school, clinic, or office? Get in touch and we will send the pilot package and walk you through the install.
Privacy is part of the architecture
Heronix Forms keeps data inside your perimeter by construction: the whole product runs on your server, pages load zero external assets, and Heronix never receives your data. That is the same commitment behind every Heronix product.
Want to see Heronix Forms on your own server?
The 90-day pilot package is the full product. Install it in an afternoon, build your first form the same day.
Request the pilot How we handle data