IFrame security and CORS
<p>I have a generic question which I am trying to get a bit of information on.</p>

<p>I have a server and on this server I have a webform which submits to an API.</p>

<p>A third party company has a server and they need to host my form.  As such, they IFrame my form into their page.</p>

<p>Is there any possible way for the third party company to obtain the data entered into the form contained within the iframe?  Will their Apache logs record the data?  Can they do something on their server which can help them get data?</p>

<p>My server is secure, it wont allow CORS or anything of this sort.  The question is whether they can do anything their side to obtain the inputted data?</p>