Server-Side Input Limitations

Hello friends, I would like to know if the input limitation for the email to contain more than a number of characters or limit an input to not be empty or any input validation, these validations are server-side or need to be validated by a workflow to prevent it from being modified on the client side?