Forms — live in the EU
Forms that never leave Europe.
Point any HTML form at deploybase — we store, filter, and email every submission from EU infrastructure. No server of your own, no US spam service in the loop.
The 30-second setup
One action URL. That's the integration.
Swap in your form ID and ship. It works from any site — CORS is open — form-encoded or as JSON over AJAX.
<form action="https://api.deploybase.eu/f/your-form-id" method="POST">
<input type="email" name="email" />
<input type="text" name="_gotcha" style="display:none" tabindex="-1" autocomplete="off" />
<button>Send</button>
</form>- Any site. Static, SSR, or JS-rendered — it's a stable runtime endpoint, not build-time HTML parsing, so the form doesn't have to exist in your built HTML.
- Form-encoded or JSON. Send
Accept: application/jsonand you get{"ok": true}back for a clean AJAX flow. Otherwise we issue a303redirect to your_nextURL — or our hosted thank-you page when you haven't set one. - Formspree-compatible reserved fields. Migration is a URL swap: keep your markup, change the action.
_gotcha honeypot — leave it hidden and empty_replyto sets the Reply-To on the email we send you_subject sets the notification subject line_next where to send the visitor after a submitSpam without surveillance
We filter bots, not your visitors.
Five layers, named plainly. Spam is quarantined, never dropped — one click marks it "not spam", and a bot always sees a normal success response. No Akismet, no reCAPTCHA, no US spam services, no CAPTCHA hoops for the people filling in your form.
- Configurable honeypot
A hidden field bots fill in and humans never see. Named per form, so scrapers can't learn it. A hit looks like success to the bot and lands in quarantine to you.
- Origin allow-list
Pin a form to the domains it should be submitted from. Off by default — CORS stays open so the endpoint works from anywhere — on when you want it.
- Per-IP rate limit
The only hard refusal on the page. One address firing far faster than a human can type gets turned away at the door. Everyone else passes.
- Flood quarantine
When a form is buried under a burst, the burst is set aside — not discarded. A real lead caught in a flood is never lost, just held for your review.
- Duplicate absorption
A double-clicked submit or a retrying script collapses into one submission, so your inbox isn't a hall of mirrors.
Raw IP addresses are never stored or logged — truncated (185.12.x.x) or nothing at all, your choice per form. Retention is yours to set:
keep forever, or auto-purge after 30, 90, or 365 days. Data-subject
requests run through an erasure API with an audit trail. Every
submission is stored in the EU, in Paris.
For agencies and client sites
Submissions go to the person who answers them.
You build the site. Your client answers the enquiries. They should not need a hosting account, or a password for one, to read a message sent from their own website.
Add their address as a recipient on the form, they confirm it once, and from then on every enquiry lands in the inbox they already use.
- Verified opt-in. Nobody gets submission mail until they confirm the address themselves. One email, one click, no account.
- The whole submission in the mail. Every field in the email body. No login, no dashboard, no preview that turns into a signup.
- A way out on every email. One-click unsubscribe that Gmail and Outlook surface natively, and removing a recipient removes their data.
Northwind Studio added you to enquiries on bakery-site
- what arrives
- each submission, full content
- how often
- as they come in, digested during floods
- the way out
- one click, any email
The honest gap
What it doesn't do yet — stated plainly.
- No file uploads yet. Accepting files means malware scanning, and we won't half-ship that. Text submissions today; uploads when we can do them safely.
- No outbound webhooks or Slack yet. They're coming — signed webhooks are on the roadmap. For now, notifications arrive by email.
- No autoresponders. Sending mail on your behalf to whoever fills in a form is a spam-relay risk, and we'd rather not be that open relay.
On quotas: we count verified submissions, spam never counts, and going over pauses your notifications — never your site, and never with a surprise bill.
Where your data lives
deploybase vs Netlify Forms vs Formspree
Netlify and Formspree are good products. The axis here is one thing: where your form data physically sits. Migrating from Netlify? See the full deploybase vs Netlify Forms comparison.
| Feature | deploybase | Netlify Forms | Formspree |
|---|---|---|---|
| Form data residency | EU (Paris) | US (no EU region) | US (AWS) |
| Included free | 100 submissions/mo | Free on credit plans | 50 submissions/mo |
| Spam filtering | Honeypot + rate limits, no CAPTCHA | Akismet + optional reCAPTCHA | Honeypot + reCAPTCHA + classifier |
| Works with SSR / JS-rendered forms | Yes | Build-time HTML parsing (SSR needs workarounds) | Yes |
| Retention auto-purge | Yes (30 / 90 / 365d) | Manual delete | — |
| Erasure API + audit trail | Yes | — | — |
| File uploads | Not yet | Yes | Paid plans |
Facts checked July 2026. “—” means not offered.
Straight answers
Common questions
Is this a GDPR-compliant form backend?
Submissions are stored and processed in the EU (Scaleway, Paris) — no US sub-processors in the path. Raw IP addresses are never stored or logged: you choose truncated (185.12.x.x) or nothing at all, per form. Set retention to keep forever or auto-purge after 30, 90, or 365 days, and handle data-subject requests through an erasure API that leaves an audit trail. It's built to sit inside a GDPR-compliant setup rather than around one.
Is deploybase a European alternative to Netlify Forms?
Yes. Netlify Forms and Formspree both store form data on US infrastructure. deploybase keeps every submission in the EU (Paris) and filters spam without Akismet, reCAPTCHA, or any US spam service. If your form data needs to stay in Europe, that's the difference. On features like file uploads Netlify does more today — we're honest about the gap.
Can I handle forms on a static site without a backend?
That's exactly the case it's built for. Point any HTML form's action at https://api.deploybase.eu/f/your-form-id and we store, filter, and email each submission — no server of your own, no serverless glue. It works from a static site, an SSR page, or a JS-rendered form, because it's a stable runtime endpoint, not build-time HTML parsing.
How do you stop spam without reCAPTCHA?
In layers, none of which put a puzzle in front of your visitors: a per-form configurable honeypot, an optional origin allow-list, a per-IP rate limit (the one hard refusal), flood quarantine, and duplicate absorption. Suspected spam is quarantined, never dropped — you get one-click 'not spam' in the dashboard, and a bot always sees a normal success response. No Akismet, no reCAPTCHA, no CAPTCHA hoops.
Can I migrate from Formspree?
Usually it's a one-line change. Our reserved fields — _gotcha, _replyto, _subject, _next — match Formspree's, so swap the form's action URL for your deploybase endpoint and existing markup keeps working. Form-encoded and JSON/AJAX submissions are both supported; send Accept: application/json and you get {"ok": true} back.
What happens if I go over my submission quota?
We count verified submissions; spam never counts against you. Going over pauses notifications until the next cycle — it never pauses your site, and it never bills you a surprise overage. The form keeps accepting and storing submissions; you just stop getting the emails until the next cycle starts — or sooner, if you move up a plan.
Can form submissions go to someone without a deploybase account?
Yes. Add their address in the form's settings and they get one email naming your team, the project, and the form. They confirm on a page that needs no account, and from then on every submission lands in their inbox with the full content, not a preview. Every one of those emails carries one-click unsubscribe, the kind Gmail and Outlook surface natively, and declining or unsubscribing stops the mail immediately. Verification links are single-use and expire after 72 hours, and there are per-team and per-address caps on invitations and sends, so the flow cannot be used to spam anyone.
Give your forms an EU home.
Point a form at deploybase and read the first submission in your inbox — filtered, stored in Paris, and never routed through a US service.