Forms — live in the EU
Forms that never leave Europe.
Point any HTML form at deploybase — we store, filter, and email every submission from EU infrastructure. No server of your own, no US spam service in the loop.
The 30-second setup
One action URL. That's the integration.
Swap in your form ID and ship. It works from any site — CORS is open — form-encoded or as JSON over AJAX.
<form action="https://api.deploybase.eu/f/your-form-id" method="POST">
<input type="email" name="email" />
<input type="text" name="_gotcha" style="display:none" tabindex="-1" autocomplete="off" />
<button>Send</button>
</form>- Any site. Static, SSR, or JS-rendered — it's a stable runtime endpoint, not build-time HTML parsing, so the form doesn't have to exist in your built HTML.
- Form-encoded or JSON. Send
Accept: application/jsonand you get{"ok": true}back for a clean AJAX flow. Otherwise we issue a303redirect to your_nextURL — or our hosted thank-you page when you haven't set one. - Formspree-compatible reserved fields. Migration is a URL swap: keep your markup, change the action.
_gotcha honeypot — leave it hidden and empty_replyto sets the Reply-To on the email we send you_subject sets the notification subject line_next where to send the visitor after a submitSpam without surveillance
We filter bots, not your visitors.
Five layers, named plainly. Spam is quarantined, never dropped — one click marks it "not spam", and a bot always sees a normal success response. No Akismet, no reCAPTCHA, no US spam services, no CAPTCHA hoops for the people filling in your form.
- Configurable honeypot
A hidden field bots fill in and humans never see. Named per form, so scrapers can't learn it. A hit looks like success to the bot and lands in quarantine to you.
- Origin allow-list
Pin a form to the domains it should be submitted from. Off by default — CORS stays open so the endpoint works from anywhere — on when you want it.
- Per-IP rate limit
The only hard refusal on the page. One address firing far faster than a human can type gets turned away at the door. Everyone else passes.
- Flood quarantine
When a form is buried under a burst, the burst is set aside — not discarded. A real lead caught in a flood is never lost, just held for your review.
- Duplicate absorption
A double-clicked submit or a retrying script collapses into one submission, so your inbox isn't a hall of mirrors.
Raw IP addresses are never stored or logged — truncated (185.12.x.x) or nothing at all, your choice per form. Retention is yours to set:
keep forever, or auto-purge after 30, 90, or 365 days. Data-subject
requests run through an erasure API with an audit trail. Every
submission is stored in the EU, in Paris.
The honest gap
What it doesn't do yet — stated plainly.
- No file uploads yet. Accepting files means malware scanning, and we won't half-ship that. Text submissions today; uploads when we can do them safely.
- No outbound webhooks or Slack yet. They're coming — signed webhooks are on the roadmap. For now, notifications arrive by email.
- No autoresponders. Sending mail on your behalf to whoever fills in a form is a spam-relay risk, and we'd rather not be that open relay.
On quotas: we count verified submissions, spam never counts, and going over pauses your notifications — never your site, and never with a surprise bill.
Where your data lives
deploybase vs Netlify Forms vs Formspree
Netlify and Formspree are good products. The axis here is one thing: where your form data physically sits.
| Feature | deploybase | Netlify Forms | Formspree |
|---|---|---|---|
| Form data residency | EU (Paris) | US (no EU region) | US (AWS) |
| Included free | 100 submissions/mo | Free on credit plans | 50 submissions/mo |
| Spam filtering | Honeypot + rate limits, no CAPTCHA | Akismet + optional reCAPTCHA | Honeypot + reCAPTCHA + classifier |
| Works with SSR / JS-rendered forms | Yes | Build-time HTML parsing (SSR needs workarounds) | Yes |
| Retention auto-purge | Yes (30 / 90 / 365d) | Manual delete | — |
| Erasure API + audit trail | Yes | — | — |
| File uploads | Not yet | Yes | Paid plans |
Facts checked July 2026. “—” means not offered.
Straight answers
Common questions
Is this a GDPR-compliant form backend?
Submissions are stored and processed in the EU (Scaleway, Paris) — no US sub-processors in the path. Raw IP addresses are never stored or logged: you choose truncated (185.12.x.x) or nothing at all, per form. Set retention to keep forever or auto-purge after 30, 90, or 365 days, and handle data-subject requests through an erasure API that leaves an audit trail. It's built to sit inside a GDPR-compliant setup rather than around one.
Is deploybase a European alternative to Netlify Forms?
Yes. Netlify Forms and Formspree both store form data on US infrastructure. deploybase keeps every submission in the EU (Paris) and filters spam without Akismet, reCAPTCHA, or any US spam service. If your form data needs to stay in Europe, that's the difference. On features like file uploads Netlify does more today — we're honest about the gap.
Can I handle forms on a static site without a backend?
That's exactly the case it's built for. Point any HTML form's action at https://api.deploybase.eu/f/your-form-id and we store, filter, and email each submission — no server of your own, no serverless glue. It works from a static site, an SSR page, or a JS-rendered form, because it's a stable runtime endpoint, not build-time HTML parsing.
How do you stop spam without reCAPTCHA?
In layers, none of which put a puzzle in front of your visitors: a per-form configurable honeypot, an optional origin allow-list, a per-IP rate limit (the one hard refusal), flood quarantine, and duplicate absorption. Suspected spam is quarantined, never dropped — you get one-click 'not spam' in the dashboard, and a bot always sees a normal success response. No Akismet, no reCAPTCHA, no CAPTCHA hoops.
Can I migrate from Formspree?
Usually it's a one-line change. Our reserved fields — _gotcha, _replyto, _subject, _next — match Formspree's, so swap the form's action URL for your deploybase endpoint and existing markup keeps working. Form-encoded and JSON/AJAX submissions are both supported; send Accept: application/json and you get {"ok": true} back.
What happens if I go over my submission quota?
We count verified submissions; spam never counts against you. Going over pauses notifications until the next cycle — it never pauses your site, and it never bills you a surprise overage. The form keeps accepting and storing submissions; you just stop getting the emails until the next cycle starts — or sooner, if you move up a plan.
Give your forms an EU home.
Point a form at deploybase and read the first submission in your inbox — filtered, stored in Paris, and never routed through a US service.