The European alternative to Netlify Forms.

Yes — deploybase Forms is a European alternative to Netlify Forms. Every submission is stored and processed in the EU (Scaleway, Paris), with zero third-party services in the submission path: no Akismet, no reCAPTCHA, no US spam filter. Spam is handled with a per-form honeypot, rate limits, and a quarantine that never silently drops a message. GDPR tooling is built in: raw IP addresses are never stored (truncated to a /16 by default, or off entirely per form), retention auto-purges after 30, 90, or 365 days, and data-subject requests run through an erasure API with an audit trail. The integration is one action URL, so it works from any static site, SSR page, or JS-rendered form — including sites that stay hosted on Netlify.

Netlify Forms' documented spam escalation is Google reCAPTCHA v2 — either a widget you add yourself or one Netlify injects into your form for you. The baseline layer is Akismet, Automattic's US-based spam service, which Netlify's docs describe filtering all submissions through; it is not documented as optional. That means a visitor's message can touch two US companies before it reaches your dashboard. reCAPTCHA also carries a consent problem in Europe: under §25(1) TDDDG, Germany's telecom-privacy law, it requires prior consent because it reads and writes device information that isn't strictly necessary — and even after Google's April 2026 switch to a data-processor role, that consent requirement doesn't go away. Austria's Federal Administrative Court reached the same conclusion in September 2024. deploybase uses no CAPTCHA at any escalation level, so there's nothing for a consent banner to gate.

Netlify has not published an EU data-residency option for Forms. On Netlify's own support forum, staff have confirmed that form submissions are handled on US infrastructure, with Standard Contractual Clauses covering the transfer for European customers. SCCs are a valid legal mechanism, and the EU–US Data Privacy Framework currently stands — but it faces an ongoing challenge before the CJEU, so many European teams prefer to avoid the transfer question entirely rather than re-litigate it at every client's DPA review. deploybase stores every form submission in Paris, on Scaleway infrastructure, and never routes it through a US service. When a compliance review asks where the form data goes, "Paris" is a much shorter conversation.

Usually in three edits. A Netlify form is declared with a data-netlify attribute and a hidden form-name field that Netlify parses out of your built HTML. To migrate: point the form's action at your deploybase endpoint (https://api.deploybase.eu/f/your-form-id), remove data-netlify and the hidden form-name input — the endpoint URL identifies the form — and replace netlify-honeypot with our _gotcha honeypot field. Reserved fields _replyto, _subject, and _next control the notification email and the post-submit redirect, and they're Formspree-compatible. Because deploybase Forms is a runtime endpoint rather than build-time HTML parsing, the form doesn't need to exist in your built HTML, so SSR and JS-rendered forms work without workarounds. Your site can stay on Netlify hosting — the endpoint works from any origin.

In layers, none of which put a puzzle in front of your visitors or send their data to a third party: a per-form configurable honeypot, an optional origin allow-list, a per-IP rate limit (the one hard refusal), flood quarantine, and duplicate absorption. Suspected spam is quarantined, never dropped — you get one-click "not spam" in the dashboard, and a bot always sees a normal success response, so it never learns what tripped it. The important part for a privacy review: your visitor's browser makes no third-party request, and no submission leaves our EU infrastructure to be scored by an external service. Spam never counts against your submission quota either.

Yes — Netlify Forms is included on Netlify's credit-based plans, and we won't pretend otherwise. deploybase's free plan includes 100 verified submissions per month, with spam never counted against the quota, and paid plans raise the limit. The honest framing: this comparison isn't about price, and it isn't about feature count either — Netlify Forms has file uploads today and we don't yet. It's about where submissions live (Paris vs. US infrastructure with no published EU option) and what touches them on the way in (nothing vs. Akismet, with reCAPTCHA as the documented escalation). If those two things matter to your project, that's the reason to switch.