Blog
Notes on form backends, EU data residency, and keeping spam out.
The Formward Team6 min read
A scheduled job can be broken in ways that produce no error, no log line, and no failed exit code anywhere a human looks. Four small mechanisms cause most of it: a carriage return, cron's % rule, tests that exercise the wrong parser, and a timezone assumption. Here is the anatomy, and the checklist that catches all four.
Read →The Formward Team7 min read
"Your data never leaves the EU" is the standard claim, and for most form backends (including, until this week, several pages of our own site) it is not quite true. Here is the honest version: what stays, what leaves, who is responsible for which, and the one setting that sends submission content to a US provider with nothing switched on.
Read →The Formward Team7 min read
Form notifications get filtered more often than ordinary mail, and it is usually not your domain reputation. Here is the mechanism behind it, how to tell a real authentication problem from a false positive, and what actually fixes it.
Read →The Formward Team6 min read
Looking for a Formspree alternative that keeps submissions in Europe? Here is an honest look at why EU hosting matters for GDPR, what to check, and how Formward differs.
Read →The Formward Team2 min read
You no longer need a site to collect submissions. Publish a hosted form on Formward and share the link directly, with the data still in Europe.
Read →The Formward Team7 min read
Send form submissions to Slack and Discord the moment they arrive using outbound webhooks. Here is how signed webhooks work, how to set them up, and why the signing secret matters.
Read →The Formward Team7 min read
A practical guide to a GDPR compliant contact form: lawful basis, consent, data minimisation, retention, DSARs, and vetting your sub-processors.
Read →The Formward Team7 min read
A practical guide to Next.js form submission in the App Router: server action versus direct POST, JSON responses, and a spam honeypot, all without running your own backend.
Read →The Formward Team6 min read
Choosing a GDPR form backend comes down to five things: data residency, a real DPA, named sub-processors, consent handling, and retention. Here is what to check, and where an EU-native option fits.
Read →The Formward Team7 min read
When you need a DPA for your contact form, why the relationship usually requires one, and what a good data processing agreement actually covers.
Read →The Formward Team8 min read
How to get real form spam protection in 2026 without reCAPTCHA: honeypots, rate limiting on hashed IPs, Cloudflare Turnstile, and AI spam scoring, with the tradeoffs of each layer.
Read →The Formward Team6 min read
How to give a React form a backend without running a server: a controlled form, a fetch POST to a form endpoint, and proper success and error states you can ship today.
Read →The Formward Team2 min read
Most form-handling services route your visitors' data through US infrastructure. Here is why that is a GDPR problem, and what to do about it.
Read →The Formward Team1 min read
You can collect form submissions without writing a single line of server code. Here is the mechanism behind a backend-less form.
Read →The Formward Team1 min read
The Schrems II ruling changed what it means to send EU personal data to the US. Here is what it actually means for the humble contact form.
Read →The Formward Team1 min read
Rate limiting usually means keeping a log of IP addresses. Here is how Formward stops floods while treating the IP as a secret.
Read →