One form backend for every client site

A workspace holds a client's forms, submissions, recipients and integrations. Invite client staff with the member role so they can read their own submissions, or as admins if they should change form settings too. Owners and admins manage forms; members cannot change them.

The form on the client's site is ordinary HTML, so it fits any CMS or builder you hand over. A hidden _subject keeps notifications easy to tell apart in a shared inbox:

Copy<!-- Client site: acme.example -->
<form action="https://forms.formward.eu/f/ACME_FORM_ID" method="POST">
  <input type="hidden" name="_subject" value="Acme website: new enquiry">
  <input type="text" name="name" required>
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>
  <input type="text" name="_gotcha" tabindex="-1" autocomplete="off"
         style="position:absolute;left:-9999px;opacity:0">
  <button type="submit">Send</button>
</form>

Every form has its own notification addresses, so enquiries go to the client and not through you. From Professional, each form can also have several webhooks, Slack or Discord channels, and a Google Sheets or Baserow sync, set up per client. Webhooks are signed with an HMAC header, retried on failure, and can be replayed from the dashboard if the client's endpoint was down.

• Sending domain. Verify the client's domain in their workspace (DKIM and SPF records) and notifications and autoresponses go out from it.
• From name and subject. Set them per form, instead of the Formward defaults.
• Hosted forms and pages without Formward branding for clients who want a form at a shareable link. This one starts on Professional.

In most setups your client is the controller, your agency is a processor, and Formward is a sub-processor. The documents a client will ask for are public: the DPA, which you accept in the dashboard with the version and time recorded, and the sub-processor register.

Your agency is responsible for its own data processing agreement with each client. Formward's DPA covers only Formward's processing, as a sub-processor of your agency. On Business you can give client staff read access to their responses, or let them prepare field changes, without adding them to your team.

Retention is set per form, so each client can have its own period. From Personal up, the DSAR console finds one person's submissions across a workspace's forms to export or erase them when a client receives an access or deletion request.

Your developers and account managers join each client workspace they work on. On Business, staff can sign in through your identity provider with OIDC, and SCIM keeps accounts in step when people join or leave. See single sign-on.

Formward stores submissions, file attachments and backups in Sweden, on servers run by Hostup AB. Notification email goes out through Mailjet from an EU data centre. Submitter IP addresses are replaced with a keyed HMAC-SHA-256 hash on receipt, so the raw address is never written to disk. On Professional and Business, AI features run on Mistral AI in France and can be switched off per form.

Data leaves the EU only where you send it: a notification inbox hosted outside the EU, a webhook URL, a Slack channel or a Google Sheet. Cloudflare Turnstile is a US service, and it is off unless you switch it on for a form. The details are in the sub-processor register, the data residency page and the published DPA. For the wider picture, see GDPR form backend.