Accept file uploads on any HTML form

The per-submission ceiling is the same on both plans; Business gets larger single files and more of them inside it. The stored total covers every form in the workspace, and deleting submissions frees the space again. Set the accept attribute and a note next to the input so visitors know the limits before they pick a file.

Formward accepts images (JPEG, PNG, GIF, WebP), PDF, plain text and CSV, Microsoft Office documents (Word, Excel, PowerPoint) and their OpenDocument equivalents. Anything else, including archives, executables, scripts and HTML, is refused with a 415.

new FormData(form) picks up file inputs along with the other fields. On success the JSON response includes the number of files stored.

Copyconst form = document.querySelector("form");
form.addEventListener("submit", async (event) => {
  event.preventDefault();
  // Do not set Content-Type yourself: the browser adds the multipart boundary.
  const res = await fetch(form.action, {
    method: "POST",
    headers: { Accept: "application/json" },
    body: new FormData(form),
  });
  const data = await res.json();
  if (res.ok) {
    form.reset();
    form.after(`Received, with ${data.files} file(s).`);
  } else {
    // 413: too large, 415: file type not allowed, 403: uploads not enabled
    alert(data.error);
  }
});

Files are stored with the submission in Sweden, on infrastructure run by Hostup AB, the same as the rest of the submission. They appear in an Attachments section on the submission with their size and type. The notification email links to them rather than carrying them, which keeps CVs and ID photos out of mail archives.

Uploaded documents are often the most sensitive part of a submission. Set a retention period on the form, anywhere from 1 to 3,650 days, and the nightly cleanup deletes expired submissions together with their files. If a stored file cannot be removed on the first try, the job keeps retrying it instead of forgetting it. The retention guide suggests periods for common form types.

Formward stores submissions, file attachments and backups in Sweden, on servers run by Hostup AB. Notification email goes out through Mailjet from an EU data centre. Submitter IP addresses are replaced with a keyed HMAC-SHA-256 hash on receipt, so the raw address is never written to disk. On Professional and Business, AI features run on Mistral AI in France and can be switched off per form.

Data leaves the EU only where you send it: a notification inbox hosted outside the EU, a webhook URL, a Slack channel or a Google Sheet. Cloudflare Turnstile is a US service, and it is off unless you switch it on for a form. The details are in the sub-processor register, the data residency page and the published DPA. For the wider picture, see GDPR form backend.