Accept job applications on your own site

The simplest setup is one Formward form per opening. The role sits in a hidden position field, the _subject field names it in the notification, and closing the role means switching that form off. Each form has its own recipients and retention, so a short contract role and a senior hire can follow different rules.

If you would rather run one form for the whole careers page, make position a dropdown instead. On Personal and above you can search the submissions list, so filtering by role is one search.

A relative _redirect such as /careers/thanks/ sends the candidate back to your own site after a normal submit. Add your domain to the form's allowed origins so the endpoint only accepts posts from your own site.

On Professional a candidate can attach up to 5 files of up to 10 MiB each; Business allows 10 files of up to 25 MiB. PDF and Word files are accepted, along with images and OpenDocument files. Files are stored with the submission in Sweden and deleted with it.

On Free and Personal, swap the file input for a link. You then store a URL instead of a document:

Copy<label>Link to your CV, LinkedIn profile or portfolio
  <input type="url" name="cv_link" placeholder="https://" required>
</label>

The job application template has both versions with every field explained.

• Every plan emails each application to a verified address. Several recipients per form, for example the hiring manager and HR, start on Personal.
• Colleagues you invite to the workspace see applications in the dashboard: 2 seats on Free, 5 on Personal, 15 on Professional and 50 on Business.
• Turn on link-only notifications for the form and the email says only that an application arrived, with a link. Names, answers and file names stay out of mailboxes, which matters when an inbox is shared or hosted outside the EU.
• On Professional and Business, the autoresponder can confirm receipt to the candidate, and a webhook can pass each application to your applicant tracking system.

You can publish the form as a page of its own and share the link in the job ad. Free includes one published page and unlimited hosted forms. The hosted job application template uses a CV link with an optional upload, and the upload field needs Professional. See hosted forms for the details.

Handling an application the candidate chose to send you does not usually rest on consent, so the form does not need a mandatory consent box. Keeping the CV for future openings is a separate purpose: ask for it with an optional, unticked checkbox named _consent. Enter the same wording as the form's consent text in its settings, and Formward stores that text and the time with each application that agrees. The consent checkbox guide covers the wording.

Then set the form's retention to the period you tell candidates. On Free, submissions are deleted after 30 days. Paid plans choose any period from 1 to 3,650 days, and the nightly cleanup removes expired applications together with their files. The retention guide has a starting point for job applications.

If a candidate asks you to delete their application, delete the submission in the dashboard. From Personal, the DSAR console searches the forms in all your workspaces for one email address and can export or erase what it finds.

Formward stores submissions, file attachments and backups in Sweden, on servers run by Hostup AB. Notification email goes out through Mailjet from an EU data centre. Submitter IP addresses are replaced with a keyed HMAC-SHA-256 hash on receipt, so the raw address is never written to disk. On Professional and Business, AI features run on Mistral AI in France and can be switched off per form.

Data leaves the EU only where you send it: a notification inbox hosted outside the EU, a webhook URL, a Slack channel or a Google Sheet. Cloudflare Turnstile is a US service, and it is off unless you switch it on for a form. The details are in the sub-processor register, the data residency page and the published DPA. For the wider picture, see GDPR form backend.