No. It receives, filters, stores and forwards form submissions. Most teams send leads on to their CRM with a webhook, n8n or a spreadsheet sync and work them there.

Does lead scoring send data outside the EU?

No. AI features run on Mistral AI in France. They are on by default on Professional and Business and can be switched off per form. Free and Personal submissions are never sent to the AI provider.

Do hosted forms record UTM parameters too?

Yes. A hosted form page passes the UTM parameters from its own link along with the submission, so you do not need the script there.

Do I need a consent checkbox for marketing follow-up?

If you plan to send marketing to the address, you usually need consent for that purpose. Formward's consent capture records your wording and the time it was given, on every plan.

Use case · Lead generation

Lead capture forms that keep track of where each lead came from

Send the page's UTM parameters along as hidden fields and Formward files them with the submission instead of mixing them into the answers. The form's analytics then count leads by source. Here is a demo-request form that does it with a short script:

<form id="demo" action="https://forms.formward.eu/f/YOUR_FORM_ID" method="POST">
  <input type="text" name="name" required>
  <input type="email" name="email" placeholder="Work email" required>
  <input type="text" name="company">
  <input type="text" name="_gotcha" tabindex="-1" autocomplete="off"
         style="position:absolute;left:-9999px;opacity:0">
  <button type="submit">Request a demo</button>
</form>

<script>
  // Copy UTM parameters from the page URL into the form as hidden fields.
  const params = new URLSearchParams(location.search);
  const form = document.getElementById("demo");
  for (const key of ["utm_source", "utm_medium", "utm_campaign", "utm_term", "utm_content"]) {
    const value = params.get(key);
    if (value) form.append(Object.assign(document.createElement("input"), { type: "hidden", name: key, value }));
  }
</script>

On Professional and Business each lead also gets an AI score from 0 to 100 and a short summary, processed by Mistral AI in France.

What gets recorded with each lead

Source: the utm_source value, or the referring site's host when there is none, or "direct".
Medium, campaign, term and content from the matching UTM fields, when present.
Referrer, cut down to origin and path so query strings with personal data are not kept.

These values are stored as submission metadata, so they do not show up as answers in the notification email. Every value is length-capped, and a malformed one is dropped rather than failing the submission.

Keeping junk out of the pipeline

A lead form's worst output is a plausible fake. Alongside the honeypot and the per-IP rate limit, switch on the disposable-email block for the form: submissions from throwaway address domains are refused. Cloudflare Turnstile is available on every plan when a form is targeted directly. On Professional and Business, the AI spam score holds back what still looks like spam, and those submissions are refunded against your monthly allowance.

AI lead scoring

On Professional and Business, each submission that passes the spam checks gets a lead score from 0 to 100, a summary of up to 200 characters, and a spam verdict. The score sits on the submission in the dashboard, and the form's analytics show how scores are spread.

You can also write routing rules in plain English, for example "pricing questions go to sales@, bug reports to support@". The AI picks one address from the ones you listed and cannot send anywhere else. If the AI is unavailable, the lead is still stored and emailed to the form's normal address.

Getting leads into your CRM

Webhooks (Professional and up): each submission is POSTed as JSON to your URL, signed with an HMAC header you can verify. A form can have several. n8n, Make and Zapier's webhook trigger all accept it.
Google Sheets and Baserow (Professional and up): rows added as leads arrive.
Slack or Discord (Professional and up): a message in the channel your sales team watches.
CSV export (Personal and up) and the REST API (Professional and up) when you would rather pull.

X-Formward-Signature: t=<unix-timestamp>,v1=<hex-hmac>

The webhook docs show how to check that header. Note that Slack, Google Sheets and many CRMs are hosted outside the EU, and sending leads there is a transfer you make as the controller.

Volume by plan

Plan	Submissions / month	At the limit
Free	50	New submissions refused
Personal	200	New submissions refused
Professional	2,000	20% more accepted as overage
Business	20,000	20% more accepted as overage

A campaign that suddenly works can outrun a small plan. If you expect spikes, a plan with overage keeps the form accepting leads while you upgrade.

Where the data lives

Formward stores submissions, file attachments and backups in Sweden, on servers run by Hostup AB. Notification email goes out through Mailjet from an EU data centre. Submitter IP addresses are replaced with a keyed HMAC-SHA-256 hash on receipt, so the raw address is never written to disk. On Professional and Business, AI features run on Mistral AI in France and can be switched off per form.

Data leaves the EU only where you send it: a notification inbox hosted outside the EU, a webhook URL, a Slack channel or a Google Sheet. Cloudflare Turnstile is a US service, and it is off unless you switch it on for a form. The details are in the sub-processor register, the data residency page and the published DPA. For the wider picture, see GDPR form backend.

Questions

Is Formward a CRM?: No. It receives, filters, stores and forwards form submissions. Most teams send leads on to their CRM with a webhook, n8n or a spreadsheet sync and work them there.
Does lead scoring send data outside the EU?: No. AI features run on Mistral AI in France. They are on by default on Professional and Business and can be switched off per form. Free and Personal submissions are never sent to the AI provider.
Do hosted forms record UTM parameters too?: Yes. A hosted form page passes the UTM parameters from its own link along with the submission, so you do not need the script there.
Do I need a consent checkbox for marketing follow-up?: If you plan to send marketing to the address, you usually need consent for that purpose. Formward's consent capture records your wording and the time it was given, on every plan.

Start capturing leads

Start free, then move to Professional (EUR 30 a month) when you want scoring and webhooks.

Start free Compare plans