Basin review (2026): a capable form backend with a small free plan

How Basin works

Basin is an endpoint-based form backend. You create a form in the Basin dashboard, copy its unique URL, which looks like https://usebasin.com/f/ followed by an ID, and paste it into your HTML form's action attribute with method="POST". Every input needs a name attribute. Basin then stores each submission, runs it through spam filters, emails you and forwards it to any integrations you have connected.

Because the form only needs a URL, it works on any host: Basin's docs mention Webflow, WordPress, Squarespace, Vercel and custom HTML. JavaScript submissions are supported by default with JSON, form-data or x-www-form-urlencoded bodies; send an Accept: application/json header to get a JSON response. Basin also offers Basin JS for AJAX and CAPTCHA helpers, a drag-and-drop Form Studio, and an AI form generator.

Basin has since added AI-generated websites (Basin Sites) and an AI chat widget on paid plans. Those are separate from the form backend, and the Basin Sites count on each plan does not limit how many external websites can use your form endpoints.

Basin pricing and free plan limits

Basin's Free plan gives you one form endpoint, 50 submissions a month, 30-day data retention, basic spam protection, AJAX support and Zapier. Paid plans are Starter ($15/month, or $12.50/month billed yearly, 250 submissions and 3 forms), Growth ($29 or $24.17, 1,000 submissions and unlimited forms), Pro ($49 or $40.83, 5,000) and Agency ($130 or $108.33, 25,000). A new-customer coupon advertised on the pricing page takes 50% off Pro and Agency for six months.

Spam does not count toward any limit. On paid plans, Basin keeps accepting submissions past the monthly cap and bills extras monthly, from $5.25 per 1,000 for the first 5,000 extra down to $2.00 per 1,000 above 100,000. The docs FAQ says the Free plan works differently: you get email warnings as you approach the limit, and once it is reached submissions may be restricted until the next month. Limits reset at the start of each billing cycle.

Extra file storage costs $5 per 5 GB a month. Every paid plan includes a 14-day free trial.

• Free: 50/month, 1 form, 30-day retention, 100 MB storage
• Starter: 250/month, 3 forms, 365-day retention, 500 MB
• Growth: 1,000/month, unlimited forms, 2 GB, first plan with webhooks and API
• Pro: 5,000/month, 10 GB; Agency: 25,000/month, 50 GB

Spam protection

Basin layers several defences. Its docs say SpamCheck.ai content analysis is always enabled, with Cloudflare's WAF in front, and every plan can add Google reCAPTCHA v2 or v3, hCaptcha or Cloudflare Turnstile (Basin recommends only one CAPTCHA at a time) and restrict a form to specific domains.

The comparison table puts more filters on higher plans: custom honeypot field names and duplicate detection from Growth; country and radius filters, burner-email blocking, custom content and language filters, and a user-agent blocklist from Pro.

Flagged submissions go to a Spam tab where you can mark them as not spam. By default webhooks and notification emails skip spam, though a webhook can be set to fire for every submission. The spam basics docs say spam is kept for 30 days before permanent deletion, so check the folder regularly.

File uploads

Add enctype="multipart/form-data" to the form tag and Basin accepts files up to 100 MB each on every plan, either one per input or several through an attachments[] input with the multiple attribute. Uploads count against your plan's storage: 100 MB on Free, 500 MB on Starter, 2 GB on Growth, 10 GB on Pro and 50 GB on Agency.

An Attachments view lists every file across your forms and lets you bulk-delete them to free space. On Pro and above, attachments are scanned for malware with ClamAV.

Notifications, webhooks and integrations

Notification emails are on every plan. Each recipient address, including CC and BCC, has to confirm a verification email before it receives anything. Branded emails and language settings need Growth, and custom HTML templates, custom sending domains and your own SMTP server need Pro. Autoresponders to the person who submitted start on Growth.

Zapier works on every plan, including Free. Growth adds signed webhooks, API access, Slack, Discord, Google Sheets, Mailchimp and Asana. Basin's webhook docs say a failed delivery is retried up to 15 times over 24 to 28 hours with exponential backoff, and each request carries an X-Basin-Signature header with an HMAC-SHA256 signature.

Data retention, export and privacy

Retention is capped by plan: 30 days on Free, 365 days on Starter, and unlimited on Growth and above, per the pricing page. You can also set a shorter per-form retention period, delete submissions individually or in bulk, or delete them through the API. Basin's GDPR page adds that submissions are deleted automatically after 48 months and that encrypted backups are kept for up to five weeks. There is no email-only mode; every submission is stored.

Export to CSV or XLSX is available from Starter up, for one form or across all forms. Exports include every field plus submission date, IP address and location.

Basin is operated by Moonshot Ventures Inc. in British Columbia, Canada. Its GDPR page lists sub-processors including DigitalOcean (hosting and database, Canada), Amazon Web Services (file storage, USA), Postmark (email, USA), Hetzner (backups, Germany) and CleanTalk (spam processing, EU). Basin's docs say a DPA is published at usebasin.com/dpa, but that address returned a not-found page when we checked on October 10, 2026, so ask support for a copy if you need one.

Support

Basin's plan comparison lists email support on every plan, phone support from Growth, and priority support on Pro and Agency. Basin also runs a Discord server, a public status page at status.usebasin.com, and [email protected]. The Terms say Basin does not guarantee any specific uptime unless a separate written agreement says so.