Honeypot field
Every form carries a hidden botcheck field. If a submission fills it in — which only automated bots do — the row is silently flagged as spam, and we never email or webhook it to you.
Security & trust
Form backend security you can defend in a review.
A factual, non-marketing look at the controls we run, the providers we trust, and — just as importantly — the things we don't yet do.
- AES-256 at rest
- TLS in transit
- 0 passwords stored
Encrypted in transit and at rest
TLS on every request and AES-256 on every stored submission and file — the encryption a buyer checks for before pasting an access key into production.
Row-Level Security isolation
Postgres RLS on every table scopes reads to auth.uid() = user_id, so one account's form submissions are never visible to another.
Magic-link auth, no passwords
Sign-in is a one-time magic link via Supabase Auth. There is no password field and no password database to leak in a breach.
Spam & abuse
Contact form spam protection, layered.
Form submissions are an internet-facing endpoint, so spam, scrapers, and runaway scripts try to abuse them constantly. splitforms ships several layered controls — most on by default, a couple you can opt into per form.
Content spam scoring
Every submission that clears the honeypot is scored against known spam signals: excessive links, spam keywords, disposable email domains, gibberish or repeated text, and suspicious TLDs. Anything over the threshold is quarantined in a recoverable spam folder instead of your inbox.
Origin allow-list
Lock a form to the domains you actually publish it on. With strict origin protection enabled, posts from unapproved origins are dropped — and optional Google reCAPTCHA can be required per form for an extra challenge.
Rate limits
A rolling cap of 6 submissions per minute per IP per form, plus a sustained cap of 20 per 15 minutes. Bursts above either limit are rejected with HTTP 429 — protecting our SMTP reputation and your monthly quota from runaway loops or scripted attacks.
Monthly quota
Free, Pro, and 3-Year plans each have a monthly submission ceiling enforced at the database layer. Submissions over the cap are rejected cleanly, so spam can't silently burn through your tier.
Infrastructure
What powers splitforms form backend security?
splitforms runs on a battle-tested stack — no in-house datacentres. Each provider holds its own SOC 2 / ISO 27001 attestations, which inherit downstream. See the full GDPR breakdown for how data is processed.
- Vercel — Next.js compute and edge TLS termination. SOC 2 Type II.
- Supabase — managed Postgres, magic-link Auth, Storage. SOC 2 Type II, AES-256 at rest.
- AWS SES — outbound notification and magic-link email. SOC 2 + ISO 27001.
- Stripe — billing under PCI DSS Level 1; we never see your card number.
- No third-party analytics, ad pixels, or session-replay on submission endpoints.
Data isolation
How does splitforms isolate my form data?
Every customer-facing table has Postgres Row-Level Security scoping reads, updates, and deletes to auth.uid() = user_id — so even a bug in app code can't leak across tenants. The one exception, /api/submit, runs as the service role but only ever writes to the target form's own user.
- RLS enabled on profiles, forms, submissions, webhooks, and user_integrations
- Policies scope every read, update, and delete to auth.uid() = user_id
- No shared all-tenants view and no admin bypass for normal app traffic
Transparency
Is splitforms SOC 2 certified? Not yet.
Honesty is a security feature. Here's what splitforms does not have yet, so you can decide up-front whether we're a fit — we'd rather name the gaps than imply controls we can't back up under audit.
- No SOC 2 report yet — our providers hold theirs; ours is on the roadmap.
- No third-party penetration-test report yet.
- No HIPAA BAA — do not use splitforms for Protected Health Information.
- No formal SLA on Free — the service is provided as-is.
- No bug-bounty programme yet — responsible disclosure is credited.
How SplitForms works
From form to workflow in 3 simple steps.
Connect your form, collect every submission, and send data where it needs to go — without building backend infrastructure.
Add your endpoint
Point your form to your unique SplitForms endpoint. That's it.
Receive submissions
We instantly capture and organize every submission in your inbox.
Route anywhere
Send data to email, spreadsheets, CRMs, webhooks, and 7,000+ apps.
No credit card required. Set up in under 60 seconds.
Connect & automate
Connect your favorite tools and automate everything
SplitForms works with the destinations you route to and the platforms you build on — from Slack and Sheets to WordPress, Shopify, and Next.js.
Trusted by indie teams and agencies shipping forms worldwide
PETAL/COKRAFT.DELINEAR-XBUILD.DEVSTUDIO 71MERIDIANFRAME&CO
Testimonials
Loved by developers shipping at every scale.
40 quotes on record — from indie hacks to agency migrations.
“I replaced a Lambda + DynamoDB + SES contact form with six lines of HTML. It took eleven minutes, and the dashboard is better than what I was going to build.”
“We migrated 14 client sites off Formspree in a single weekend. The price is a third of what we paid, the API is more honest, and the spam filter actually works.”
“The webhook payload is signed, idempotent, and well-shaped. It reads like code from a competent team, not a CRUD app held together with duct tape.”
“I stopped reaching for Typeform on small marketing sites. splitforms covers 90% of the use case at none of the bloat.”
“I onboarded our whole agency in an afternoon. The MCP integration meant Cursor literally dropped the form straight into our client repos for us.”
“The free plan gave me 500 submissions before I paid a cent, and Pro is five dollars a month. I've spent more on coffee deciding which backend to use.”
“Spam went from forty junk entries a day to zero, with no reCAPTCHA puzzle ruining the form. The honeypot and time-trap just quietly do their job.”
“Point the form action at one endpoint and you're done. No SDK, no client library, no build step. This is how a form backend should feel.”
“Leads land in Slack the second someone submits, and a copy goes to Google Sheets for the sales team. I wired both up in under ten minutes.”
“I run a static Hugo site on a five-dollar VPS. splitforms gave it a real contact form without me standing up a single server.”
Security FAQ
Form backend security questions.
View all FAQsAre my form submissions encrypted?
Yes — in transit and at rest. All traffic to splitforms.com uses HTTPS with TLS. Stored submissions live on Supabase managed Postgres, which encrypts data at rest using AES-256. File uploads in Supabase Storage are likewise encrypted at rest.
Do you store passwords?
No. splitforms uses magic-link authentication via Supabase Auth. To sign in, you enter your email and click the link we email you. There is no password field, no password hash on disk, and no password to leak in a breach.
Is splitforms GDPR compliant?
splitforms helps you meet GDPR for the form submissions you collect. You are the data controller for the submissions on your forms; splitforms is the data processor. We support data subject rights via the dashboard (export, delete) and offer a Data Processing Agreement on request. See /gdpr for the full breakdown.
Are you CCPA compliant?
Yes for the data we hold about you as a splitforms account holder. You can access, export, or delete your data from the dashboard at any time. We do not sell personal information to third parties. For broader CCPA programme questions, email hello@splitforms.com.
Are you HIPAA compliant?
No. splitforms is not HIPAA compliant and we do not sign Business Associate Agreements (BAAs). Do not use splitforms to collect Protected Health Information (PHI). If you need HIPAA, use a backend that's specifically built and audited for it.
Are you SOC 2 certified?
Not yet. splitforms has not undergone a SOC 2 Type I or Type II audit. Our underlying infrastructure providers (Supabase, AWS, Vercel, Cloudflare) hold their own SOC 2 reports, which inherit downstream — but splitforms itself is not certified. A formal SOC 2 is on the roadmap once revenue justifies the audit cost.
Can I delete my data?
Yes. Individual submissions can be deleted from the dashboard at any time. Deleting your account cascades through Postgres foreign keys and removes all associated forms, submissions, webhooks, and profile data. If you want a full erasure confirmation in writing, email hello@splitforms.com.
Where is my data hosted?
Today, all production data lives in US regions: Supabase Postgres + Storage (AWS US), Vercel compute (US edge + Lambda regions), AWS SES (US), and Cloudflare for DNS. An EU-resident option is on the roadmap.
Can I get a Data Processing Agreement (DPA)?
Yes — email hello@splitforms.com with subject "DPA" and we'll send our standard DPA. It's a short, plain-English document covering processor obligations, sub-processors, breach notification, and data subject rights.
Is there an audit log of who accessed my submissions?
Internal admin write actions are recorded in an admin_audit_log table (used by the founder ops console). A user-facing access log surfaced inside the dashboard is on the roadmap and not yet shipped.
Do you support 2FA or passkeys?
Not via SMS today — TOTP and passkeys are on the roadmap. Sign-in uses a one-time magic link via Supabase Auth, with optional Google OAuth (email + name only). Sessions use short-lived JWT access tokens stored in HttpOnly, SameSite=Lax cookies, and refresh tokens can be revoked server-side at any time.
How long do you keep my form submissions?
For as long as your account is active — there's no automatic expiry, because many customers want a permanent CRM of every lead. You can delete individual submissions, export any form to CSV, or delete your account, which cascades through Postgres foreign keys and removes every form, submission, webhook, uploaded file, and profile row; backups rotate within 30 days. Need auto-delete after N days? Email hello@splitforms.com.
How do I report a security vulnerability?
Email security@splitforms.com (also reachable at hello@splitforms.com) with reproduction steps and any proof-of-concept. We aim to acknowledge within one business day and keep you updated through remediation. Please don't run automated scans against production — create a free account and test against your own forms. We won't pursue good-faith researchers reporting under responsible-disclosure norms.
Simple pricing
Start free. Scale when you need more.
Choose a plan that fits your workflow — from a free form endpoint to full automations, exports, and higher submission limits.
Free
$0
Free forever
For side projects and indie devs.
- 500 submissions / mo
- Unlimited forms
- Email notifications included
- Honeypot spam filtering
- Submissions dashboard
- MCP setup stays free
- No credit card required
Most Popular
Pro
$5/ month
was $15 · save 67% · new-user price
For agencies and growing products.
- 5,000 submissions / mo
- Unlimited forms
- Every paid feature included
- Priority support (under 4hr)
- 10× free submission volume
- Cancel anytime
Pre-launch · founders pricing locked in
3-Year
$59/ 36 months
was $99 · save 40% · new-user price
Pay $59. 3 years sorted.
- 15,000 submissions / mo
- Unlimited forms
- Everything in Pro
- Renews every 3 years
- Long-term discount
- Priority support included
- Vote on the roadmap
No credit card required on Free • Cancel anytime