Storage first
The endpoint accepts or rejects a submission upon receiving the request, and includes a reason for either one in the response. When accepted, the endpoint stores it immediately and keeps it for as long as the form’s retention period (30 days to forever). Every delivery is a separate job that follows. A failing webhook or mail server cannot lose a submission and the visitor never waits for either.Deliveries
Emails, webhooks, and integrations are tried until delivered. The dashboard shows each attempt and its outcome under the submission record. A failure that cannot pass, a removed endpoint, or an address that does not exist is marked as failed and reported to you.Failover
If a part of formcarry behind the endpoint is unavailable, submissions are still accepted and stored, and their deliveries resume once it recovers.When something on your side breaks
Formcarry alerts you when a recipient keeps bouncing, a webhook endpoint is down, or your own email server fails. The alert message will include evidence of failure and what to change. If your mail server refuses the connection, the email goes out from formcarry’s sender instead.noreply@formcarry.email, an authenticated sender.
Bounces and complaints are tracked, and an address that keeps bouncing is dropped from the recipients until you add it again.
Uptime
The status page shows the endpoint, submission processing, and the website. Processing is measured with real submissions.Security
- Every address is HTTPS only (the endpoint, the dashboard, the API and the MCP server).
- The database is encrypted at rest and backed up on a schedule, as a managed service.
- Passwords are stored hashed. You can also sign in with Google.
- Access is per team with four available roles: owner, admin, edit and read. A member sees only the teams they were invited to and nothing of any other account.
- API keys are stored hashed and shown once, at creation. Each key is limited to read or write, restricted to the forms you choose, rotated with a grace period, and revoked immediately upon request. The dashboard shows when and how much each key was used.
- Apps connect over MCP with OAuth 2.0 and PKCE. You approve each app for the teams you pick, its tokens expire, and you revoke it at any time under Connected apps.
- The endpoint and the API are rate limited and an address can be blocked per form.
- Every delivery of every submission is logged with its outcome, so an audit can follow a submission from arrival to your inbox.
- Availability is public on the status page, and incidents are tracked and reported.
Privacy and GDPR
You are the data controller for your forms. Formcarry is the data processor, and processes submissions in compliance with GDPR and CCPA under a data processing agreement with standard contractual clauses. The agreement lists the subprocessors.- All submissions, files and account data are stored in data centers in the EU.
- A submission holds what the visitor sent, any files, and the request’s IP address, country, city, browser and referring page. Nothing else is collected about the visitor.
- You set how long each form keeps its submissions, from 30 days to forever. Deleting a submission is permanent. Deleting a form, a team or your account is permanent.
- You can export a form’s submissions as CSV or JSON at any time, which covers access and portability requests, and delete any single submission, which covers erasure requests.
- Submission content goes only to the recipients you set and the integrations you connect. Emails leave from formcarry’s authenticated sender, or from your own email server on your own domain.
- The privacy policy and the terms of service apply to every account.