TruFormsNo backend required
Point your form at one HTTPS endpoint and ship. Static sites, SPAs, and server-rendered apps all work exactly the same way.
POST /api/submit
access_key: "…"
200 OKsubmission stored
Free forever · 250 submissions/month
Contact forms for modern websites
Post form submissions to a single HTTPS endpoint and we'll handle spam filtering, email delivery, webhooks, and storage. No backend code. No lock-in.
No credit card required · Works with any frontend framework
contact.html
<form action="https://forms.truenotech.com/api/submit" method="POST">
<input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
<input type="text" name="name" required />
<input type="email" name="email" required />
<textarea name="message" required></textarea>
<button type="submit">Send message</button>
</form>submit.js
const res = await fetch("https://forms.truenotech.com/api/submit", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
access_key: "YOUR_ACCESS_KEY",
name: "Alice",
email: "[email protected]",
message: "Hello from my React app",
}),
});
const result = await res.json();Everything a form backend should be
Built from first principles: fast, secure, and honest about what it costs to run.
Real-time submissions
New submissions stream into your dashboard the instant they land — Server-Sent Events, no polling, no refresh.
Live
Layered spam filtering
Heuristic scoring, honeypot, and rate limits on every plan — plus first-class Turnstile and hCaptcha when you need more.
Webhook delivery log
HMAC-signed webhooks with retries, a dead-letter queue, and an auditable log. Verify signatures in two lines of code.
Integrations out of the box
Slack, Discord, Telegram, and Google Sheets — wired up in seconds. No Zapier middleman, no per-task fees.
File uploads, handled
Multipart uploads stored in S3-compatible storage, with signed 7-day download links right inside your notification emails.
Encrypted at rest
Integration secrets and captcha keys are AES-256-GCM encrypted with per-instance keys. Your data stays yours.
GDPR-friendly
EU-region hosting on request. Submission retention is per-plan and pruned deterministically — nothing lingers.
Open and self-hostable
Run it on your own VPS or use our managed instance — same stack, same code, same endpoints. No lock-in, ever.
DockerPostgresRedisS3 / R2Caddy
How it works
Three steps, no detours.
01
Create a form
Sign up, name your form, and copy the access key. The whole flow is under 60 seconds.
02
Add the snippet
Paste one `<form>` tag or a single `fetch()` call. Works with any framework — no plugins required.
03
Receive submissions
Email notifications go to verified addresses. Set up Slack, Discord, webhooks, or Sheets alongside.
One endpoint, every destination
Your form POSTs once. TruForms filters spam, stores the submission encrypted, and fans it out wherever you need it — no backend code in between.
Simple, transparent pricing
Start free. Upgrade only when you need to.
Free
Free
For side projects and personal sites
- 250 submissions / month
- 3 forms
- 2 linked email addresses
- 5 MB max file upload
- 30-day submission history
Pro
Most popular₹499/ month
For growing businesses
- 10,000 submissions / month
- 50 forms
- 10 linked email addresses
- 25 MB max file upload
- 365-day submission history
Business
₹1,999/ month
For teams at scale
- 1,00,000 submissions / month
- 500 forms
- 50 linked email addresses
- 100 MB max file upload
- 365-day submission history
Frequently asked
If your question isn't here, write to [email protected].
Is the free plan really free?+
Yes. 250 submissions per month, 3 forms, 2 verified recipients. No credit card, no expiry. If you stay within the limits, you pay nothing — ever.
How do you stop spam?+
Four layers: honeypot field, per-IP + per-form rate limits, heuristic content scoring (URL count, keyword blocklist, caps ratio), and optional Cloudflare Turnstile or hCaptcha verification. Spam submissions still save but do not trigger emails or integrations.
Can I run TruForms on my own servers?+
Yes. The repo is fully self-hostable. Bring your own Postgres, Redis, and S3-compatible object storage (Cloudflare R2, MinIO, or AWS S3), and connect a Microsoft Graph mail app for outbound email. Deploy via Docker Compose or any Kubernetes cluster.
What happens when I exceed my plan?+
The /submit endpoint returns HTTP 402 for new submissions once you hit your monthly cap. Nothing retries automatically — upgrade and the next submission goes through. We never silently charge overage.
Do you store form data in the EU?+
Default hosting region is India (Mumbai). EU-region hosting is available on Business plans or self-hosted deployments. All submissions are encrypted at rest and in transit.
How are webhooks signed?+
We send X-TruForms-Signature: sha256=<hex> where the hex is HMAC-SHA256 over "timestamp.body" using your per-integration secret. Verify in two lines of code — see the docs.
Can I cancel any time?+
Yes. Cancel converts your workspace back to the Free plan at the end of the current billing period — your data stays put and remains queryable, just within Free-tier limits.