Forms and spam protection

Put a form on your website that pages your team, with invisible spam checks, claiming, and export of every submission.

Put a contact form on your website. Each message reaches your team's phones as an alert, with spam kept out and no captcha for your visitors to solve.

Set up a form#

An owner creates it with one request (POST /v1/teams/{id}/forms) and chooses:

• A name and address (a short slug, like kitchens).
• Where your site lives. The form accepts posts only from the web addresses you list, up to ten.
• Which channel it alerts. Everything a channel does applies: members' phones, escalation if nobody opens it, receipts, webhooks and email.
• How urgent each kind is. Choose a priority for inquiry, bug, feature and question. Make bugs Urgent and they repeat until someone takes them.
• How long to keep messages, from 30 to 730 days.
• Where to send the visitor afterwards, a thank-you page on your own site.

You get a copy-and-paste HTML form that needs no JavaScript:

A visitor who posts with a plain browser form is sent to your thank-you page with a reference added. A script that posts JSON gets JSON back with the reference, never a redirect. The reference is how a sender asks for their message to be removed.

What a message can hold#

Files are judged by their contents, not by what they claim to be.

Spam protection that visitors never see#

There is no captcha on any form. Every check is invisible, and a message that trips one is still answered like any other so a bot learns nothing. It is filed as spam and pages nobody.

• A hidden field. People cannot see it, so a filled one means a bot.
• Only your own pages. A browser post from any other website is refused.
• Blocked senders. Names and addresses that have sent spam before.
• The look of a pitch. A shouted message with a link, or a message stuffed with links.
• A sender who will not stop. The same name and address past their daily allowance.
• A campaign. The same words from different names and addresses, however the spacing, case or punctuation changes.
• Rate limits. Five messages an hour from one sender, and 20 a day from one app install, per form. A form accepts 500 messages a day in all.

No raw address or install id is kept. Only a keyed code is held, and it is deleted within 25 hours.

Take it, so two people do not reply#

Anyone on the channel can claim a message. One person gets it; if two try at once, the second is told who has it. Claiming settles the alert for everyone: repeats stop and nothing escalates, whatever the channel's acknowledge rule. Webhooks and receipts name the person who claimed it by their team name.

Work through your inbox#

Each form has an inbox page in the web console (/org/team/{id}/forms/{slug}) with every field, the diagnostics and the attachments. Filter by kind or status (new, read, replied, archived, spam), search the message, name, email and your notes, and add a private note that is never sent back to the sender. Export everything as CSV or JSON; cells that a spreadsheet would run as a formula are neutralised for you.

Who sees a form follows the channel: admins see every form, everyone else only forms that alert a channel they are on.

Keeping and erasing#

Messages are kept for the number of days you chose (30 to 730) and then deleted. Deleting a message, a form, a team or the owner's account also removes members' copies of the alert, its queued webhook and email deliveries, and its attachments. What has already reached a mailbox or a webhook receiver cannot be recalled.

Limits per team: ten forms, 50 MB of attachments.

Taking a form offline#

If a form is misused, suspending it turns it off for the public at once with nothing deleted, and your team can still read what it holds.