Data flows

​

Capture and validation

1. Re-validates all field values against the rules you configured — server-side validation cannot be bypassed by a modified client.
2. Runs spam and abuse detection — see AI features → Spam and abuse detection.
3. Assigns a unique submission ID (sub_xxxxxxxxxxxxxxxx) and records the exact submission timestamp in UTC.
4. Stores the submission in persistent, encrypted storage.
5. Queues workflow execution — all active workflows attached to the form are scheduled for immediate asynchronous processing.

​

Storage

• The submission ID and form ID
• The submission timestamp (UTC, ISO 8601)
• The respondent’s IP address (hashed and stored separately from the response body; see privacy section below)
• The value of every submitted field, keyed by field ID
• Metadata: user agent string, referrer URL, and any UTM parameters captured from the form URL
• File attachment references (uploaded files are stored in object storage; the submission record holds a reference URL, not the binary data)

​

Submissions inbox

• Flag or unflag submissions for follow-up
• Add internal notes visible only to your team
• Manually mark a submission as spam or restore a quarantined submission
• Delete individual submissions (permanent; cannot be undone)

​

Data retention

​

Routing to integrations and webhooks

• Email — formatted notification or confirmation emails sent via FormFlows.ai’s mail infrastructure
• Google Sheets — rows appended or updated in real time
• Slack — messages posted to channels or users
• Zapier — your Zap’s webhook trigger fires, unlocking thousands of downstream actions
• Webhooks — an HTTP POST to any URL you specify, with the full submission payload in the request body

​

Webhook payload

{
  "event": "submission.created",
  "submission_id": "sub_01hx4k9bfzc3q8y7v2mn6p",
  "form_id": "frm_01hw3j8azb1r5t6u9ndc4e",
  "form_name": "Customer Feedback",
  "submitted_at": "2026-04-05T14:23:07Z",
  "data": {
    "name": "Alex Rivera",
    "email": "[email protected]",
    "rating": 4,
    "comments": "Really smooth experience overall."
  },
  "metadata": {
    "ip_hash": "a3f1b2c9...",
    "user_agent": "Mozilla/5.0 ...",
    "referrer": "https://example.com/contact"
  }
}

​

Exporting data

curl "https://api.formflows.ai/v1/forms/frm_01hw3j8azb1r5t6u9ndc4e/submissions?limit=50&created_after=2026-01-01T00:00:00Z" \
  -H "Authorization: Bearer YOUR_API_KEY"

​

Data privacy and security

​

Encryption

• In transit — all data between respondents, your dashboard, and FormFlows.ai servers is encrypted using TLS 1.2 or higher.
• At rest — submission data and file attachments are encrypted at rest using AES-256.
• IP addresses — IP addresses are one-way hashed before storage. The original IP address is not retained and cannot be recovered by FormFlows.ai or accessed by you.

​

GDPR

• Consent field — add a GDPR-compliant consent checkbox to any form, with a configurable consent statement and link to your privacy policy.
• Individual deletion — delete any single submission from the inbox to fulfill a right-to-erasure request. Deletion is permanent and propagates to all associated backups within 30 days.
• Data export — export all submissions associated with a specific email address to fulfill subject access requests.
• Data residency — Business plan customers can request that their data be stored in EU-region infrastructure. Contact support to enable this.

​

SOC 2 and certifications

​

Access controls

• Submission data is accessible only to authenticated workspace members with the appropriate role.
• API keys are scoped to a workspace and can be restricted to read-only access.
• Webhook secrets are unique per form.

​

Next steps