Changelog

Notification recipients now live at the project level instead of being re-added and re-verified on every form. Add and verify an address once, mark it as a default to cover every form automatically, or assign it to only the forms that need it.

Every file uploaded to a form is now scanned for malware with AWS GuardDuty before it becomes downloadable. Clean files are unaffected; anything flagged is quarantined and removed automatically.

Resend any already-processed submission to email or Google Sheets on demand, straight from the submissions table, with a delivery-history popover showing every past attempt.

Forms can now accept file attachments. Files upload directly to storage, show up in the submissions drawer with previews and downloads, and are managed from a dedicated Storage page with bulk ZIP export.

Settings → General now actually saves your workspace name and URL slug. The sidebar switcher updates immediately after saving.

Flag a submission as spam directly from its notification email, no dashboard login required. A signed confirmation link replaces the old broken 'View Submission' button.

Connect any form to 5,000+ apps through Zapier. Paste a Catch Hook URL into a form's Integrations panel and every submission triggers your Zap.

Send a single form's submissions to its own webhook URL, separate from your workspace-wide webhook endpoints. Same HMAC signing and retry engine, scoped to one form.

Form submissions now append as rows in Google Sheets automatically. Connect your Google account once at the workspace level, pick a spreadsheet and sheet tab per form, and every new submission lands as a structured row with no code and no middleware.

Strengthened cooldown enforcement on notification recipient verification resends and added rate limiting to additional email-sending flows.

Formtorch now exposes a stable REST API under /v1/ for reading submissions and forms programmatically. Workspace API keys let you authenticate from any HTTP client, and plan-based rate limiting keeps usage fair across all tiers.

Formtorch can now push submission data to any external service in real time. Configure webhook destinations at the workspace level, subscribe to specific events, verify payloads with HMAC signatures, and monitor delivery health from the dashboard.

Formtorch now supports paid plans via Stripe. Upgrade to Starter or Pro, manage your subscription from the billing portal, and switch between monthly and yearly billing — all without leaving the dashboard.

TorchWarden gets a new bot user-agent signal and accuracy tuning, Cloudflare Turnstile CAPTCHA is now available per form, and you can manually override any spam classification directly from the dashboard.

The Formtorch documentation site is live, with full coverage of every shipped feature, guides, API reference, migration walkthroughs, and working code examples.

Three trust-focused updates: every notification email now carries a working unsubscribe link, workspace owners can pause all notifications in one toggle, and closing your account automatically deletes all your data.

A cluster of infrastructure updates: durable ingest with explicit failure codes, idempotency protection for duplicate submissions, async delivery with exponential backoff and manual retry, a full submission lifecycle event log, and delivery status badges in the dashboard.

You can now add verified email recipients to each form. Any address added receives a confirmation link before it starts getting submission notifications, keeping your notification pipeline under your control and free of unintended recipients.

Introducing TorchWarden, Formtorch's built-in spam detection engine. Submissions are automatically scored across five signals (keyword patterns, honeypot traps, duplicate detection, rate limits, and bot behavior) so your inbox stays clean without any configuration.

You can now export any form's submissions as a CSV file. Choose from the last 24 hours, 7 days, 30 days, or all time. The export streams directly to your browser and handles millions of rows without breaking.

Get notified by email every time a form receives a new submission. Configure a notification address per workspace, toggle delivery per form, and skip noise from spam and test submissions automatically.

Form submissions now go to formtorch.com/f/{id} instead of app.formtorch.com/f/{id}. A cleaner URL for your HTML attributes, documentation, and code snippets. No changes needed if you integrated before this.

All public form endpoints are now protected by a four-layer rate limiting stack (global, per-form, per-IP, and per-IP-per-form), backed by Upstash Redis with an automatic in-memory fallback.

New accounts now walk through a guided setup that creates your first project, generates a live form endpoint, and lets you send a real test submission before writing a single line of code.

Each submission now has its own detail page showing all fields, metadata, and spam signals in a clean layout. The submissions list supports pagination and displays key metadata at a glance.

The Formtorch dashboard is live. Organize your forms inside projects, manage settings per form, and track submissions across your entire workspace from a single interface.