FormalyticsPricing
Form backend with AI validation

Real enquiries.Nothing else.

Every submission passes four layers of spam defence and an AI validation check before it reaches you. What lands in your inbox is a genuine enquiry from a real person, formatted, stored, and ready to answer.

See pricingHow the filter works

Hosted for you · Live in under an hour · 4 lines of JavaScript

POST /api/form-submit200 OK · 218 ms
form-handler.js
// the entire integrationawait fetch('https://api.formalytics.io/api/form-submit', {  method: 'POST',  headers: {    'Content-Type': 'application/json',    'X-API-Key': 'fts_9c41…'  },  body: JSON.stringify(Object.fromEntries(new FormData(form)))});
AI validationGenuine enquiry· asks about a service you offer
New Patient Enquiry form submissionto hello@northbridge-clinic.com · notification sent
Delivered
name
Dagny Osei
email
d.osei@harlow.co
enquiry_type
New patient (physiotherapy)
preferred_slot
Weekday mornings
message
Referred by my GP. Is there a wait list for the Thursday clinic?
try it →
The situationWhat an unfiltered form costs

The form works. That's the problem.

It accepts everything. Bots, SEO pitches, gibberish, someone testing whether your site is worth attacking. And somewhere in there, the customer you actually wanted.

Junk volume92%

Of submissions to a typical unprotected contact form are automated or unsolicited. You read all of them to find the other 8%.

Time lost4 hrs

A month, triaging a form inbox by hand. Not answering enquiries, just deciding which ones are real.

The real cost1 missed

Enquiry is worth more than a year of the subscription. Once you stop trusting the inbox, you start skimming, and skimming is how you lose them.

Illustrative figures based on typical small-business contact form patterns, not measured customer data.

SetupSign up → key → paste → live

Live on your site in under an hour.

  1. STEP 01

    Sign up your site

    Your business name, the inbox that should receive enquiries, and the domains your form runs on.

  2. STEP 02

    Copy your key

    An fts_ key scoped to your site alone: your inbox, your domains, your quota, your data.

  3. STEP 03

    Paste four lines

    A fetch to one URL with one header. React, Astro, WordPress, Webflow, or plain HTML.

  4. STEP 04

    Real enquiries land

    Filtered, formatted, stored, and visible in your dashboard. Add a field to the form and it just appears.

CapabilitiesWhat's included

Everything a form needs. Nothing it doesn't.

AI validation

A filter that reads

Every submission is read for meaning, not just pattern-matched. Sales pitches, gibberish, scams and off-topic messages are held back. Genuine enquiries pass straight through, with the reasoning recorded either way.

Spam defence

Four layers before the AI

Origin lock, honeypot, per-IP burst guard, and a rate limit stop automated traffic outright. On by default. It is the standard posture, not an upgrade.

CAPTCHA

Turnstile & hCaptcha

Drop in a challenge widget and Formalytics verifies the token server-side before anything else runs. Optional, and most sites never need it once the other layers are on.

Dashboard

Your own view of everything

Submissions, search, volume over time, and a running count of what the filter caught and why. Export any date range as CSV whenever you need it.

Schemaless

Send whatever the form has

No field configuration, because there is no schema. emailSubject is the only required field. budget, preferred_slot, anything else is accepted, stored, and emailed as-is.

Notifications

Email you can actually read

Multipart HTML and plain text, rendered as labelled rows. Custom templates let you match your brand, and field control means a fifteen-field form can send a four-field notification.

Multiple forms

One site, many forms

Contact, careers, quote request, support: each with its own subject line, own template, and own recipient, all under one key.

Integrations

Webhooks, Slack, Discord

Push every clean enquiry into your CRM, Zapier, n8n, or a team channel. Fire-and-forget, so a slow endpoint never delays the visitor.

Self-serve

Sign up and go

Create your account, add a site, get a key. No sales call, no onboarding queue. Rotate a key yourself in two clicks if it is ever exposed.

The filterFive layers · zero configuration

Four layers stop the machines. The fifth reads what got through.

A CAPTCHA proves someone is human. It has nothing to say about a human who is deliberately wasting your time, and that is most of what reaches a modern contact form.

LayerWhat it doesResponseWhat the sender learns
Origin lockOrigin checked against your allowlist403A stolen key is useless from any other domain
HoneypotHidden field, invisible to people, irresistible to scrapers200Nothing, it believes it succeeded
IP burst guardThrottles repeated requests from a single address429Volume attacks die in the first minute
Rate limitAdaptive ceiling on submission volume429A targeted flood can't drain your quota
AI validationReads the submission for meaning and intent200Nothing, filtered and delivered look identical
Design principle

Nothing that gets stopped is ever told it was stopped.

The honeypot returns a success response that is deliberately indistinguishable from the real one. So does the AI filter. A bot logs a win and never comes back to probe for the stop it never hit; a person pitching SEO services believes their message was sent. Neither one learns anything they could adapt against, and neither one reaches you.

The layers run cheapest first, so the overwhelming majority of junk is rejected before it costs anything to process, and the ones that stop a request give away nothing about where it stopped.

What it holds back
  • Unsolicited sales and SEO pitches
  • Gibberish and keyboard-mash tests
  • Link-farm and gambling spam
  • Obvious scams and phishing attempts
  • Messages with no discernible enquiry
What always gets through
  • Anything asking about what you do
  • Short messages, because brevity is not spam
  • Complaints and difficult feedback
  • Enquiries in any language you accept
  • Anything the filter is unsure about
You stay in control
  • Every filtered message is kept, not deleted
  • Each one shows the reason it was held
  • Release one to your inbox in a click
  • Tune the threshold for your business
  • Turn it off entirely if you would rather

The filter errs toward delivery. When a submission is ambiguous it goes to your inbox flagged, not to the filtered list. A missed enquiry costs more than a junk one.

DashboardWhat you didn't have to read

See what came in, and what never had to.

Every enquiry in one searchable list, volume over time, and a running count of what the filter held back with the reason for each. Export any date range as CSV.

Northbridge Clinic · SeptemberExample data
Submissions
231
this month
Reached your inbox
19
genuine enquiries
Filtered
212
kept, reviewable
Released by you
0
nothing wrongly held
ReceivedFromMessageVerdict
14:22Dagny OseiReferred by my GP. Is there a wait list for the Thursday clinic?Delivered
13:47growth@rankboost-pro.netWe can guarantee first-page Google results in 30 days…Sales pitch
11:09Tomas WredeDo you do home visits for post-op rehab? My father can't travel.Delivered
10:55asdfkjasdkfj alskdjf test testNo enquiry
09:31Priya RaghunathanWhat's the cost for six sessions? Do you invoice insurers directly?Delivered
ReferencePOST /api/form-submit

One endpoint. Here is the contract.

Request

FieldRequiredValidation
X-API-KeyHeaderIssued per site, rotatable by you at any time
emailSubjectYesNon-empty string. Becomes the notification's subject line.
emailNoEmail format, validated only if present
(hidden field)NoA field only automated clients fill. Its name is issued with your key.
…anything elseNoString, number, boolean, null, or object, accepted as-is
Response codes
  • 200Accepted, or silently filtered
  • 400Validation or CAPTCHA failed
  • 401Missing or unknown API key
  • 403Origin not on your allowlist
  • 429Rate or burst limit exceeded

Delivered and filtered are both 200. Nothing can tell them apart.

Platform
  • Serverless, no cold infrastructure to share
  • CORS preflight cached for 24 hours
  • Payloads schema-checked before anything is stored
  • Multipart HTML and plain-text email
  • Field count and length caps on notifications
  • Works with any host, framework or CMS
Security
  • Every request authenticated by site key
  • Per-site origin allowlisting
  • Two-click key rotation
  • Signed, httpOnly dashboard sessions
  • Every submission stored with its verdict
  • Submissions isolated per site
  • Delete any submission, or all of them

Exact thresholds, the hidden field's name, and the services behind each stage are issued with your key and kept out of public documentation. Publishing them would only help someone build around them.

TranscriptScripted · composite persona

“Two hundred and thirty-one submissions. Nineteen reached my inbox.”

This is a scripted narrative built from the problems Formalytics was written to solve. It is a composite persona, not a real customer, and it is not a testimonial.

  1. Act 01The setup40 real · ~600 junk
    00:00

    I manage a physiotherapy clinic. Three practitioners, and about forty new-patient enquiries a month through the website. That form is where our new business comes from.

    00:13

    It is also where roughly six hundred pieces of garbage a month came from.

  2. Act 02The escalationcaptcha added · junk continues
    00:19

    Bots at first. We added a captcha, and that helped for a while. Then it turned into people. Actual humans, typing “I can improve your Google ranking” into a patient enquiry form.

    A captcha does nothing about a real person wasting your time on purpose.
    00:33
  3. Act 03The cost1 enquiry missed
    00:40

    And what that does to you is subtle. You stop opening the notifications when they arrive. You batch them up for the end of the day. You skim.

    One Thursday I skimmed past a woman asking about post-surgical rehab. I found it eleven days later. She had already gone somewhere else.
    00:52
    01:04

    That was the point I stopped treating it as an annoyance.

  4. Act 04The change231 in · 19 delivered
    01:08

    The developer who built our site set Formalytics up for us. Took him about twenty minutes. But the thing that actually sold me was the first week’s number.

    Two hundred and thirty-one submissions. Nineteen reached my inbox. All nineteen were real.
    01:20
    01:29

    It is not just blocking bots. There is an AI reading the content of every message, and it can tell the difference between somebody asking about our Thursday clinic and somebody pitching SEO in a message field. I could not have written a rule for that. Nobody could.

    01:47

    And I can see everything it caught. It is all in the dashboard, every one it held and the reason. For the first fortnight I checked every single one, waiting for it to eat a real patient enquiry. It never did.

  5. Act 05The new normalinbox trusted
    Now my inbox is small, and I trust it again. When something arrives, I open it.
    02:04
AlternativesIncluding where we lose

Everyone forwards your form. We decide what's worth forwarding.

FormalyticsFormspreeNetlify FormsBasin
Reads submissions for intentYes, AI validationNoNoNo
Bot & spam filtering5 layersHoneypot, reCAPTCHAHoneypot, AkismetRule-based filtering
Shows why a message was heldPer messageSpam folder onlySpam folder onlySpam folder only
Field control in notificationsYesNoNoNo
Custom email templatesYesPaid plansNoPaid plans
Works on any hostYesYesNetlify onlyYes
Pricing modelPer sitePer sitePer sitePer site
Free planNoYes, limitedYes, limitedYes, limited
Time to first submission~5 min~5 min~10 min~5 min

Two honest rows there. We do not have a free plan, and every one of these is priced per site, so the question is not which is cheapest. It is whether a form that only forwards is worth the same as one that decides.

PricingPer site · AI validation from Pro

Stop the machines at $9. Read the message at $19.

Starter$9/ site / month

Spam defence for one domain, without the AI layer.

  • 500 submissions a month
  • Origin lock & honeypot
  • Rate limiting
  • Up to 5 forms
  • 1 domain
  • Email delivery
  • Dashboard & CSV export
  • AI validation
  • CAPTCHA support
  • Webhooks
  • Custom email templates
  • Slack & Discord
Start on Starter
Pro$19/ site / month

Every filter layer, including the one that reads the message.

  • 5,000 submissions a month
  • Full AI validation
  • All five filter layers
  • CAPTCHA support
  • Unlimited forms and domains
  • Email + webhook delivery
  • Custom email templates
  • Tunable filter threshold
  • Slack & Discord delivery
  • 12-month history
Start on Pro
Multi-businessCustom

Several businesses, brands or locations under one account.

  • Volume priced across all sites
  • Everything in Pro
  • One dashboard, every site
  • Consolidated invoicing
  • Filter rules tuned per business
  • Priority support
Talk to us

Billed per site. Starter covers the automated traffic; Pro adds the layer that reads what got through. Running several businesses, brands or locations? Multi-business pricing is worked out across your whole portfolio. Talk to us rather than adding sites one at a time.

QuestionsThe ones people actually ask

Before you sign up.

It is built to err toward delivery: anything ambiguous goes to your inbox flagged, not to the filtered list. And nothing is ever deleted: every held message sits in your dashboard with the reason it was held, and you can release it to your inbox in one click. If you would rather see everything, turn the filter off; the other four layers keep working.

No. Reading every submission with a model costs real money on every request, which is why AI validation sits on Pro rather than being spread thinly across a free tier and quietly degraded. Starter is a real plan, not a trial: origin lock, honeypot, rate limiting, up to five forms, and the dashboard. If cost is the deciding factor, the free tiers at Formspree and Basin are genuinely fine. They just forward everything.

Each site gets its own key, its own domain allowlist, its own inbox, its own quota, and its own isolated data. That separation is what keeps one site's traffic from affecting another's. If you run several businesses, brands or locations, multi-business pricing covers the whole portfolio at a volume rate. That is a conversation, not a checkout.

It is a public credential by design, like a Stripe publishable key. It is useless from any domain that is not on your allowlist, because the origin check rejects it with a 403 before anything else runs. If a key ever does need replacing, rotation takes two clicks.

For most sites, briefly. It is four lines of JavaScript in your form handler. Quick for anyone who has edited site code before, and about twenty minutes for a developer who has not seen it. WordPress, Webflow and Squarespace all take it as a custom code block.

Your data is isolated per site and reachable only with your key or your dashboard login. Submission content passes through the validation model to be classified; it is not used to train anything. You can delete any submission, or all of them, whenever you want.

Not yet. If attachments are a hard requirement today, this is not the right tool for you.
One request, one key

Your form works. Make it selective.

See pricingRead the full spec
bash — northbridge-clinic
$ curl -X POST https://api.formalytics.io/api/form-submit \    -H "X-API-Key: fts_9c41…" \    -d '{"emailSubject":"Contact Form","name":"Test"}' HTTP/2 200{ "success": true, "id": "sub_8f2a41" } $