Plans, limits and data

Prices are on Formhaus Cloud. Limits enforced by the service:

Plan	Price	Forms	Submissions	Editors	Webhooks and emails	Submission retention
Unclaimed	None	3 per agent key, deleted forms count for 24 hours	100 in total per form	None	No	Deleted with the form after 7 days
Free	$0	3	100 per month	1	Yes	90 days
Pro	$19 per month or $190 per year	Unlimited	25,000 per month	3	Yes	Until deleted
Team	$49 per month or $490 per year	Unlimited	100,000 per month	10	Yes	Until deleted

• The plan belongs to the workspace. Owners see it under Settings > Usage and plan.
• Pro and Team are switched on by hand. Pro opens a Stripe checkout and is active within a day of payment. For Team, write to hello@formhaus.dev.
• Monthly limits count all submissions to the workspace's forms in the calendar month, UTC.
• Editor seats count owners and editors plus pending unexpired editor invites. Viewers are unlimited on every plan. See Teams and roles.
• Over a limit, POST /f/{id} answers 402 limit_reached, and the REST API and MCP tools return upgrade_url with Ask the user to upgrade at <url>. The URL is the payment link, or https://app.formhaus.dev/usage when none is set.
• list_forms and GET /v1/forms return upgrade_url and notice from 80% of the monthly limit.
• A definition is at most 32 KB and 100 fields. Rate limits are in Publishing and Collecting submissions.

Region

The service and its Postgres database run on DigitalOcean in Frankfurt (fra1).

What is stored

Data	Stored
Account	Email
Workspaces	Name, plan, memberships with roles, pending invites (email, role, sent time)
Forms	Every published definition version, settings, webhook secret
Submissions	Validated values, definition version, time, user agent, referrer (each cut at 512 characters), skipped steps
IP addresses	Not stored. Rate limits keep them in memory. Abuse reports store an HMAC of the IP with a daily key.
API keys, sign-in links, sessions, claim and invite tokens	HMAC or hash only
Claim and invite email addresses	The email is sealed in the queued job until sent. Claims keep an HMAC of the address.
Webhook deliveries	Last 100 attempts per form
Idempotency keys	24 hours

Retention and deletion

Data	Deleted
Unclaimed forms and their submissions	Daily, after expiry
Agent keys	Daily, after their last form expires
Free plan submissions	Daily, after 90 days
Sign-in links and sessions	Hourly, after expiry
Webhook deliveries beyond the last 100	Hourly
Database backups	Daily, encrypted with age, kept 30 days

Deleting a form deletes its versions, submissions, idempotency keys and delivery log. Owners delete forms in the dashboard, under Danger zone in the form settings. Deleting a workspace or an account is described in Teams and roles. To remove data another way, write to hello@formhaus.dev.

Security

• Submissions are validated on the server by @formhaus/core; the browser cannot skip checks.
• API keys never belong in browser code. Pages use only the public form_id.
• Webhooks are signed with HMAC-SHA256, use https on port 443 only and refuse private addresses. See Webhooks.
• The dashboard, hosted page and emails show zero-width, bidirectional and tag characters, and variation selectors, as \u{XXXX}. The REST API and MCP return values unchanged and flag them with values_contain_hidden_characters.
• CSV cells that start with a formula character are prefixed with '.
• Roles are checked on every call. See Teams and roles.
• The hosted page sets a strict Content-Security-Policy and blocks framing outside the embed.
• Dashboard POST requests check Sec-Fetch-Site and Origin.

Legal

Terms, Privacy, DPA, Sub-processors.