How Web3Forms Handles Security, Privacy, and Email Deliverability

Web3Forms secures form submissions with HTTPS in transit and encryption at rest, sends each submission directly to your email address, and stores submissions for up to 3 years with a retention period you control. Its servers run on Amazon Web Services (AWS), and the service states it is GDPR compliant and does not share or sell your data with third parties. These claims come from Web3Forms' own site, so treat them as vendor statements rather than independently audited guarantees.

Security: what protects a submission

The security model rests on three layers described on the site:

• Transport encryption. Form data is submitted to https://api.web3forms.com/submit over HTTPS, so the browser-to-server leg is encrypted.
• Encryption at rest. Stored submissions are encrypted while sitting on Web3Forms' infrastructure.
• Direct delivery. Emails go straight to the address tied to your access key rather than through a shared inbox or third-party processor.

The access key is the one credential you must protect. It is placed in a hidden form field, which means anyone who views your page source can read it. That is acceptable for a public contact form but means the key is not a secret in the cryptographic sense — it identifies your form, it does not authenticate a user. If a key is abused, the practical remedy is to rotate it in your Web3Forms account and update the form.

A concrete example

Suppose a visitor submits their name, email, and message. The browser posts those fields plus your access_key to the API endpoint over HTTPS. Web3Forms receives the request, stores it encrypted, and forwards it to your inbox. If you later delete the submission or let your retention window expire, the stored copy is removed on that schedule. At no point does the visitor need an account, and you need no server-side code.

Privacy: where data lives and for how long

Two practical implications follow. First, because you control retention, you can shorten the storage window to match your own privacy policy — useful if you operate under GDPR or a similar regime and want to minimize data held by a processor. Second, since submissions land in your email inbox, your email provider's retention and access rules also apply; Web3Forms' storage policy does not override them.

If your site collects sensitive categories of data (health details, financial information, government IDs), a general contact-form processor is usually the wrong tool regardless of its encryption claims. Keep such fields out of the form or handle them through a channel built for that purpose.

Deliverability and uptime

Web3Forms reports the following operating figures:

• 99.9% uptime
• 13.2 million+ emails delivered
• 220,000+ spam submissions blocked
• 412,000+ users

The AWS infrastructure underpins the uptime and deliverability claims. Spam blocking matters for deliverability in a indirect way: fewer junk submissions means your notification emails are less likely to be filtered or ignored, and your inbox stays usable.

Deliverability also depends on factors outside the service. If your receiving mail server is strict, add the sending domain to your allowlist, and test with a real submission after setup rather than assuming the first email arrives. A quick verification step: submit the form once, confirm the message reaches your inbox (check spam), then submit again from a different network to confirm consistency.

What this means for your decision

Web3Forms is a reasonable fit when you need a no-backend contact form, you are comfortable with the access key being visible in page source, and your form collects ordinary contact details. The free tier's 250 submissions per month and the stated retention controls cover most small sites.

It is a weaker fit when you need per-user authentication on submissions, when you must keep data out of email entirely, or when you collect sensitive personal data. In those cases, look for a form backend with server-side validation and stricter data-handling options, or build a small endpoint you control.

Before relying on any of the compliance or uptime figures for a regulated deployment, confirm them directly with Web3Forms and check them against your own obligations — the site's statements are the starting point, not the final word.