Does my form data pass through third-party automation services?

No. Submissions go from the visitor's browser (or your server) to the SheetLink Forms endpoint, are screened and stored there, and are delivered directly to the Google Sheets or Microsoft Graph API. No Zapier, no per-task automation platform.

What happens when delivery fails?

Failed deliveries retry automatically at 5 minutes, 30 minutes, and 2 hours. Every submission and its delivery state is visible in the dashboard, so nothing disappears silently.

How does field mapping work?

Field names that match your column headers map automatically - 'Email', 'email', and 'E-mail' all match an 'Email' column. Explicit per-field mapping is available when names differ.

What spreadsheet access does SheetLink Forms get?

For Google, the drive.file scope: only the spreadsheets you pick in the picker or create through the product - never the rest of your Drive. For Microsoft 365, delivery writes to the Excel table you choose.

How it works

One pipeline, five doors in. Everything below is live today - you can watch it run on the live demo.

1. Every form gets a permanent endpoint

Create a form in the dashboard and it gets a token and an endpoint:

https://sheetlinkforms.com/f/slf_yourtoken

The token is the credential. POST to it from anywhere: an HTML form action, JSON from any backend, the sl.js embed, a Webflow or Framer webhook (/w/webflow/<token>, /w/framer/<token>), or email to <token>@sheetlinkforms.com.

2. Submissions are screened, not silently filtered

Each submission passes rate limits (per form and per IP), an optional per-form origin allowlist, a honeypot field, a timing signal from sl.js, and content heuristics (link stuffing, disposable email domains, empty payloads) tuned by a per-form strictness dial. Suspicious submissions land in a quarantine you can review in one click - approving delivers them. Only the honeypot, which humans never touch, marks spam outright.

3. Delivery is direct, asynchronous, and retried

A delivery worker writes each accepted submission straight to the Google Sheets API (appended under your header row, aligned to your columns) or to your Excel table via Microsoft Graph. Failures retry at 5 minutes, 30 minutes, and 2 hours; every attempt is visible in the dashboard. Field names that match your column headers map automatically; explicit mapping covers the rest. Formula-injection guards escape anything starting with =, +, or @ so a malicious submission cannot execute in your sheet.

4. Attribution rides along

With the sl.js embed, utm_source through utm_content plus gclid, wbraid, gbraid, fbclid, and msclkid are captured on the landing page, persisted in the browser, and attached to the submission - even when the form is pages away from the ad click. Add matching columns and they appear in your sheet, ready for offline conversion uploads.

5. Your spreadsheet stays yours

Google connections use the drive.file scope: SheetLink Forms can only see and write the spreadsheets you pick or create - never the rest of your Drive. Tokens are stored encrypted; submission content is stored only to screen, deliver, and retry. Details on the security page.

Request an invite Developer docs