Feature Deep Dive

Form Backend with Secure File Uploads & Cloud Storage

Accept file attachments directly from any HTML or React form with presigned direct uploads, private storage, and signed download links.

Last updated: 2026-09-22
Direct Answer

How does Form2Lead handle form backend with secure file uploads & cloud storage?

Form2Lead supports direct presigned file uploads to private encrypted storage. Visitors upload attachments directly from the browser to cloud storage — bypassing serverless body limits — and download links are delivered via signed capability URLs in email alerts, CSV exports, and the dashboard.

Verified product capabilityRead documentation →

Capability Overview

Direct presigned file uploads to private cloud storage. Upload attachments from HTML or React forms with zero server code and signed download links.

Key Benefits & Developer Controls

  • Direct-to-storage presigned uploads bypass standard 4.5 MB function payload walls completely.
  • Private storage security: uploads are never public; downloads require HMAC signed capability tokens.
  • Tiered storage allowances: Basic (1 file, 5 MB, 100 MB quota), Starter (2 files, 10 MB, 400 MB quota), Growth (4 files, 20 MB, 1 GB quota).
  • Malware and script prevention: executable files, HTML, SVG, and dangerous scripts are automatically rejected.
  • Server-side verification: automated validation checks file existence, size, and MIME type before submission confirmation.
  • Automated lifecycle management: files expire cleanly with submission retention or after 24 hours if unattached.
// Direct presigned file upload flow with zero backend code
<!-- 1. HTML form with file picker -->
<form id="contact-form" action="https://form2lead.com/api/v1/f/YOUR_FORM_ID" method="POST">
  <input type="text" name="name" required placeholder="Your Name" />
  <input type="file" id="attachment" name="attachment" accept=".pdf,.png,.jpg" />
  <input type="text" name="_gotcha" style="display:none !important;" tabindex="-1" />
  <button type="submit">Submit Form</button>
</form>

<script>
  // 2. Two-step direct upload: presign -> PUT to storage -> submit _f2l_files
  const form = document.querySelector('#contact-form');
  form.addEventListener('submit', async (e) => {
    e.preventDefault();
    const file = document.querySelector('#attachment').files[0];
    const fileIds = [];

    if (file) {
      // Step A: Request short-lived presigned upload URL
      const presign = await fetch('https://form2lead.com/api/v1/f/YOUR_FORM_ID/presign', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ fileName: file.name, contentType: file.type, sizeBytes: file.size })
      }).then(r => r.json());

      // Step B: Upload bytes directly to secure storage (bypasses serverless limits)
      await fetch(presign.uploadUrl, { method: 'PUT', headers: { 'Content-Type': file.type }, body: file });
      fileIds.push(presign.fileId);
    }

    // Step C: Submit form payload with file reference IDs
    const payload = Object.fromEntries(new FormData(form));
    delete payload.attachment;
    payload._f2l_files = fileIds;

    await fetch('https://form2lead.com/api/v1/f/YOUR_FORM_ID', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },
      body: JSON.stringify(payload)
    });
    alert('Submitted successfully with attachment!');
  });
</script>

Frequently Asked Questions

Direct Answer

How does Form2Lead handle file uploads without exceeding serverless limits?

Form2Lead uses a two-step presigned URL architecture. The client requests a short-lived presigned upload URL from Form2Lead, uploads the file directly to private cloud storage, and submits the form with the resulting file ID. Because file bytes bypass serverless functions, you never encounter request body size limit errors.

Direct Answer

What file types and sizes are supported?

Supported types include PDF, JPG, PNG, WEBP, DOCX, XLSX, CSV, and ZIP depending on your tier. Size allowances range from 5 MB on Basic up to 20 MB per file on Growth (with a 25 MB platform hard cap). Dangerous extensions like EXE, SH, SVG, and HTML are denied by default.

Direct Answer

Are uploaded files publicly accessible on the web?

No. All files are stored in private encrypted storage. Download access is gated through Form2Lead signed capability URLs that expire in 15 minutes and force attachment download headers. Direct unauthorized links return HTTP 403 Forbidden.

Direct Answer

How long are uploaded files retained in storage?

File retention matches your subscription retention: 14 days on Basic, 30 days on Starter, and 120 days on Growth. An automated hourly janitor deletes expired files from storage so you never get billed for orphaned data.

Start Using Form Backend with Secure File Uploads & Cloud Storage

Set up your form endpoint in under 60 seconds with zero backend code.