Case study · Our own product
How SimplyForms is built
Our own live SaaS product – proof that the team building your website also ships production software with paying customers.
SimplyForms is a form-building platform we designed, built and run ourselves. It is live at simplyforms.dev with paying customers, and it handles the hard parts of real software: encrypted data at rest, subscription billing, spam defence, third-party integrations and AI-assisted form creation. We show it here not as a client success story but as evidence of capability – when you hire us for a website, you are hiring a team that operates a real engineering business, not just a page-builder.
The brief we set ourselves
We wanted a form and lead-capture product that a small business could trust with real customer data, without the compromises that usually come with cheap tools: forms that load fast, submissions that stay private, spam that never reaches the inbox, and billing that just works. The goal was to build it to a genuine production standard – the same standard we hold ourselves to on client work – and then run it in the open, with live customers, so it had to actually hold up.
What we built
Encryption of customer data at rest
Every submission is encrypted with AES-256-GCM before it hits the database, with a separate key per team and no plaintext fallback. If the database were ever exposed, the contents stay unreadable.
Subscription billing that works
Real money runs through Stripe – tiered plans plus a one-off lifetime "founding members" deal – with webhooks, invoices and billing emails handled end to end. Live and taking payments.
Spam protection in layers
Multiple CAPTCHA providers, a honeypot field and configurable spam rules – with per-form CAPTCHA secrets themselves stored encrypted. Only real messages reach the inbox.
Integrations and webhooks
Submissions fan out to Slack, Discord, Telegram and Google Sheets, and outbound webhooks come with retries and replay so a downstream outage never silently loses data.
AI form generation
Describe the form you want in plain English and it is generated for you, built on Google’s Gemini and Vertex models. Modern AI as a first-class part of the product, not a gimmick.
A hardened admin and ops layer
The internal admin enforces mandatory TOTP MFA and step-up re-authentication with an audit log. Plus a public read-only API, custom domains via Cloudflare, cookieless analytics and a status page.
The stack
How we ship it
SimplyForms is run like a real engineering operation, not a one-off build:
- Monorepo. All apps in one monorepo, sharing types, config and tooling, so changes stay consistent across the whole system.
- Trunk-based deploys. Every merge to main deploys to staging automatically; tagging a release deploys to production on Cloud Run. Deploys are boring and repeatable by design.
- Versioned migrations. Every schema change is a timestamped, reviewed migration – no ad-hoc edits to production data.
- Our own secrets tooling. Local and CI secrets are managed with HushEnv, our own secrets manager, so credentials never sit in plaintext in a repo.
- Reviewed changes. Pull requests are reviewed with SimplyReview, our own code-review tooling, before anything reaches main.
This is the same discipline – version control, migrations, code review, controlled deploys, secrets hygiene – that we bring to every client project, whatever its size.
Why this matters for your project
The same team, the same stack and the same discipline that built SimplyForms build your website – and that is literal: your site runs on the very products showcased here. We use SimplyForms for your contact and lead-capture forms and Umami for privacy-friendly, cookieless analytics. When we say your site is fast, secure and properly built, we mean it in the same terms we hold our own live software to.