These are the features buyers ask for, each classified with the same honesty as the stated ones, and prioritised for the DACH-agency fallback. Being asked for doesn't mean you should build it. Almost everything here is already offered by Web3Forms, Formspree or an EU entrant.
Legend: TS = Table stakes, D = Differentiator, X = Distraction, L = Liability. Priority: P0 = v1 of the fallback, P1 = next, P2 = later, — = don't build.
4.1 Core submission handling
| Feature | Demand signal | Category | Priority | Notes |
|---|
| HTML form endpoint with access key | Universal | TS | P0 | The whole product for most users. Solved everywhere. |
| JSON / fetch API for JS frameworks | High | TS | P0 | Needed for React, Astro, Next.js and AI-built sites. |
| Email notification to one or more recipients | Universal | TS | P0 | Routing to several recipients is a paid feature at Formspree. |
| Redirect or thank-you page | High | TS | P0 | Trivial. |
| Submissions dashboard, search, CSV export | High | TS | P0 | Agencies need it per client. |
| File uploads | Medium | TS / L | P2 | Storage cost and malware risk. EU storage only. |
| Autoresponder to the submitter | Medium | TS | P1 | Deliverability risk if abused. |
| Conditional routing (e.g. "sales" vs "support") | Medium | TS | P1 | Formspree Business has it. |
4.2 Spam, abuse and deliverability (the quality bar)
| Feature | Category | Priority | Notes |
|---|
| Honeypot and rate limiting | TS | P0 | Free to build, catches most bots. |
| Self-hosted proof-of-work captcha (no cookies, no US service) | TS / D in DACH | P0 | Avoids a consent banner for reCAPTCHA or hCaptcha. Friendly Captcha and Formdall already use this idea. |
| Cloudflare Turnstile or hCaptcha option | TS | P2 | Offer as opt-in only. Both are non-EU services. |
| AI spam scoring | TS | P2 | Formward has it. Use an EU model provider if you add it. |
| Destination-email verification | TS | P0 | Stops your endpoint being used to spam third parties. |
| Phishing-form detection (password or card fields) | L if missing | P0 | Form backends are an easy target for credential-harvest pages (reasoned risk). |
| SPF, DKIM, DMARC-aligned sending; per-client sender domain | TS / D for agencies | P0 / P1 | Notifications from the client's own domain are the white-label feature agencies want. |
| Bounce and complaint handling | TS | P0 | Protects your sender reputation for every customer. |
4.3 Agency features (the only differentiators)
| Feature | Category | Priority | Notes |
|---|
| Per-client workspaces with separate keys and settings | D | P0 | The core of the Agency plan. |
| White-label notification emails (no FormDrop branding) | D | P0 | Agencies don't want your name in their client's inbox. |
| Per-client AVV annex the agency can forward | D (DACH) | P0 | A real chore for German agencies, cheap to build. |
| Client read-only inbox (the client sees their own submissions) | D | P1 | Removes "can you forward me that lead?" requests. |
| Transfer a workspace to the client's own account | D | P2 | Handover at the end of a contract. It reduces lock-in, but agencies ask for it. |
| Usage alerts per client site | TS | P1 | "Client X is at 80% of their limit." |
| Bulk migration from Web3Forms or Formspree | D | P1 | Pairs with the paid switch service. |
4.4 Data protection (DACH trust)
| Feature | Category | Priority | Notes |
|---|
| EU-only hosting, email and storage, with a published subprocessor list | TS in DACH | P0 | Formward, Formhook and Formdall all have it. It's the entry ticket, not the win. |
| AVV (DPA) accepted in the dashboard | TS in DACH | P0 | Formward and FormVault offered this. |
| Set retention window with automatic deletion | TS | P0 | Default 90 days, configurable. |
| Hashed or truncated IP storage | TS | P0 | Formward stores SHA-256 hashes. |
| Data-subject access and erasure tools (Art. 15/17) | TS | P1 | Formdall has them. |
| Encryption at rest per workspace | TS | P1 | Formdall and FormVault advertise AES-256. |
| TOMs document (technical and organisational measures) | TS in DACH | P0 | Agencies attach it to client files. |
| "DSGVO-konform" certification or badge | L | — | No such certification exists for a form backend. A badge invites formal warnings. |
4.5 Integrations and distribution
| Feature | Category | Priority | Notes |
|---|
| Webhooks (HMAC-signed) | TS | P1 | Formdall includes them on all plans. |
| Google Sheets, Slack, Discord | TS | P2 | Each is permanent maintenance. |
| Zapier / Make / n8n | TS | P2 | n8n is popular with German agencies (unverified). |
| HubSpot, Pipedrive, Brevo | TS | P2 | Only when paying agencies ask. |
| Framework guides (Astro, Hugo, Next.js, Eleventy, Framer, plain HTML) in German | TS | P0 | Content, not product. German is the only angle. |
| MCP server or "paste this prompt" for AI builders | TS | P2 | Formdall has one. Fine as a doc page, not a headline. |
| Vercel Marketplace connectable listing | TS | P2 | Formspree is already there. |
| White-label resale through an EU host or agency network | D | P1 | The one pivot allowed. See WHAT-TO-DO-AND-AVOID. |
4.6 Rejected, even though people ask
| Feature | Category | Why not |
|---|
| Drag-and-drop form builder | X | Tally (EU, free), Typeform, Jotform. A different product. |
| Surveys, polls, quizzes | X | FormVault tried forms plus polls and stopped taking signups. |
| Payments inside forms | X / L | Stripe payment links do it. Adds PCI scope. |
| CRM or lead pipeline | X | Agencies' clients already have one. |
| Regulated intake (health, legal) with signed agreements | X here | A different product and buyer. Not researched. |
| A lifetime deal | L | Caps revenue and brings users who never renew. |
4.7 Net effect
Of about 45 features buyers ask for, about 5 are differentiators, and all of them only for DACH agencies. About 15 belong in the fallback's v1. Everything else is table stakes that Web3Forms, Formspree or an EU entrant already ships. That's the core problem: there is nothing to build that others don't have.