Building a Form and Survey Intake System: Bot Defence, Attachments, Auto-Routing and CRM Handoff

612 submissions received, 180 actually answered

An industrial parts distributor had five entry points on its website: quote request, catalogue download, dealer application, warranty registration and job application. All five pointed at one info@ mailbox. Over six months it collected 612 messages; after someone manually filtered out the 41% that were bot spam, 361 genuine enquiries remained. With no assignment rules, no status field and no overdue alerts, only 180 ever got a reply, at a median first response of 3.8 days. A polished front-end form feeding a pipeline with no routing, deduplication or audit trail is just a tidier way of discarding leads.

When it fits, and when it does not

A custom intake system earns its cost when:

• You receive 100+ submissions a month across more than three entry points (website, LINE, trade-show QR codes, landing pages)
• Attachments matter — site photos, invoices, CVs — and must be retained beyond a year
• Different forms must reach different departments or regional reps, with a response-time SLA to track
• Surveys or registrations need conditional logic, quota caps or cut-off dates
• Submissions contain personal data, so consent version, timestamp and access logs must be retained

Use an off-the-shelf tool instead when:

• You get fewer than 30 submissions a month and one person handles them all
• It is a one-off event registration with no follow-up nurture
• Nobody internally can yet answer "who owns this enquiry"
• The budget is under NT$60,000 but the ask includes two-way CRM sync

Alternatives compared

The rule is blunt: once "who owns this submission" takes more than three rules to express, SaaS automation starts fighting you. And when attachments are part of the workflow — no drawing, no quote — a custom build is close to the only option.

A seven-week build: phases, deliverables, tools

• Week 1 — Intake audit. Lay out every entry point and stray spreadsheet; define each field's type, requiredness, option codes and retention period. Deliverables: field dictionary, routing matrix. Tool: Notion.
• Week 2 — Flow and prototype. Design four states — pre-submit, success, failure, duplicate — and sign off the validation copy with them. Deliverable: clickable prototype. Tool: Figma.
• Weeks 3–5 — Form engine and attachments. Configurable field engine, duplicate validation on client and server, presigned-URL direct upload, file-type allowlisting and scanning. Deliverables: API docs, staging environment. Tools: Laravel, Cloudflare R2, Turnstile.
• Week 6 — Routing and CRM handoff. Rules engine (form type × region × deal size → owner), overdue alerts, webhook push with a retry queue. Deliverable: SLA table. Tools: Amazon SES, HubSpot API.
• Week 7 — Acceptance and training. Push 500 synthetic submissions to measure routing accuracy, rehearse oversized-file and dropped-connection cases. Deliverables: acceptance checklist, walkthrough recording. Tool: UptimeRobot.

What it actually costs, hidden items included

• Entry tier: form engine and back-office UI for 3–5 form types, NT$50,000–80,000
• Standard tier: adds attachment upload with allowlisting plus the routing rules engine, NT$110,000–180,000
• Advanced tier: adds the CRM webhook, survey conditional logic and quota control, NT$200,000–280,000
• Hidden cost one: Amazon SES bills about US$0.10 per 1,000 emails, so 20,000 notifications a month is roughly NT$65 — but budget hours for domain authentication and bounce handling
• Hidden cost two: reCAPTCHA is free for the first 10,000 assessments a month and tiered above that; Turnstile offers a free plan instead
• Hidden cost three: internal agreement on the field dictionary and routing rules takes 12–20 hours of meetings, the line most often forgotten
• Annual operations: NT$18,000–36,000 for backup verification, spam-rule tuning and field changes

ScriptWalker's Form and Intake Workflow build starts at NT$50,000, covering the field dictionary, bot defence and a single form set. Two-way CRM sync is quoted separately.

Expectation vs reality

• Expectation: changing a field is quick. Reality: every extra required field depresses completion rate, and it touches routing rules, CRM field mapping and report definitions at once.
• Expectation: a CAPTCHA ends the spam. Reality: the hard cases are agencies filling forms by hand, which needs rate limiting, honeypot fields and content rules together.
• Expectation: files upload straight to the web server. Reality: a 20MB site photo hits PHP upload limits and request timeouts first.
• Expectation: connecting the CRM makes follow-up happen. Reality: without an SLA and overdue alerts, leads just sink somewhere more expensive.

Five traps and how to avoid them

• Trap: every form lands in one shared mailbox. Fix: give each form a routing key in a hidden field, and let the backend assign and record an owner.
• Trap: unlimited attachments with no type allowlist. Fix: cap at 20MB per file and five files per submission, validate extension and MIME on both sides, scan before storing.
• Trap: validation lives only in front-end JavaScript. Fix: re-run the identical rules on the server; client-side checks are not a security boundary.
• Trap: one person submits five times and becomes five leads. Fix: fingerprint on email + form type + a 24-hour window, and merge repeats into one case.
• Trap: the consent notice is a bare checkbox. Fix: under Taiwan's Personal Data Protection Act notice-and-consent duties, store the policy version, consent timestamp and source IP.

Success metrics and the 90-day roadmap

• Day 30 — submission success rate at 98% or better, bot share under 5%, median first response under 4 hours, zero unassigned submissions carried overnight.
• Day 60 — analyse field-level abandonment and remove the two worst-performing optional fields; keep form-page LCP within 2.5 seconds and lift mobile completion by 10%.
• Day 90 — routing accuracy at 95% or better, duplicate leads under 3%, a baseline conversion rate for qualified leads, and a weekly report delivered automatically to department heads.

Decision checklist: answer these 12 first

• ☐ I know our monthly submission volume and the split by entry point
• ☐ Every form type has a named first responder
• ☐ We have a written response deadline, such as four business hours
• ☐ Someone is alerted when a submission goes past that deadline
• ☐ We need attachments, and I can state accepted types and sizes
• ☐ Submission data must be retained for more than a year
• ☐ I know which CRM or spreadsheet this has to feed
• ☐ Someone can maintain the option lists (product lines, regions)
• ☐ Spam currently exceeds 20% of what we receive
• ☐ We need conditional logic or quota caps
• ☐ We have explicit notice-and-consent wording for personal data
• ☐ The budget covers first-year operations, not only the build

Seven or more ticks and a custom intake system usually pays back inside six months. Fewer than four and you should get more out of an off-the-shelf tool first.

Frequently asked questions

We already use Google Forms — can the data come across?

Yes. Export to CSV, map and clean it against the new field dictionary (normalise region spellings, split name from company, flag duplicates), then bulk import while preserving original creation timestamps. A migration of 500 to 5,000 records typically takes 4–8 hours.

Do we have to use a CAPTCHA?

Not necessarily. A honeypot field plus rate limiting usually blocks more than 70% of automated submissions, and pairing that with a non-interactive challenge like Turnstile means visitors click nothing at all. What genuinely damages completion is the old image-selection CAPTCHA, so escalate to it only during abnormal traffic.

Can we build only the routing and keep our existing forms?

Yes, and it is usually the highest-return first step. Keep the current front-end, repoint the submit action at an intake API, and start with case numbers, assignment rules and overdue alerts — roughly NT$35,000–55,000 and two to three weeks to launch.

Next step

Start with a free intake audit: send us your live form URLs and the last three months of submission volume, and we will return a draft routing matrix marking overlapping entry points, missing owners and the two breakpoints worth fixing first.

• Email: [email protected]
• Phone: 0916-224-047
• LINE: @ufv9089p