Construiești
You prepare the questions and the path through the form.
Produse Megaforms
Formulare conversaționale Dezvoltare & demonstrații
A form you can speak into, not just type into.
Megaforms explores collecting answers through conversational forms, including spoken answers and transcription. The information arrives structured, ready for the team that has to use it.
- 1Întrebări
- 2Voce sau text
- 3Răspunsuri structurate
Megaforms
From information to work done.
Colectezi
The respondent answers in whichever format is available, speaking included.
Organizezi
The answers are gathered in one place, for review and for connecting to workflows.
Where it earns its place.
Requests and briefs
Structured information before the first conversation.
Feedback
Easier answers to give, when writing is the awkward part.
Internal processes
Forms shaped to the role and to how the team works.
The features, the connections and the terms of use are confirmed in a demo of the relevant configuration.
Megaforms in detail
What you can do with this project.
Megaforms is a form builder in which a person can answer by speaking, not only by typing. The question appears on screen, the respondent presses and talks, and the recording is turned into text on the server — with `whisper-1`, through our own model gateway. The audio stays stored next to the transcript, because a transcription can get things wrong and somebody has to be able to listen to the original.
Around the form sits everything a team needs in order to use it seriously: workspaces with roles, API keys for server-to-server integrations, cryptographically signed webhooks with secret rotation, custom domains per workspace, two-factor authentication with hardware security keys included, Stripe payments, and export to CSV, JSON, plain text and PDF.
The compliance side is not a policy page, it is functionality: every workspace has a retention policy, records of processing activities, a data protection impact assessment, tracking of data processing agreements, a sub-processor list, and a spending ceiling on the AI side, so that a model bill cannot quietly get out of hand. Transcripts pass through a personal-data redaction step before they are stored.
Answering by voice, transcribed on the server
The actual route: the recording is uploaded to an endpoint tied to the session, the size is checked — 25 MB at most — along with the type, from a list of eleven accepted formats (webm, ogg, mp3, m4a, mp4, wav, flac, aac and their variants). Transcription is done with `whisper-1` through our own gateway, with the language normalised to Romanian, Russian, English or Ukrainian. On top of that sits a limit of 30 uploads per 15 minutes per IP address.
An explicit switch for server-side voice
Server-side transcription is turned on per form, through the `voice_server_enabled` field, and requires the gateway key to be configured. If either one is missing, the form does not break — it falls back to the browser's own speech recognition, which is weaker and depends on the respondent's browser. The difference is visible in the code, not hidden.
Signed webhooks, rotated without an outage
Every delivery carries the header `X-Megaforms-Signature-V1: sha256=<hex>`, computed as HMAC-SHA256. When the secret is rotated, for 24 hours `X-Megaforms-Signature-V1-Previous` is sent as well, with the old secret, and the receiver accepts either — so the key can be changed without the integration going down. There is a delivery history, redelivery, content preview and test scenarios.
API keys that cannot be recovered
The format is `mf_<prefix>_<secret>`, with an 8-character prefix and a 32-character secret. Only the prefix and `sha256(secret)` are kept in the database; the whole key is shown exactly once, when it is created. Comparison is done with `timingSafeEqual`.
Authentication at the level 2026 expects
Passwords with bcrypt, two-factor authentication with a code generated on the phone and, separately, WebAuthn for hardware keys or biometrics. On top of those: an allowed-IP list per workspace, an audit log with a live stream, tracking of active sessions, and administrator impersonation that is itself written to the audit log.
Compliance as a feature, not as a page
A retention policy per workspace, records of processing activities, a data protection impact assessment, tracking of data processing agreements, notification when sub-processors change, full export of a workspace, cookie consent management, content-policy violation reporting, and personal-data redaction in transcripts.
Data and operation
What goes into the system. What has to be checked.
- Where the answers live
- PostgreSQL, with 20 tables: users, workspaces and members, projects, questionnaires, questions, sessions, answers, usage metering, API keys, link events, webhooks and their deliveries, custom domains, uploaded files, voice recordings, follow-up questions, AI consumption, NPS responses and session summaries.
- The audio is kept next to the text
- The recorded file stays on the server, in a directory of its own, and the transcript passes through a personal-data redaction step before it is saved. Both are needed: automatic transcription makes mistakes, and whoever takes a decision on the strength of an answer has to be able to hear what was actually said.
- Model cost has a ceiling
- AI consumption is metered per workspace, and transcription checks the ceiling before calling the model: if the monthly ceiling has been reached, the request is stopped with a dedicated error that says how much of it has been used. This is not an alert after the invoice, it is a gate in front of the call.
- What a public form sees, and what it does not
- Public sessions have per-IP rate limiting, automatic saving of answers in progress, a resume link with a token, and a separate check, through a signed token, for forms embedded in another site.
From exploration to deployment
How we prepare a project with Megaforms.
We decide what shape the answer takes
Voice, text or both, question by question. The input types the question engine accepts also decide where voice makes sense: on open-ended questions, not on an email address or a number.
We turn on server-side voice, where it earns its place
`voice_server_enabled` is switched on for the form and the gateway key is configured. Without them, respondents get the browser version — a legitimate decision for a simple form, but one to take deliberately.
We connect the result to the system that receives it
A signed webhook to your system, or an API key for server-to-server reads. We test the secret rotation inside the 24-hour window, so that changing the key in production is not the first time you do it.
We set retention and the cost ceiling before launch
How long answers and recordings are kept, who has access, what monthly ceiling AI consumption has. All three are fields in the product, so they are decided once and then apply on their own.
Questions worth settling.
How does answering by voice work, exactly?
The respondent records in the browser, the file is uploaded to the session endpoint, and the server checks the size (25 MB at most) and the format (eleven accepted types: webm, ogg, mp3, m4a, mp4, wav, flac, aac). Transcription is done with `whisper-1` through our own model gateway, with the language normalised to ro, ru, en or uk. The audio stays stored next to the transcript, and the text passes through a personal-data redaction step.
Does voice work on any form, automatically?
No. Server-side transcription is switched on explicitly on the form and needs the gateway key. If either one is missing, the form does not lock up: it falls back to speech recognition in the respondent's browser. That is a real difference in quality and in language coverage, which is why we say it before the build, not after.
What do we receive in our system, for each answer?
A webhook signed with HMAC-SHA256, in the `X-Megaforms-Signature-V1` header. The key can be rotated without an outage: for 24 hours both signatures are sent, the new one and the old one, and the verifier accepts either. There is a delivery history, manual redelivery and content preview. For server-to-server reads there are API keys, of which we keep only the prefix and the hash in the database.
Can an AI bill get out of hand?
Not quietly. Consumption is metered per workspace and there is a monthly ceiling checked before the model is called: when it is reached, transcription stops with an error that says how much of the ceiling has been used. The gate sits in front of the call, not in the invoice at the end of the month.
How well tested is the product?
Honestly: less well than its surface area would suggest. The project's test command runs nothing — it answers "No tests yet" and exits successfully. What actually exists: three unit test files (conditional logic, form authentication, personal-data redaction), one end-to-end test and one automated accessibility test. Real verification today is done through `tsc --noEmit` plus the build, and through the production health endpoint, which checks the database, Stripe, the model gateway and token signing.
Where is it hosted, and on which domain?
On our own infrastructure in Europe, at `forms.megapromoting.com`. The domain is a temporary one, under the company's domain rather than the product's own — moving it is an open branding decision, not a technical limitation.
What happens to respondents' data after a while?
The retention policy set on the workspace applies. The product also holds records of processing activities, the data protection impact assessment, tracking of data processing agreements, notification when sub-processors change, and full export of a workspace — all as endpoints, not as text on a policy page.
Illustrative example
An open-ended spoken answer that reaches the team as structure
A usage scenario, with no client data and no commercial results attributed.
The starting situation
A respondent is given an open question and, instead of writing, presses the record button and talks for a minute.
How it works
The file is uploaded to the session endpoint; the server checks the size and the format, then asks for transcription with `whisper-1` through our own gateway, in the form's language. The text passes through personal-data redaction before it is saved, and the audio stays stored beside it.
Rezultatul
The team sees the answer as text in the panel, can export it to CSV, JSON, plain text or PDF, and can listen to the original if the transcript looks wrong. If a webhook is configured, your system receives the signed event.
Ce este necesar:Formularul cu voce pe server activată și cheia gateway-ului configurată — altfel se folosește recunoașterea din browser. Plafonul lunar de cost AI neatins. Informare clară a respondentului despre înregistrare și transcriere.
Ways of working together
Megaforms, in the context of your organisation.
Access to approved information
Assistants for recurring questions, with controlled sources, explicit limits, and handover of sensitive situations to a named person.
Private companies
We define a pilot around one real process: users, data, integrations, costs and acceptance criteria. Expansion follows once the result has been assessed.
Public institutions and state-owned companies
We establish the requirements for accessibility, hosting, data protection and interoperability. Any connection to services run by Moldova's e-Governance Agency (AGE) or its state information-technology service (STISC) requires eligibility, access and approvals to be validated.
These are adaptation scenarios, not statements about existing contracts or partnerships. The proposed capabilities are confirmed within the project's scope of work.
Discută un pilotPart of an ecosystem.
Conversații și suport
aichat
Un asistent conectat la informațiile afacerii tale, în canalele în care îți scriu clienții.
PlatformăOrganizarea muncii
Taskin
Taskin explorează transformarea discuțiilor și a contextului de proiect în angajamente, priorități și pași de lucru.
Dezvoltare & demonstrațiiPlatformă civică
sesizari.md
sesizari.md organizează sesizările despre spațiul public: loc, categorie, descriere și materiale relevante.
Platformă publicăWhat would you want to work better?
Tell us about your process. Together we decide what is worth building, what we can connect, and how we check the result.