How to Build an Online Form With File Uploads Using AI

To build an online form with file uploads using AI, list the fields, required documents, accepted file types and who reviews submissions. The builder creates the form, validates input, stores files privately behind expiring links, saves each submission to a database and gives reviewers an admin list. Email alerts work once you add your SMTP account.

• Your list of fields, documents, file types and reviewers is the spec. Write it before you prompt.
• Uploaded files are private by default and open only through short-lived links, for signed-in reviewers.
• Each file can be up to 25 MB, and uploads count toward your plan's storage and bandwidth.
• Reviewers work in a login-protected list with statuses and notes, filtered by status, role or date.
• Email alerts and auto-replies use your own SMTP account; submissions are saved either way.
• Collect only what you need, say how long you keep it, and build the delete button before the first applicant arrives.

When a custom form beats a generic form tool

Generic form tools are excellent for surveys, sign-ups and simple contact forms. They get awkward when documents and decisions are involved: a recruiter sorting CVs by stage, an agency collecting brand files before a kickoff call, a builder comparing photos of twenty bathrooms. Then the form is the front door to a review process.

If you need ten questions and no files, use a generic tool or a simple sign-up page like the one in the waitlist landing page guide. Build your own when files, statuses and several reviewers are involved.

Plan fields, validation and accepted file types

Write a one-page spec. It will save you several rebuilds.

• Fields: name, type (email, phone, date, number, choice, long text), required or optional, and any condition, such as showing "Portfolio URL" only for design roles.
• Validation: checked instantly in the browser for convenience, and again on the server, where it counts. Note limits such as "description up to 1,000 characters".
• Documents: which ones, which are required, and how many files per field.
• Accepted types: an allow-list such as PDF and DOCX for documents, JPG, PNG and HEIC for photos. HEIC photos from iPhones don't preview in every browser, so reviewers may need to download them.
• Size: 25 MB per file is the platform maximum. Set a lower limit if your files are smaller; 10 MB covers almost any CV.
• Reviewers and statuses: who reviews, the statuses a submission moves through, and who may delete.
• Retention: how long you keep submissions and files.

The OWASP File Upload Cheat Sheet, a standard security reference, recommends exactly this: allow-list extensions, don't trust the browser's reported file type, rename files, and set size limits. Put those rules in your prompt.

Ask only for documents you will actually use. A CV and a cover letter, yes; a passport scan at the first stage, almost never. Every extra document is more to secure, store and eventually delete.

Build it: steps and three prompt templates

1. Finish your spec, then open a new WisyLink chat on the web or in the iOS or Android app.
2. Paste the closest template below, edited with your fields, file rules and statuses.
3. When the build finishes, read the final note: it tells you how to reach the admin area and that email waits on your SMTP details under Integrations. Never paste passwords or keys into the chat.
4. Test with real files (the largest you allow, a wrong type, a phone photo, a duplicate), then act as a reviewer: open a file, change a status, add a note, delete a test submission.
5. Adjust in the same chat. Each change is a new build, and a failed build never replaces the live form.
6. Put it on a paid plan before real people apply. Free links last 30 days plus a week marked for deletion, and the submissions and files go with them.

Job application form

Build a careers site for Brightline Dental with three open roles stored as saved data, each on its own page with an application form: full name, email, phone, role (preselected), years of experience, right to work (yes/no), CV (required, PDF or DOCX) and cover letter (optional, PDF or DOCX), 10 MB per file, stored privately. Show a confirmation page with a reference number. Admin: a login-protected list, newest first, filterable by role and status (New, Reviewing, Interview, Offer, Rejected), with internal notes and buttons to open each file. Through my SMTP account, email me each new application and send the applicant an acknowledgement. Add a privacy notice link stating we keep applications for 6 months, and an admin button that deletes an application and its files.

Client intake form

Build a three-step client intake form for Northwind Studio, a branding agency. Step 1: company, website, contact name, email. Step 2: project type (logo, full brand, website), budget range, deadline. Step 3: existing logo files and brand guidelines, up to 5 files of PDF, PNG, JPG or ZIP, 25 MB each, stored privately. Let clients save progress and return through a private resume link. Admin: intakes list with status (New, Call booked, Proposal sent, Won, Lost), notes and an assigned team member. Email me each completed intake.

Quote request form

Build a quote request page for Oak & Iron Renovations: name, phone, email, postcode, job type (kitchen, bathroom, extension, other), description up to 1,000 characters, preferred contact time, and up to 6 photos (JPG, PNG or HEIC, 25 MB each, private). Show what happens next on the thank-you page. Admin: requests filtered by job type and status (New, Visit booked, Quoted, Won, Lost), with notes and a photo gallery per request. Add a hidden honeypot field and limit submissions per email address. Email me each request through my SMTP account.

If clients should later log in to see project files and updates, you need a portal rather than a form; see how to build a client portal without code.

File uploads: private vs public, size limits

Are uploaded files private? Yes, by default. The visitor's browser sends each file straight to the site's file storage with a one-time signed upload, and the site records it against the submission. A private file can only be opened through a link the site creates on request, after checking that the person asking is a signed-in reviewer. Each link expires within minutes, so a forwarded link stops working almost at once.

Public files are for things meant to be seen, such as gallery images; anyone with the URL can open them, and public uploads reject HTML, SVG and scripts so a file can't run code on your site. Keep application and intake documents private.

How large can uploaded files be? Up to 25 MB each. A few more limits to plan around:

• Uploads count toward your plan's file storage and bandwidth. Every time a reviewer opens a private file, that download counts toward bandwidth as well.
• The platform caps how many files a single IP address can upload per minute, which blunts automated floods.
• When a cap is reached, the form says it can't accept uploads right now instead of failing silently; the Resources panel shows how full each cap is.
• For video portfolios or large drawings, ask for a link field to a file-sharing service instead of an upload.

WisyLink's published capabilities don't include virus scanning, so treat files from strangers with care: open them in a viewer, keep your software updated, and never enable macros in a document someone sent you.

Reviewing submissions: admin list, statuses, notes

In the admin area, ask for:

• A list with filters by status, role or job type, and date. Filters match exact values, so you can look someone up by their exact email. There's no free-text search across large sets of submissions; lists of around 100 or fewer can be searched instantly in the browser.
• A fixed list of statuses that matches your real process, and a date stamp each time a status changes.
• Notes with author and time, visible only to reviewers.
• Roles: reviewers who can read, comment and change statuses, and an admin who can also delete.
• A CSV export of the fields for spreadsheets. Files stay in storage; the export lists file names, because private file links expire within minutes.

If reviewing grows into a back office with approvals and scheduling, see how to build internal tools with AI.

Notifications and auto-replies

Can you get an email for every submission? Yes, through your own SMTP account, entered once under Integrations. Until you add it, nothing is sent, but every submission is still saved.

• Owner alert: a short summary with a link to the submission in the admin area. Don't attach the uploaded files; email is the wrong place for private documents.
• Auto-reply to the submitter: a confirmation, the reference number, what happens next and when, and how to withdraw.
• Status emails: templates such as "invited to interview", sent by a button the reviewer presses rather than automatically, so a mis-click doesn't email fifty people.
• Daily digest instead of one alert per submission: a background job checks every 30 to 60 minutes and sends once a day. There's no time-zone setting, so give the hour in UTC.

Send from an address on your own domain, with the SPF and DKIM records your email provider gives you, so mail doesn't land in spam.

Spam protection and rate limits

Bots post junk, and junk uploads eat your storage. Layer the defences:

1. Platform limits. Traffic is rate-limited per IP address before it reaches your site, and so are file uploads. These stop floods, not a patient spammer.
2. A honeypot field: hidden from people, filled in by bots, rejected on the server.
3. A per-email limit, such as 10 submissions an hour from one address, which no real applicant reaches.
4. Server-side checks on file type and size before an upload is accepted.
5. Duplicate marking: the same email for the same role within a day gets flagged, not rejected.
6. A CAPTCHA if spam persists. Any provider with an API can be connected, with its keys under Integrations.

Privacy: consent, retention, deleting data

This is general guidance, not legal advice. The European Commission's summary of the GDPR principles is a good checklist even outside the EU: collect only the data you need for the purpose, keep it no longer than necessary, protect it, and tell people what you do with it.

• Legal basis. Consent is not the only basis, and for job applications it's often not the best one. The Commission notes that consent is not freely given where there's a clear imbalance of power, as between employer and employee. Decide your basis with whoever handles your privacy compliance.
• Privacy notice. Link it next to the submit button: who you are, why you collect the data, how long you keep it, who sees it and how to ask for deletion. Ask for separate opt-ins for anything extra, such as keeping a CV for future roles.
• Retention. Pick a period, such as six months after the role closes, and ask for automatic deletion. A background job runs every 30 to 60 minutes and deletes expired submissions and their files in small batches.
• Deletion on request. An admin button that deletes a submission and its files together. The Commission's guidance on requests from individuals says to reply without undue delay and in principle within one month.
• Access. Only reviewers can open files, through short-lived links, and reviewer pages are never served from a shared cache.
• Sensitive categories. Health data and similar categories carry extra rules. Don't collect them on a general form.

WisyLink's privacy policy tells owners not to publish private or regulated information without their own access controls and compliance review, and it doesn't state a hosting location. If your organisation needs data kept in a particular region or a signed processing agreement, confirm that with WisyLink before you collect documents. Then test the full flow, including deletion, before launch; you're responsible for reviewing what the AI built.

The consent mechanics are the same for marketing sign-ups; the quiz lead magnet guide shows how to store proof of consent.

Build your upload form with WisyLink

Write the spec, pick the closest template and describe your form in one message. WisyLink builds the form, private file storage, the reviewer list and the email hooks as one hosted app, each site isolated from every other. See how WisyLink is built for the isolation and reliability details.

Start free on the Community plan, no card required, and test with your own files. Move to a paid plan before real submissions arrive, so the form, its data and its files stay online.