Design a form once. Publish it as PDF and HTML. Receive it signed.
The CodeB eForms Server turns one form design into a fillable PDF, a responsive web form and a static HTML page. Each submission comes back as a sealed PDF plus XML by e-mail, signed with PAdES up to B-LTA if you want, filled from the EU Digital Identity Wallet, or turned into a ZUGFeRD e-invoice.
From form design to signed document
Form designer in the browser
Drag fields onto the page, set validation rules with regular expressions, use letterheads and cascaded documents, clone templates. Works on tablets and phones too.
One design, three outputs
Each form is published as a fillable PDF (AcroForm), a responsive HTML form for phones and a static HTML page. The right format is picked for each device.
Sealed submissions
The server renders each submission as a PDF, seals it with SHA-512 and an optional RFC 3161 timestamp, and e-mails it with the XML data. Any later change breaks the seal.
Attachments
Uploaded files are converted to PDF pages or zipped, so everything arrives as one document.
Users, roles and groups
Organise forms in groups with their own mail templates per language. Export and restore forms.
Spam protection without CAPTCHA
An invisible check built into the server keeps bots out. No third-party service, no puzzles for real people.
Four steps to a working form
- Design the form in the browser, or start from a template.
- Set delivery: recipients, mail template and language, optional webhook.
- Choose sign-in and signature: open form, sign-in with EUDI Wallet or passkey, handwritten signature, or “Sign the PDF when it is submitted”.
- Release the form and share the link, embed it in your website or send prefilled links through the API.
Electronic signatures at every eIDAS level
Whether a submission is signed is set per form. Forms that require sign-in with a CodeB server are signed with the personal key of the signed-in person at that server, without software to install or a certificate password. All other forms get the seal of your organisation, and so does a submission whose personal signature is not possible, so nothing is lost.
| eIDAS level | With the eForms Server |
|---|---|
| Simple (SES) | Handwritten signature with finger, pen or mouse; the server seals the PDF (SHA-512) and can add a timestamp. |
| Advanced (AdES) | Personal key of the signed-in person at the CodeB server, as PAdES up to B-LTA; or a signature field with a personal certificate. |
| Qualified (QES) | Signature field signed with a qualified certificate on a smart card in a PDF reader. |
Signatures from the CodeB signing service reach PAdES B-LTA by default: an RFC 3161 timestamp (B-T), embedded certificates and revocation data (B-LT) and an archive timestamp (B-LTA). The service reports the level it delivered; anything below the minimum level you set is sealed by the organisation instead. If the timestamp service is down, the server signs again at B-B with the person's own key, provided your minimum level allows B-B.
The signing service is the CodeB remote signature server; its interface is documented in the CSC v2 API. Details: signatures on form-provider.com.
Verified identity instead of typed-in names
A form can require sign-in through www.aloaha.com, which verifies EU Digital Identity Wallet presentations with OpenID4VP and DCQL, for SD-JWT VC and ISO mdoc credentials under the HAIP profile. The form is then pre-filled with the verified data the person chooses to share, and the PDF records how they signed in. Passkeys and OpenID Connect accounts work the same way.
Under eIDAS 2.0 (Regulation (EU) 2024/1183) every member state must offer a wallet by the end of 2026, and regulated private services such as banks, telecom, energy, transport, health and education must accept it by the end of 2027. See the wallet verifier and EU Wallet sign-in.
ZUGFeRD and XRechnung from a web form
An invoice form produces a ZUGFeRD / Factur-X invoice (PDF/A-3 with embedded XML) or an XRechnung according to EN 16931. Businesses without invoicing software can meet the German e-invoicing mandate this way. Software can do the same through POST /api/v1/einvoices. To build e-invoicing into your own application instead, use the ZUGFeRD Pro SDK.
Connect forms to your own systems
| Interface | What it does |
|---|---|
| REST API | OpenAPI 3.1, OAuth 2.0 bearer tokens from your OpenID Connect server. List forms and fields, validate, fill and submit forms. |
| Webhooks | Every submission as JSON to your HTTPS endpoint (submission.created, optionally with the sealed PDF), signed per Standard Webhooks with HMAC-SHA256, retried after 1 min, 5 min, 30 min, 2 h, 6 h and 12 h. |
| Prefill links | POST /api/v1/forms/{formId}/prefill returns a link that opens the form with your values; valid 7 days by default, at most 90. |
| E-invoices | POST /api/v1/einvoices: seller, buyer, lines and VAT as JSON in, ZUGFeRD PDF/A-3 or XRechnung out. |
| Usage | GET /api/v1/usage and X-RateLimit-* headers show rate limits and the daily submission cap. |
Documentation: REST API and webhooks with signature checks in Node.js, Python, C# and PHP.
Built to hold as little data as possible
- No submission database: each submission is delivered as sealed PDF plus XML and not kept on the server.
- Optional encrypted archive, only if you switch it on.
- Spam protection without third-party services or tracking.
- Wallet sign-in shares only the attributes the person agrees to.
- Run it in your own data centre, or hosted by Aloaha.
Where a signed form replaces paper
Hotel registration
A digital registration form (Meldeschein) that guests fill in on their phone, pre-filled from their wallet and signed by hand.
Applications and onboarding
Customer, member or staff applications with verified identity, attachments and a signed PDF for the file.
Consents and confirmations
Consent forms, delivery and visit confirmations signed at the counter or on site.
Invoices without software
Small businesses and associations issue ZUGFeRD or XRechnung invoices from a web form.
Nine live sample forms, including the hotel registration and a ZUGFeRD invoice, are on form-provider.com, usable without an account.
On your server or hosted
| Option | Details |
|---|---|
| Own data centre | Windows Server with IIS and .NET Framework 4.7.2; rented server licence with free updates. |
| Hosted | Operated by Aloaha. |
| Trial | Free for 30 days with three example forms; free test credentials for the online server on request. |
| Price | On request from info@aloaha.com. |
Frequently asked questions
What is the CodeB eForms Server?
A web-based form server by Aloaha Limited (Malta, EU), formerly called Aloaha eForms Server. You design a form once in the browser and publish it as a fillable PDF, responsive HTML and static HTML. Every submission becomes a sealed PDF plus XML, delivered by e-mail.
Where are form submissions stored?
The server keeps no submission database. Each submission is delivered by e-mail as a sealed PDF plus XML, and optionally sent to your system by webhook. An encrypted archive can be switched on if you need one.
Which eIDAS signature levels are possible?
A handwritten signature in the form is a simple electronic signature, sealed by the server. Forms with sign-in can be signed with the person's own key at the CodeB server as an advanced electronic signature (PAdES up to B-LTA, not qualified). Qualified signatures are made in signature fields with a qualified certificate on a smart card.
Does the eForms Server accept the EU Digital Identity Wallet?
Yes. Forms can require sign-in through www.aloaha.com, which verifies wallet presentations with OpenID4VP and DCQL (SD-JWT VC and ISO mdoc, HAIP profile). The form is then pre-filled with the verified data the person shares.
Can a form create a ZUGFeRD or XRechnung invoice?
Yes. Invoice forms produce ZUGFeRD / Factur-X (PDF/A-3 with embedded XML) or XRechnung according to EN 16931, without your own invoicing software. The REST API offers the same through POST /api/v1/einvoices.
Is there an API?
Yes, a REST API described in OpenAPI 3.1 with OAuth 2.0 bearer tokens. It lists forms and fields, validates, fills and submits forms, creates prefilled links and e-invoices, and manages webhooks signed according to Standard Webhooks (HMAC-SHA256).
How do you stop spam without a CAPTCHA?
An invisible check built into the server keeps bots out. Visitors never click pictures or type distorted letters, and no third-party CAPTCHA service sees them.
Can we run it on our own server?
Yes. The eForms Server runs on Windows Server with IIS and .NET Framework 4.7.2 in your own data centre, with free updates for rented servers. Alternatively Aloaha hosts it for you.
How can I try it?
Try the live sample forms on form-provider.com without an account, or ask for a free 30-day trial with three example forms. Prices are on request from info@aloaha.com.
Try the CodeB eForms Server
Fill in a sample form, ask for free test access or read the full feature list on form-provider.com.
Sample forms ↗ Free trial ↗ form-provider.com ↗