---
title: "Report form"
description: "A link that lets staff, suppliers or customers report an incident or a security concern without a login. Each report becomes an alert in Incident Management."
---

The **Report form** alert source gives you a link to a simple web form. Anyone you hand the link to, staff, suppliers, customers, can report something that looks wrong without an account and without technical knowledge. Each report opens an alert in the source's team, with the same routing, grouping and escalation as any other source.

It covers the requirement of NIS-2 Implementing Regulation (EU) 2024/2690, Annex 3.3, that staff and relevant third parties can report incidents and suspicious events.

## 1. Create the source

Go to **Incident Management → Alert Sources → New**, pick **Report form**, name it and choose the team. On the success screen, copy the link. It has the shape `https://uptimeify.io/report/<token>` (the German form: `/de/report/<token>`) and is shown once. If you lose it, rotate the token from the source's **Settings** tab; the old link keeps working for 7 days.

Share the link wherever people will find it: the intranet, the supplier portal, your security policy, an email signature.

## 2. What the form asks

| Field | Required | Becomes |
|---|---|---|
| What happened? | Yes, 10 to 4000 characters | The alert title (its first eight words) and the `description` field |
| Since when? | No, free text | The `since` field |
| Who is affected? (nobody, a few, many) | No | The suggested severity and the `impact` field |
| Do you suspect an attack? (yes, no, don't know) | No, defaults to "don't know" | The `suspectedAttack` field |
| Name, email | No | Only the alert's raw payload, under `reporter` |

The page shows only your organization's name. It is not indexed by search engines and sends no referrer.

## Severity

The severity is a suggestion from the reporter's own estimate, your team re-rates it during triage:

| Who is affected? | Severity |
|---|---|
| Nobody | `sev4` |
| A few people | `sev3` |
| Many people | `sev2` |
| Not answered | `sev3` |

Every report opens its own alert (`dedupKey` `form:<random id>`), so two people reporting the same thing are two voices, not a duplicate.

## Abuse protection

The link is public by design, so the form carries the same protection as other public forms on uptimeify.io: a hidden honeypot field, a minimum fill time, and a quota of 3 reports per sender per hour and 30 reports per form per hour. The sender's IP address is only used as a daily changing pseudonym for the quota and is not stored with the report. A discarded submission gets the same confirmation as an accepted one.

The form's link only works with the form. The [webhook endpoint](/api/incident-management/ingest-webhook) answers a form token with `404`, and HMAC or Bearer authentication do not apply to a form source.

## Personal data

Name and email are optional and the form says so. They stay in the alert's raw payload, which is cleared after 90 days like every other source's raw payload. The fields `description`, `since`, `impact` and `suspectedAttack` are part of the alert like any mapped field. For the reports, your organization is the controller and Uptimeify processes them on your behalf under the data processing agreement.

## Mapping

A form source always has this fixed mapping; a `payloadMapping` sent when creating it is ignored. Test it with [test-mapping](/api/incident-management/alert-sources-api) by passing a `payload` (a form source has no sample):

```json
{
  "title": "title",
  "severity": "severity",
  "severityMap": { "sev1": "sev1", "sev2": "sev2", "sev3": "sev3", "sev4": "sev4" },
  "dedupKey": "dedupKey",
  "custom": {
    "description": "description",
    "since": "since",
    "impact": "impact",
    "suspectedAttack": "suspectedAttack"
  }
}
```