Forms & surveys
Form and survey platforms collect structured data from respondents via web forms, questionnaires, and feedback tools. For EU buyers, the critical question is whether collected responses — often personal data — are stored and processed by an EU-owned operator under EU law. Top-rated EU options on EU Vetted include Formdesk (Netherlands, 5/5) and LimeSurvey (Germany, 5/5).
Form and survey platforms provide the tools to collect structured input from users, customers, employees, or research participants. The category covers simple contact or registration forms, multi-page surveys with skip logic, NPS and customer satisfaction tools, quiz builders, and payment-enabled order forms. More sophisticated platforms add analytics dashboards, respondent tracking, partial-response saving, and integration with CRM or data warehouse pipelines. The range spans open-source self-hosted options (LimeSurvey), managed cloud builders (Formdesk, Tally, Survicate), and conversational survey formats (Typeform, Tripetto).
For EU buyers, form and survey tools deserve close scrutiny because the data they collect is often directly personal: names, email addresses, health information, employment details, or commercially sensitive feedback. Under GDPR, the controller — the organisation running the form — is responsible for establishing a legal basis for collecting each field, but the platform acts as a data processor and must have appropriate technical and organisational measures in place. If the platform is a US-incorporated or US-owned company, the CLOUD Act can in principle compel production of response data regardless of EU storage. EU-owned operators such as Formdesk (Netherlands, 5/5), LimeSurvey (Germany, 5/5), and Tally (Belgium, 4/5) are not subject to that direct exposure. Typeform (Spain, 3/5) and Formbricks (Germany, 3/5) are EU-headquartered but carry US-investor ownership signals.
The listings below show each product's country of incorporation, ownership signal, hosting country, and EU Vetted's editorial compliance score on a 1–5 scale. Use the filters to narrow by ownership signal, by self-hosted availability, or by use case if you need a specialist tool for NPS, employee surveys, or research questionnaires.
-
FormdeskVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Dutch enterprise forms platform (Innovero Software Solutions B.V., Wassenaar, 20+ years), NL-only hosting.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
NL · 0 sub-procs Open ↗ -
LimeSurveyVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
German GPL-licensed open-source survey platform (LimeSurvey GmbH Hamburg, project since 2003), self-host first.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
DE · 0 sub-procs Open ↗ -
TallyVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Belgian bootstrapped form builder (Tally BV, Ghent) with free unlimited forms, EU-only hosting claim, and 500k+ teams using it.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗ -
FindmindVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Swiss research-focused online survey tool operated by Fabian Keller since 2009; used by University of Zurich researchers.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other This listing Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗ -
FormbricksVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
German open-source experience-management platform (Formbricks GmbH, Kiel) for link, website and in-product surveys; AGPLv3, self-hostable.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
DE · 0 sub-procs Open ↗ -
FormsparkVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Developer form-backend (form-to-email API) flagged as Swiss; 20k+ customers, one-time-payment bundles, no UI.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other This listing Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗ -
SurvicateVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Warsaw-based Polish in-product survey and NPS platform on AWS-EU, ISO 27001 + SOC 2 + HIPAA-aligned.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗ -
TripettoVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Dutch form builder with hosting freedom — free Studio cloud, WordPress plugin, and FormBuilder SDK that lets you self-host data.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗ -
TypeformVERIFIED SIGNALSJurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
Barcelona-headquartered Typeform SL but heavily US-VC-funded with a San Francisco Typeform Inc and AWS hosting; listed with procurement warning.
OWNERSHIPWhere ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
CLOUD ACT EXPOSUREHow exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
0 sub-procs Open ↗
| Compare | Owner | CLOUD Act | Cert. | Sub-procs | ||||
|---|---|---|---|---|---|---|---|---|
|
Formdesk
Dutch enterprise forms platform (Innovero Software Solutions B.V., Wassenaar, 20+ years), NL-only hosting.
|
WASSENAAR · NL
Netherlands
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
LimeSurvey
German GPL-licensed open-source survey platform (LimeSurvey GmbH Hamburg, project since 2003), self-host first.
|
HAMBURG · DE
Germany
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Tally
Belgian bootstrapped form builder (Tally BV, Ghent) with free unlimited forms, EU-only hosting claim, and 500k+ teams using it.
|
—
Belgium
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Findmind
Swiss research-focused online survey tool operated by Fabian Keller since 2009; used by University of Zurich researchers.
|
—
Switzerland
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Formbricks
German open-source experience-management platform (Formbricks GmbH, Kiel) for link, website and in-product surveys; AGPLv3, self-hostable.
|
DE
Germany
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
SOC 2
|
0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Formspark
Developer form-backend (form-to-email API) flagged as Swiss; 20k+ customers, one-time-payment bundles, no UI.
|
—
Switzerland
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Survicate
Warsaw-based Polish in-product survey and NPS platform on AWS-EU, ISO 27001 + SOC 2 + HIPAA-aligned.
|
—
Poland
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
ISO/IEC 27001
SOC 2
|
0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Tripetto
Dutch form builder with hosting freedom — free Studio cloud, WordPress plugin, and FormBuilder SDK that lets you self-host data.
|
—
Netherlands
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
— | 0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ | |
|
Typeform
Barcelona-headquartered Typeform SL but heavily US-VC-funded with a San Francisco Typeform Inc and AWS hosting; listed with procurement warning.
|
—
Spain
|
OWNERSHIP
Where ultimate control over the operating company sits.
|
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
|
SOC 2
|
0 |
VERIFIED SIGNALS
Jurisdiction
Transparency
|
Open ↗ |