Formbricks
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
German open-source experience-management platform (Formbricks GmbH, Kiel) for link, website and in-product surveys; AGPLv3, self-hostable.
Formbricks offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Forms & surveys.
Assessment notes
German GmbH (Kiel) shipping an AGPLv3 open-source survey/forms platform with a publicly-downloadable DPA (sub-processors in Annex IV) and SOC 2 Type II, but the managed Formbricks Cloud runs on AWS in Germany for database + email at rest, with Stripe (US), Google Cloud, Sentry, PostHog EU and, since mid-2026, Cloudflare Inc. as a global CDN and reverse proxy alongside it, and US VC (OSS Capital) on the cap table, EU-headquartered but US-VC-funded with material CLOUD Act exposure for the managed cloud; self-hosting the AGPLv3 build on EU infrastructure removes the AWS and US sub-processor exposure entirely.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 8 · 6 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: Yes
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Formbricks
Formbricks is a German open-source experience-management platform operated by Formbricks GmbH (Kuhnkestr. 6, 24118 Kiel), founded in 2022 by Johannes Dancker and Matti Nannt. It positions itself as the open-source Qualtrics alternative and covers link surveys, website and in-product (in-app) surveys, and email-embedded feedback forms, with event-triggered targeting, user segmentation, conditional logic, multi-language surveys, file uploads, webhooks, and SDKs. The full core application is licensed under AGPLv3 on GitHub and is fully self-hostable.
For an EU-sovereignty audit the ownership tier is eu_hq_us_funded: Formbricks is a German GmbH but is backed by OSS Capital (a US open-source-focused VC), Flex Capital, and the GitHub Accelerator, with angels including Tom Preston-Werner (GitHub) and Peer Richelsen (Cal.com). The managed Formbricks Cloud (app.formbricks.com) is hosted in Frankfurt, Germany on Amazon Web Services, which handles the database and email at rest. The DPA is publicly downloadable without signup and lists its Annex IV sub-processors: AWS (DE region), PostHog (DE region), Stripe (US), Sentry (DE region), Brevo (EU), Google Cloud (EU, opt-in and stated not to touch respondent data), Plain (UK, customer support), and Cloudflare, Inc., which now sits in front of the whole application as CDN, reverse proxy and DDoS protection; Chatwoot has been dropped. No AI provider, no captcha vendor and no separate file-upload storage provider appears anywhere in the annex, which is unusual in this category. The company holds SOC 2 Type II and states ISO 27001 is in progress. Per the directory's strict CLOUD Act stance (provider parent jurisdiction matters more than data-centre region), AWS at rest plus the US sub-processors plus US-VC ownership make this material CLOUD Act exposure for the managed cloud. Self-hosting the AGPLv3 build on EU-incorporated infrastructure (Hetzner, OVHcloud, Scaleway) removes the AWS and US sub-processor exposure entirely, making the customer the sole data controller.
Pricing: a free Hobby tier (250 responses/month, 1 workspace); Pro at US$74/month for 2,000 responses and 3 workspaces; Scale at US$325/month for 5,000 responses and 5 workspaces. Both paid figures are monthly-billing rates, with annual offered as two months free, and the default cloud region is Germany. Self-hosting is free under AGPLv3. Best fit: privacy-conscious product teams and EU developers replacing Qualtrics or Qualaroo for in-product surveys, or wanting a GDPR-compliant, self-hostable feedback layer. The self-host path is the procurement-grade option.
Sub-processor map · 8
-
AWS USUnited States
Database and email delivery (data storage; Germany)
-
Cloudflare USUnited States
CDN, reverse proxy, DDoS protection and application security (global)
-
Google Cloud USUnited States
Smart functionality (opt-in; does not touch respondent data; EU)
-
PostHog EU USUnited States
Product analytics (anonymized IP and device information; Germany)
-
Sentry USUnited States
Error tracking and diagnostics
-
Stripe USUnited States
Payment processing
-
Brevo EUFrance
Marketing/communication and admin notifications
-
Plain non-USUnited Kingdom
Customer support (UK; replaced Chatwoot, removed from Annex IV before 2026-08)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| AWS | United States | Database and email delivery (data storage; Germany) | US |
| Cloudflare | United States | CDN, reverse proxy, DDoS protection and application security (global) | US |
| Google Cloud | United States | Smart functionality (opt-in; does not touch respondent data; EU) | US |
| PostHog EU | United States | Product analytics (anonymized IP and device information; Germany) | US |
| Sentry | United States | Error tracking and diagnostics | US |
| Stripe | United States | Payment processing | US |
| Brevo | France | Marketing/communication and admin notifications | EU |
| Plain | United Kingdom | Customer support (UK; replaced Chatwoot, removed from Annex IV before 2026-08) | non-US |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Formbricks
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Netherlands · €5.42/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
-
Belgium · €21/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Findmind
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Formdesk
Netherlands
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€5.42/mo |
Formspark
Belgium
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€21/mo |