LimeSurvey
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
German GPL-licensed open-source survey platform (LimeSurvey GmbH Hamburg, project since 2003), self-host first.
LimeSurvey is a European service hosted in Germany, with at most minor, transient US exposure under the CLOUD Act. It is listed under Forms & surveys.
Assessment notes
LimeSurvey GmbH (Hamburg, Germany; founded August 2015, but the open-source LimeSurvey project itself dates to 2003 by Carsten Schmitz who remains Founder + CTO) is one of the longest-running open-source survey platforms in Europe, GPL-2.0+ licensed with source on GitHub, deployable on customer infrastructure (PHP + MySQL/PostgreSQL/SQLite/MSSQL) for full sovereignty; also offered as managed LimeSurvey Cloud, which the privacy notice places on Hetzner Online GmbH hardware in Gunzenhausen with the data stored inside Germany, so the survey-data path is EU-owned and EU-hosted end to end; CLOUD Act exposure is minor rather than none only because Google Ireland Limited is named as a recipient for website analytics and A/B testing, which never touches survey data, and the DPA for the managed cloud tier is not publicly accessible without an account; the self-host path on EU infrastructure removes both gaps entirely.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: Not assessed
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About LimeSurvey
LimeSurvey is one of the longest-running open-source survey platforms in Europe. The project was started by Carsten Schmitz in 2003, and the commercial entity LimeSurvey GmbH (Hamburg, Germany) was founded in August 2015 to better coordinate development and provide commercial services around the open-source codebase. Schmitz is credited as Founder and CTO, although the current legal notice names Jory Nagel as sole managing director. The platform is licensed under GPL v2 (or later) with source on GitHub, runs on PHP with MySQL / PostgreSQL / SQLite / MSSQL backends, and is widely deployed in EU universities, public administrations, and research institutions. The LimeSurvey Cloud managed tier is the commercial alternative to self-host: the privacy notice places it on Hetzner Online GmbH hardware in Gunzenhausen with the data stored inside Germany, under an Art. 28 order-processing agreement, and the entry Basic plan is €34/month billed monthly, with Expert at €29/month and Business at €75/month on annual commitments and a free plan available on sign-up. Two things keep the hosted tier short of a clean sheet: the customer's DPA is stored inside the account rather than published at a public URL, and Google Ireland Limited is a named recipient for the vendor's website analytics and A/B testing, which never touches survey data but does put one US-owned processor in the chain: Minor.
Sub-processor map · none disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of LimeSurvey
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Germany · €63/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Netherlands · €5.42/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Findmind
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Formbricks
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€63/mo |
Formdesk
Netherlands
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€5.42/mo |