Tally
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Belgian bootstrapped form builder (Tally BV, Ghent) with free unlimited forms, EU-only hosting claim, and 500k+ teams using it.
Tally offers EU hosting in Belgium, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Forms & surveys.
Assessment notes
Bootstrapped Belgian BV (Tally BV, Ghent, CBE 0776.979.007) founded by Marie Martens and Filip Minev, with a publicly-linked DPA and a generous free-unlimited tier; the GDPR sub-processor list (verified 2026-06) shows Tally hosts customer data on Google Cloud (Belgium region), a US-owned hyperscaler as the core host, alongside Cloudflare, SendGrid, Stripe and other US processors, raising CLOUD Act exposure to material despite the EU data region and EU ownership.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 15 · 11 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Tally
Tally is a Belgian bootstrapped form builder operated by Tally BV (Sint-Pietersnieuwstraat 11, 9000 Ghent; Belgian enterprise number 0776.979.007), founded in 2020 by Marie Martens and Filip Minev. The product is a Notion-style form-and-survey builder with a free-unlimited tier, conditional logic, e-signatures, file uploads, payment processing, multi-step workflows, and integrations with Notion, Google Sheets, Airtable, Slack, Make, n8n, Zapier, and webhooks. The company reports more than 500,000 teams using the platform (including Notion, Make, Rakuten, and Glovo) and has scaled almost entirely through bootstrapped growth without venture capital.
Compliance posture is solid for a small EU vendor. The marketing site states "Made and hosted in the EU 🇪🇺," the privacy policy locates the data controller as Tally BV in Ghent and confirms data is stored on "high-security servers within the European Union," and the Data Processing Agreement is publicly accessible at /help/data-processing-agreement without account or signature gating. Form data is encrypted in transit and at rest, no cookie-tracking is used on tally.so, and customers retain GDPR rights of access, rectification, erasure, restriction, portability, and objection. The DPA's own sub-processors annex is still marked N/A and its Article 9 discloses only categories (hosting service providers, payment service providers, communication service providers), but the named sub-processor table now lives on a separate public page, the GDPR help article, and that table names Google Cloud, Belgium region, as the host for form data and storage. Where Tally falls short for procurement-grade buyers is therefore no longer disclosure but the chain itself: the core host is a US-owned hyperscaler even in an EU region, which is what sets the exposure flag: Material.
Pricing in EUR is straightforward: Free covers unlimited forms and submissions within fair-use guidelines (45+ languages, payment processing, signatures, file uploads, conditional logic, integrations); Pro is €20/month adding custom domains, removed Tally branding, team collaboration, custom CSS, and form analytics; Business is €65/month adding data-retention controls, email verification, and 90-day version history. Best fit: indie makers, EU SMBs, agencies, and startups that want a free Typeform alternative from a Ghent-based vendor with a public DPA and a published processor table. Buyers who must keep form data off a US-owned hyperscaler should weigh the Google Cloud dependency before signing.
Sub-processor map · 15
-
Cloudflare USUnited States
File-upload storage (opt-in, EU region), DNS, and bot protection
-
Google AI Studio USUnited States
AI assistant (opt-in; data hosted in Belgium region)
-
Google Cloud USUnited States
Hosting and storage (data hosted in Belgium region)
-
Metabase USUnited States
Analytics (Germany region)
-
Mixpanel USUnited States
Analytics
-
OpenAI USUnited States
Abuse detection
-
SendGrid USUnited States
Email / form notifications (opt-in)
-
Sentry USUnited States
Error monitoring
-
Stripe USUnited States
Payments for payment forms (opt-in)
-
Tinybird USUnited States
Analytics (UK region)
-
UserJot USUnited States
Customer feedback management
-
Cello EUGermany
Referral program (opt-in)
-
Missive non-USCanada
Customer support
-
Plausible EUEstonia
Privacy-friendly analytics
-
turbopuffer non-USCanada
Search (Belgium region)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Cloudflare | United States | File-upload storage (opt-in, EU region), DNS, and bot protection | US |
| Google AI Studio | United States | AI assistant (opt-in; data hosted in Belgium region) | US |
| Google Cloud | United States | Hosting and storage (data hosted in Belgium region) | US |
| Metabase | United States | Analytics (Germany region) | US |
| Mixpanel | United States | Analytics | US |
| OpenAI | United States | Abuse detection | US |
| SendGrid | United States | Email / form notifications (opt-in) | US |
| Sentry | United States | Error monitoring | US |
| Stripe | United States | Payments for payment forms (opt-in) | US |
| Tinybird | United States | Analytics (UK region) | US |
| UserJot | United States | Customer feedback management | US |
| Cello | Germany | Referral program (opt-in) | EU |
| Missive | Canada | Customer support | non-US |
| Plausible | Estonia | Privacy-friendly analytics | EU |
| turbopuffer | Canada | Search (Belgium region) | non-US |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Tally
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Germany · €63/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Netherlands · €5.42/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Findmind
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Formbricks
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€63/mo |
Formdesk
Netherlands
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€5.42/mo |