Tripetto
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Dutch form builder with hosting freedom: free Studio cloud, WordPress plugin, and FormBuilder SDK that lets you self-host data.
Tripetto is a European service hosted in the Netherlands, with at most minor, transient US exposure under the CLOUD Act. It is listed under Forms & surveys.
Assessment notes
Dutch open-source-kernel form builder shipping in three flavours, Studio (free cloud), WordPress Plugin, and FormBuilder SDK with self-hosting, that explicitly markets 'hosting freedom' so the customer controls where data lives; the self-host path is procurement-friendly, but the Studio cloud product does not publicly disclose its hosting provider or a unified DPA, and DPA/sub-processors/security URLs were not resolvable at audit; CLOUD Act flag is set defensively to minor pending vendor disclosure.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Tripetto
Tripetto is a Dutch form-and-survey builder centred on the principle of "hosting freedom": customers can run forms on Tripetto's cloud (Studio), inside a self-hosted WordPress plugin, or via the FormBuilder SDK with full self-hosting where survey data never reaches Tripetto servers at all. The product positions itself against Typeform, SurveyMonkey, Google Forms, WPForms, Gravity Forms, and Contact Form 7, and ships with a "magnetic storyboard" form-design canvas, three rendering modes (Autoscroll, Chat, Classic), conversational logic primitives, and 1,000+ automation connectors (Slack, Zapier, Make).
For procurement-grade EU buyers the structurally interesting feature is the hybrid hosting model. The FormBuilder SDK is sold as a developer licence (from US$10,800/year, ~€10,000) and lets the customer host all form data on infrastructure of their choosing. Running it on Hetzner, OVH, Scaleway, or any other EU-incorporated host gives the customer full control with no CLOUD Act exposure. The WordPress plugin operates on the customer's WordPress installation, with the same self-control properties. The Studio (cloud) product is where transparency drops off: the dedicated /privacy/, /security/, /dpa/, /about/, /terms/ and /legal/ URLs all still return 404, the footer carries no legal section, no imprint and no company number, and the only hosting statement anywhere on the public surface is a line in the pricing FAQ saying Studio data is encrypted and stored in data centres in Western Europe, which names neither a country nor a provider. The cloud Studio therefore carries a defensive minor CLOUD Act flag pending vendor outreach.
Pricing for Studio is freemium: free accounts have all core features with Tripetto branding shown on rendered forms, and the single paid option is now "Unlock All" at €999 per year, paid annually, covering every form in the account. The one-time "Unlock 1" purchase per form has been withdrawn, so the entry cost is no longer a one-off. Best fit: developers, agencies, and EU buyers who want full control over form-data residency. The SDK and WordPress plugin paths give a procurement-grade story even though the Studio cloud product needs vendor outreach to verify. The MVP shortlist noted "open-source kernel + cloud"; the open-source claim refers to embeddable runners and the SDK rather than a fully open-source server.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Tripetto
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Germany · €63/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Netherlands · €5.42/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Findmind
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Formbricks
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€63/mo |
Formdesk
Netherlands
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€5.42/mo |