Typeform
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Barcelona-headquartered Typeform SL but heavily US-VC-funded with a San Francisco Typeform US LLC and AWS hosting; listed with procurement warning.
Typeform offers EU hosting in the United States, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Forms & surveys.
Assessment notes
Barcelona-headquartered (Typeform SL) but the cap table is heavily US-VC (General Atlantic, Index, Point Nine, Connect Ventures, Top Tier Capital Partners, GP Bullhound, Teamworthy, Trium) on top of a Sofina-led Series C, a Typeform US LLC presence in San Francisco contracts non-EEA customers, and customer data sits on AWS, EU-headquartered but US-VC-funded, with a US legal entity and material CLOUD Act exposure via AWS at rest; the DPA is publicly readable at /legal/data-processing-agreement with no login or sales gate, and it links a public sub-processor article in the help centre, but Typeform offers no EU data-residency option.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: No
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Typeform
Typeform is a Barcelona-headquartered conversational form and survey platform founded in 2012 by David Okuniev and Robert Muñoz, operated by Typeform SL with a US office and a Typeform US LLC entity in San Francisco. The product builds forms, surveys, quizzes, polls, and conversational onboarding flows with 500+ integrations (Slack, Mailchimp, Klaviyo, Zapier, HubSpot, Salesforce, etc.), an AI form builder, and a strong design-driven UX that made the product a category-defining brand. The company markets enterprise penetration as "95% of the Fortune 500" and reports total funding of around US$193M across multiple rounds.
For an EU-sovereignty audit, Typeform is the canonical example of "Spanish HQ does not equal EU-controlled". The 2022 Series C raised US$135M led by Sofina (a Belgian listed holding) with significant participation from General Atlantic (US PE), Index Ventures (UK/US), Point Nine (DE), Connect Ventures (UK), Top Tier Capital Partners (US), GP Bullhound (UK), Teamworthy Ventures (US), and Trium Venture Partners, a cap table that is heavily US-VC-weighted alongside European and UK investors. A separate US legal entity (Typeform US LLC, San Francisco) contracts non-EEA customers, and customer form data is hosted on Amazon Web Services in the United States under Standard Contractual Clauses, with no EU data-residency option offered. Per the directory's strict CLOUD Act stance, provider parent jurisdiction matters more than data-centre region (Schrems II / Microsoft Ireland v US), the AWS dependency plus the US Inc plus the US-VC ownership translate to material CLOUD Act exposure and an eu_hq_us_funded ownership flag. The listing carries a procurement warning: EU-headquartered but not EU-controlled, hosted on a US-owned hyperscaler.
Pricing is quoted in USD with no EUR list price published: the Free tier includes 100 responses a month for one user, Basic is US$28/month billed monthly or US$25/month billed annually, and Plus, Business, Talent, Growth Flow and Enterprise sit above it. SOC 2 is attested at the company level; ISO 27001 is commonly cited but not directly verified, and typeform.com/security/ now returns 404, so there is no first-party security page to check it against. Best fit: marketing teams and customer-research teams who specifically want the Typeform UX and can accept a US-VC-funded vendor on AWS. Procurement-led EU-only buyers should compare Tally (BE, EU-owned, public DPA, form data on Google Cloud in Belgium) for free unlimited forms, Survicate (PL) for in-product surveys, or Formdesk (NL, ISO 27001 and NEN 7510, Netherlands-only hosting) for enterprise forms, all listed alongside in this category.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Typeform
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Germany · €63/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Netherlands · €5.42/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Findmind
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Formbricks
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€63/mo |
Formdesk
Netherlands
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€5.42/mo |