Forms & Surveys
Fillout
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Restly, Inc. · www.fillout.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Fillout at a glance
- Vendor
- Restly, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 28 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 28 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 28 Oct 2026
- Panel verdict
- The AI panel rates Fillout 3/5, the mean of 6 judges. Fillout is a form and survey builder operated by Restly, Inc., a Delaware corporation, with a free tier of unlimited forms and seats and 1000 responses per month. how scores are made
- As of
- Vendor pages captured 28 Oct 2026; evaluated by the panel 29 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Fillout is a form and survey builder operated by Restly, Inc., a Delaware corporation, with a free tier of unlimited forms and seats and 1000 responses per month. Strongest is collection and workflows: sharing by public link, embed, email and QR code, file uploads, Stripe payments at 0% added fees, Slack and Teams notifications, webhooks and a REST API in the free plan, and workflows adding follow-up emails, approvals and AI routing. Form building sits at 6-7 on a drag-and-drop editor with 50+ question types and hundreds of templates. Weakest is analysis and reporting, flat at 4: responses can be viewed, filtered, charted and exported to CSV, with no public information on cross-tabulation, shareable dashboards or exports beyond CSV. Judges genuinely split on consent and data protection and sovereignty: on consent they weigh the same evidence differently — a published DPA with SCCs and no public information on an anonymous mode that drops IP addresses — while sovereignty turns on the United States as the default region, with EU storage for respondent data only on request.
Speaks for it
- Sharing by public link, embed, email and QR code, with file uploads, Slack and Teams notifications, and a REST API included in the free plan
- Stripe payments inside forms at 0% added fees, even on the free tier, plus electronic signatures on consent forms
- A standard DPA available on any plan that incorporates the EU Standard Contractual Clauses and UK Addendum, with an EU privacy representative named
- Deletion of a form, an individual response or the account completes within 45 days, backups included
- Free tier with unlimited forms and seats, 1000 responses per month, no credit card, and no per-seat charges
Held against it
- Analysis and reporting scores 4, with no public information on cross-tabulation, shareable dashboards or exports beyond CSV
- We found no public information on an anonymous mode that drops IP addresses, on consent or privacy-notice fields, or on automatic retention periods
- The default storage region is the United States, and EU hosting covers respondent data only, from the Team plan upward by contacting support
- We found no public information on managed invitation lists with reminders and unique links, response quotas with closing rules, or offline collection
- The captured pricing pages state no figures for the paid plans, so an annual cost cannot be computed from them
Best for
- You need operational forms — registrations, orders, workshop intake — that non-technical staff build with drag-and-drop editing, conditional questions and custom branding
- You collect payments or signatures inside the form itself, since Stripe runs at 0% added fees and electronic signatures are documented for consent forms
- You want responses pushed automatically to Google Sheets, Slack, HubSpot, Salesforce and 50+ other apps, with webhooks and a REST API included in the free plan
- You want to start free — unlimited forms and seats, 1000 responses per month — before committing to a paid plan
Avoid if
- You need cross-tabulation, significance testing, shareable dashboards or exports beyond CSV, since analysis stops at charts and a per-form CSV export
- You must certify respondent anonymity (no IP capture) or automatic retention deletion to a review board — ask the vendor: the public pages we read do not show it
- Your procurement requires an EU contracting entity or EU-default hosting — the operator is a Delaware corporation and the default region is the United States
- You need submission data to stay in the EU end to end — the published subprocessor list shows email via Postmark and payments via Stripe in the US, and Cloudflare worldwide, flagged as able to process submission data
The scores
| Criterion | Panel median |
|---|---|
| Form & survey building | 3 of 5 |
| Distribution, response collection & workflows | 3.5 of 5 |
| Survey analysis & reporting | 2 of 5 |
| Consent, GDPR & respondent data | 2.5 of 5 |
| Hosting choice, teams & portability | 3.5 of 5 |
| European sovereignty | 3 of 5 |
Form & survey building
Show reasoningHide reasoning
How this is scored
What can be built without code: question and field types, conditional logic and branching, piping and hidden fields, calculations, multi-page forms and progress, templates, design and branding, multiple languages, and accessible output for respondents.
0 — Not a form or survey builder; questions cannot be authored in the product.
3 — A builder with the common question types and a few templates; logic, branding or languages are basic or not described.
5 — A drag-and-drop builder with a wide range of question types, conditional logic that shows, hides or skips questions, multi-page forms, a template library, and the customer's logo, colours and fonts.
8 — Advanced logic with piping, hidden fields, calculations and scoring, randomisation, surveys translated into several languages from one master, reusable question libraries, custom CSS or themes, and accessible forms with a named standard (WCAG 2.1 AA or BITV) stated.
10 — Best-in-class authoring: complex research designs (loops, quotas in logic, conjoint or MaxDiff), versioned forms with change history, a published accessibility conformance report, and every element of a form available through the API.
The Market Researcher
A genuine drag-and-drop builder with 50+ question types, conditional questions, page jumps, scoring and calculations, multi-step forms, 415+ templates browsable by category and industry, custom fonts, logo, colours and CSS, and an AI builder that authors surveys with NPS and ratings from plain words. For my multilingual waves, though, we found no public information on survey translations from one master, quotas inside the logic, randomisation, or a stated accessibility standard, which is what would lift this higher. 1 8 9 10 13
The Operations Manager
A colleague could genuinely build our registration or damage-report forms without IT: a full drag-and-drop editor, 50+ field types, conditional questions, page jumps, scoring and calculations, multi-step forms, over 415 templates, and custom fonts, logo, colours and CSS. We found no public information on piping, multilingual master forms or a stated accessibility standard, which keeps it below the advanced authoring tier. 1 3 9 10
The HR Lead
A full drag-and-drop editor with 50+ question types, conditional questions with page jumps, scoring and calculations, multi-step forms, custom fonts, logo, colours and custom CSS, and a library of more than four hundred templates. We found no public information on piping, hidden fields, randomisation, multilingual surveys from one master, or accessibility to a named standard — the last matters when the works council reviews the instrument. 1 3 8 9 10 13
The Academic Researcher
A drag-and-drop editor with 50+ question types, conditional questions, page jumps, scoring and calculations, 415+ browsable templates and theming with my own fonts, logo, colours and custom CSS is a serious authoring environment, and consent forms with electronic signatures are explicitly named as a use case. But we found no public information on randomisation of items, surveys translated from one master, or a stated accessibility standard — the three things my board asks about first. 1 3 8 9 10
The Data Protection Officer
The builder is real and well documented: drag-and-drop editing, more than fifty question and field types, conditional questions, page jumps, scoring, calculations, multi-step forms, hundreds of templates, and branding down to custom CSS and imported PDFs. We found no public information on piping, hidden fields, randomisation, running several languages from one master form, or any named accessibility standard for respondents, so I cannot place it higher. 1 3 8 9 10 13
The Skeptic
A drag-and-drop editor with fifty-plus question types, conditional questions, page jumps, scoring and calculations, more than four hundred templates, and the customer's own logo, fonts, colours and custom CSS are all documented. We found no public information on piping, hidden fields, randomisation, multilingual surveys from a single master, or any named accessibility standard for respondents — for public-sector or research use that silence matters. 10 13 9 1 8
Distribution, response collection & workflows
Show reasoningHide reasoning
How this is scored
How forms reach people and what happens to an answer: share links, embedding, QR codes, email invitations with reminders, contact lists and panels, offline or kiosk collection, file uploads, payments and signatures inside the form, notifications, approval or assignment of submissions, and automations that pass a response on to other tools.
0 — No way to collect responses from other people; the product only analyses data collected elsewhere.
3 — A share link and an embed code, with responses visible in the product; invitations, notifications and onward workflows are basic or not described.
5 — Links, embedding and QR codes, email notifications on submission, file uploads, a few native integrations (spreadsheets, CRM, chat) plus a connector service such as Zapier or Make, and either email invitations with reminders or payments inside the form.
8 — Invitations to managed contact lists with reminders and unique links, response quotas and closing rules, offline or kiosk collection, submissions routed for approval or assignment, conditional notifications, documented webhooks and a REST API to read and write responses.
10 — Collection at research and process scale: panel or sample sourcing, multi-channel distribution (email, SMS, web, app intercept) with deduplication, workflows with branching and audit trail, and every response event exposed to the customer's systems in real time with a stated delivery guarantee.
The Market Researcher
Public link, embed, email and QR sharing, Stripe payments inside the form with 0% added fees even on the free tier, Slack/Teams/Discord notifications, webhooks, a REST API included in the free plan, Zapier and Make, and post-submission workflows with follow-up emails, approvals and AI routing. What I need for fieldwork is missing from the pages: we found no public information on invitations to managed contact lists with reminders and unique links, response quotas with closing rules, or offline collection. 2 3 10 12
The Operations Manager
This covers my whole wish list: public link, embed, email and QR sharing, file uploads that can land in Drive, Dropbox or S3, Stripe payments with 0% added fees even on the free tier, signatures, Slack and Teams notifications, and native pushes to Google Sheets, HubSpot, Salesforce and 50+ other apps plus Zapier and Make, with webhooks and a REST API included in free. Workflows add follow-up emails, approvals and AI routing to the right person, though we found no public information on invitation lists with reminders, response quotas and closing rules, or offline collection. 2 3 10 11 12
The HR Lead
Distribution by public link, embed, email and QR code, file uploads, payments and electronic signatures inside the form, and follow-up emails, approvals and AI routing that run after every submission. Webhooks, a REST API and dozens of native integrations plus Zapier and Make pass responses onward; we found no public information on managed contact lists with reminders and unique links, response quotas or offline collection — reminders are how I run a survey round. 2 3 10 12
The Academic Researcher
Public links, embedding, email and QR codes, file uploads, payments with amounts driven by form calculations, signatures, and webhooks plus a REST API included even in the free plan cover most study logistics, with follow-up emails, approvals and AI routing after each submission described. We found no public information on managed invitation lists with reminders and unique links, response quotas or closing rules, which panel work normally needs. 2 3 10 12
The Data Protection Officer
Public link, embed, email and QR code are all documented, plus file uploads, notifications in Slack, Discord or Teams, webhooks, REST API access, Stripe payments at 0% added fees even on the free tier, and electronic signatures. Workflows route submissions for approval or to the right person and can send follow-up emails. We found no public information on invitations to managed contact lists with reminders and unique links, response quotas with closing rules, or offline collection. 2 3 10 11 12
The Skeptic
Share links, embedding, email and QR codes, Stripe payments with 0% added fees, signatures, file uploads, Slack and Discord notifications, webhooks, Zapier and Make, and a REST API even on the free plan are documented, with workflows adding follow-up emails, approvals and AI routing of each submission. Managed invitation lists with reminders and unique links, response quotas with closing rules, and offline or kiosk collection are not described in the captured pages. 10 2 3 12
Survey analysis & reporting
Show reasoningHide reasoning
How this is scored
What the product does with the answers: live results and charts, filters and segments, cross-tabulation, NPS, CSAT and other standard scores, open-text and sentiment analysis, shareable dashboards and reports, and exports to the formats analysts use (CSV, Excel, SPSS, R).
0 — No view of results inside the product; submissions can only be forwarded or downloaded one at a time.
3 — A table of responses with simple charts per question and a CSV export; filters, comparisons and report sharing are basic or not described.
5 — Charts per question, filters and segments, at least one comparison or cross-tab view, standard scores such as NPS, shareable or exportable reports (PDF, presentation), and exports to CSV and Excel.
8 — Cross-tabulation with significance testing, weighting, open-text coding or sentiment analysis, trend reports across survey waves, dashboards for different audiences with permissions, and SPSS or R exports with labels.
10 — A research-grade analysis environment: statistical models beyond cross-tabs (driver analysis, regression), benchmarks, text analytics with themes the customer can edit, and every analysis reproducible from documented exports or an analytics API.
The Market Researcher
Responses are viewable in the product with filters, charts and a CSV export per form, flexible views with real-time collaboration, and AI workflow steps that summarise and tag long answers — a first nod to my open-text theming, though described only at marketing level. We found no public information on cross-tabulation, significance testing, weighting, trend reports across survey waves, shareable dashboards, or exports beyond CSV, so my cross-tabs and NPS tables would still pass through a spreadsheet before the board meeting. 1 3 4 10
The Operations Manager
Answers live in Fillout where you can view, filter, chart and export them, every form has a CSV export, and AI steps summarise, tag and score submissions; collaboration in real time is mentioned. We found no public information on cross-tabulation, shareable dashboards or analytical report exports beyond per-response PDFs, so anything beyond basic charts means moving data out. 1 3 4 10
The HR Lead
Responses can be viewed, filtered and charted in the product, NPS and rating questions are supported, AI steps summarise, tag and score long answers, and every form exports to CSV. We found no public information on cross-tabulation, trend reports across survey waves, shareable report formats or per-department dashboards with permissions — and nothing on hiding results below a minimum group size, which is the first thing my works council would ask for. 1 3 4 10
The Academic Researcher
Responses can be viewed, filtered, charted and exported as a per-form CSV, with NPS, ratings, scoring and AI steps that summarise, tag and score submissions. We found no public information on cross-tabulation, significance testing, shareable reports, or exports to SPSS or R with labels intact — without those, my dataset goes into another package entirely by hand. 1 3 4 10
The Data Protection Officer
Inside the product you can view, filter, chart and export responses to CSV, the builder supports NPS and scored quizzes, and AI steps summarize, tag and score open answers. We found no public information on cross-tabulation, shareable dashboards or report exports, or analyst formats such as Excel, SPSS or R, so the analysis story is thin. 1 3 4 10
The Skeptic
Responses can be viewed, filtered and charted in the product and exported as a CSV per form, NPS appears as a question type, and AI steps can summarise and tag open answers. Cross-tabulation, segments, shareable dashboards or reports, and exports beyond CSV such as Excel, SPSS or R are not described in the captured material — anything beyond per-question charts means taking the CSV somewhere else. 10 4 3 1
Consent, GDPR & respondent data
Show reasoningHide reasoning
How this is scored
What the product gives the customer to collect personal data lawfully: consent and privacy-notice fields, anonymous surveys that really drop IP addresses and identifiers, retention periods and automatic deletion, handling of access and erasure requests, encryption of responses, a data processing agreement, and controls over cookies and tracking on the form itself.
0 — The product collects no personal data from respondents, so there is nothing to protect; or it is a different kind of product.
3 — A privacy policy and a statement of GDPR compliance, with a checkbox field usable for consent; anonymity, retention and deletion are not described.
5 — A data processing agreement offered to customers, a consent or privacy-notice field, an anonymous mode that does not store IP addresses, responses deletable by the customer, and encryption in transit and at rest stated.
8 — Retention periods with automatic deletion, tools for access and erasure requests per respondent, field-level encryption or masking of sensitive answers, forms that set no tracking cookies by default, a published list of technical and organisational measures, and a named data protection officer.
10 — Data protection by design and evidenced: end-to-end or customer-key encryption of responses, documented data minimisation defaults, a DPA with audit rights and subprocessor change notice, records of consent kept with each response, and an independent audit of the privacy controls published.
The Market Researcher
A standard DPA offered on any plan incorporating the EU Standard Contractual Clauses and UK Addendum, an EU privacy representative, deletion of a form, individual responses or the account completed including backups within 45 days, 256-bit AES encryption with daily encrypted backups, a statement of no cross-site tracking, and electronic signatures for consent forms. We found no public information on an anonymous mode that drops IP addresses, retention automation beyond that deletion window, field-level masking of sensitive answers, or a named data protection officer. 3 4 6 7 10
The Operations Manager
A standard DPA incorporating the EU SCCs is available to any customer on any plan, a form, individual response or account is permanently deleted from servers and backups within 45 days on request, 256-bit AES encryption is stated, and an EU privacy representative, Prighter, is named. We found no public information on an anonymous mode that drops IP addresses, a dedicated consent or privacy-notice field, encryption in transit, or retention rules with automatic deletion. 3 4 7 13
The HR Lead
A standard DPA — explicitly offered to German customers as an AVV — is available on any plan with the EU Standard Contractual Clauses included, forms and individual responses can be deleted with permanent deletion within 45 days, and 256-bit AES encryption, SOC 2 Type 2, two-factor authentication and an EU privacy representative are stated. We found no public information on an anonymous mode that drops IP addresses, automatic retention periods, field-level masking or a named data protection officer, so I could not confirm the anonymity my survey needs. 3 4 6 7
The Academic Researcher
A standard DPA incorporating the EU Standard Contractual Clauses is available to any plan, deletion of forms, single responses or the account completes within 45 days including backups, an EU privacy representative is named, AES-256 encryption with SOC 2 Type 2 is stated, and electronic signatures on consent forms are offered. We found no public information on an anonymous mode that drops IP addresses, automatic retention schedules, field-level masking, or a named data protection officer — so I would be building the anonymity argument myself. 3 4 6 7 10
The Data Protection Officer
A standard DPA is published on the vendor's own page and available on any plan, with the EU Standard Contractual Clauses and UK Addendum incorporated; customers can delete a form, an individual response or the account with permanent removal from servers and backups within 45 days; 256-bit AES encryption and an EU privacy representative (Prighter) are stated. But we found no public information on an anonymous mode that drops IP addresses — the first thing I check before a department sends out a survey — no explicit consent or privacy-notice field (electronic signatures on consent forms are the nearest thing), and no retention periods that delete data automatically. 4 6 7 10
The Skeptic
A standard data processing agreement incorporating the EU Standard Contractual Clauses is available to any customer on any plan, an EU privacy representative is named, and forms, individual responses and accounts are permanently deleted — backups included — within 45 days, with 256-bit AES encryption and SOC 2 Type 2 claimed. We found no public information on an anonymous mode that drops IP addresses and identifiers, on consent or privacy-notice fields, or on which cookies a published form sets — precisely the silences I look for before trusting a survey tool with personal data. 4 7 13 6
Hosting choice, teams & portability
Show reasoningHide reasoning
How this is scored
What the customer may choose about where and how the product runs and who uses it: a selectable data region or EU-only hosting, self-hosting or an on-premise edition, team workspaces with roles and permissions, single sign-on, an audit log, custom domains and white-labelling, and a complete export of forms and responses that another tool can import.
0 — A single-user tool with no export of forms or responses.
3 — Shared access for a team and a response export; data location, roles and single sign-on are not described.
5 — Hosting location stated with an EU option, team workspaces with at least two roles, single sign-on on a higher plan, a custom domain or removed vendor branding, and an export of all responses.
8 — EU-only hosting selectable per account or a self-hosted edition, granular roles per form or folder, SSO with SAML and user provisioning, an audit log, white-labelling, and forms and responses exportable in a documented format with an API.
10 — Full control over operation: an open-source or on-premise edition with feature parity, customer-chosen region per workspace, administrative APIs, a documented migration path in and out, and an uptime commitment with a published status history.
The Market Researcher
EU hosting of respondent data from the Team plan upward (default region is the US), granular permissions on Team and Enterprise, SSO via G Suite with Okta, Active Directory and other SAML providers on request, custom domains, white-label emails on Pro, per-form CSV export plus a REST API included free, and even an optional self-hosted agent on the customer's own cloud so data never reaches the vendor. We found no public information on an audit log or user provisioning, which keeps it below the top level. 3 4 6 7 10
The Operations Manager
EU hosting for respondent data is available from the Team plan by contacting support, granular permissions and access controls come with Team and above, SSO covers G Suite plus Okta, Active Directory and other SAML providers, custom domains are built in, and white-label emails arrive on Pro; seats are never charged. All form responses export to CSV and the REST API is included even in the free plan, but we found no public information on an audit log or user provisioning. 3 4 6 10
The HR Lead
Respondent submissions can be switched to EU hosting from the Team plan upward, there are granular permissions and access controls, single sign-on with G Suite and SAML providers such as Okta and Active Directory, custom domains, white-label emails on a higher plan, and export of all responses with a REST API included even in the free tier. We found no public information on an audit log or user provisioning, and the EU option covers form submissions rather than the whole account. 3 4 6 10
The Academic Researcher
EU-based hosting of respondent data is available on the Team plan and above via a support request, granular permissions and access controls come with Team and Enterprise, Okta/Active Directory/SAML single sign-on is offered, custom domains are built in and white-label emails arrive with Pro, while CSV export and a REST API exist and the privacy policy sketches an optional self-hosted agent. We found no public information on an audit log or a fully self-hostable edition, and the default region is the United States. 3 4 6 7 10
The Data Protection Officer
EU storage for respondent data is available from the Team plan upward by contacting support, while the default region is the United States and the security pages state EU servers are only used if requested. Granular permissions and access controls arrive with Team and Enterprise, SSO covers G Suite plus SAML providers like Okta and Active Directory on request, two-factor authentication is included even in the free plan, and custom domains, white-label emails from Pro, CSV export and REST API access are documented. We found no public information on an audit log or user provisioning; the on-premises option in the privacy policy is a self-hosted agent for keeping customer data out of Fillout's servers, not a self-hosted edition of the platform. 3 4 6 7 10
The Skeptic
EU storage for respondent data is offered from the Team plan upward via a support request while the default region is the United States, and the privacy policy describes an optional self-hosted agent on the customer's own infrastructure to keep data away from the vendor entirely. Custom domains, white-label emails from the pro plan, granular permissions on Team & Enterprise, SAML and G Suite single sign-on, per-form CSV export and a REST API are documented; we found no public information on an audit log, user provisioning, or a complete export of the form definitions themselves. 4 7 3 6 10
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where forms and responses are hosted, and who the subprocessors are (hosting, email delivery, payment providers, analytics, AI features). Independently sourced by the sovereignty pipeline; responses often carry personal and sometimes special-category data, so the whole chain counts, not only the database.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (email, analytics, AI features, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The Market Researcher
The operator is Restly, Inc., a Delaware corporation under Illinois law, with hosting on AWS via Render in the United States by default and EU servers only on request for respondent data. The subprocessor chain is published with locations and is largely US-based — Postmark for email, Stripe for payments, OpenAI and Anthropic for AI, Cloudflare worldwide — and the DPA with SCCs plus SOC 2 Type 2 are stated, but there is no EU contracting entity and even with EU hosting enabled parts of the chain that touch submission data stay in the US. 4 5 6 7 8
The Operations Manager
The contracting entity is Restly, Inc., a Delaware corporation, and personal data is stored in the United States by default, with EU servers used only if requested and respondent-data hosting offered from the Team plan up. The chain is disclosed unusually openly: a full subprocessor list naming locations and whether each touches submission data (Postmark for email, Stripe for payments, OpenAI for AI except for EU-hosting customers, Azure in the EU for them), plus a published DPA with SCCs, SOC 2 Type 2 and a named EU representative — no public information on European ownership. 4 5 6 7 8
The HR Lead
The operator is Restly, Inc., a Delaware corporation under Illinois law, hosted on AWS via Render.com with the United States as the default region and EU servers only on request. Subprocessors are listed with their locations and whether they may process submission data, the DPA is published with SCCs, SOC 2 Type 2 is stated, and for EU submission hosting customers the AI and transcription path moves to Microsoft Azure in the EU. Even so, the contracting entity and most of the chain — email via Postmark, payments via Stripe, Cloudflare worldwide — remain outside the EU, which the works council will note. 4 5 6 7 8
The Academic Researcher
The platform is operated by Restly, Inc., a Delaware corporation, personal data is stored in the United States by default and EU storage applies only to respondent data when requested on a paid plan; the published subprocessor list shows the rest of the chain — email through Postmark, payments through Stripe, SSO through WorkOS — in the US even for EU-hosted submissions. The DPA with SCCs, the EU privacy representative and SOC 2 Type 2 are real counterweights, but as a chain this is only partly European, and the contracting entity is not. 4 5 6 7 8
The Data Protection Officer
The contracting entity is Restly, Inc., a Delaware corporation, with default storage in the United States, and the published subprocessor list shows the chain — Postmark for email, Stripe for payments, OpenAI and Anthropic for AI, Cloudflare worldwide — largely in the US, several entries flagged as able to process submission data, though AI and transcription switches to Microsoft Azure in the EU for EU submission-hosting customers. Credit where due: the subprocessor list sits on the vendor's own pages with countries and submission-data flags, the DPA incorporates the SCCs, SOC 2 Type 2 is stated, and an EU privacy representative exists. Ownership and parent-company details were not confirmed on the captured pages; a US entity and a US-default chain with an opt-in EU region keeps this in the middle of the scale. 4 5 6 7 8
The Skeptic
The contracting entity is Restly, Inc., a Delaware corporation under Illinois law, hosting runs on AWS via Render with a stated US default and EU storage only for submissions and only on request — and even then parts of the chain remain American: Postmark for email, Stripe for payments, Cloudflare worldwide, WorkOS for enterprise SSO, with OpenAI handling AI unless EU submission-hosting customers move to Microsoft Azure. The subprocessor list is unusually candid about countries and about who may process submission data, the data processing agreement carries the SCCs, and SOC 2 Type 2 is claimed; there is no European entity behind any of it, which is where it stops. 8 6 7 5 4 3
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per plan and per user, response or submission limits and what happens above them, which features (logic, branding removal, SSO, EU hosting, analysis modules) need a higher plan, add-ons, minimum term and the free tier's limits.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, responses or features is unclear.
5 — Plans are public with prices and their main limits (users, responses, forms), but at least one commonly needed piece (SSO, EU hosting, extra responses, branding removal) is unpriced or "on request".
8 — Every plan priced publicly with its limits, overage or extra-response prices, feature differences per plan in a comparison table, billing period, VAT treatment and cancellation terms stated.
10 — Complete price computability: annual cost derivable for a given number of users, responses and features, with every add-on, enterprise option, support level and data-return term published.
The Market Researcher
The free tier is fully documented — unlimited forms and seats, 1,000 responses per month, no credit card — with no per-seat charges, a 20% saving on annual billing, clear over-limit behaviour (forms keep collecting and the count resets on the 1st), auto-renewal with 30-day notice, non-refundable payments, and named feature gates per plan for things like respondent emails, white-label emails, granular permissions and external storage. But the captured pricing pages state no figures for the paid plans, so a buyer still cannot compute the real annual cost from public pages alone. 3 8 10
The Operations Manager
The free tier is genuinely clear — unlimited forms and seats, 1000 responses/mo, payments and the REST API included — and the pricing page shows which features need Starter, Pro, Team or Enterprise, that seats are never charged, a 20% annual saving, that forms keep collecting past the monthly limit until the count resets, auto-renewal with 30 days' notice and no refunds. We found no public information on currency amounts for the paid plans or their response limits, so a real annual cost for our volume cannot be computed from the captured pages. 3 8 10
The HR Lead
The free tier is clearly delimited — unlimited forms and seats, 1,000 responses per month — with over-limit behaviour described, no per-seat charges, and several plan gates published, including EU hosting from Team upward and white-label emails from Pro. The captured pages give no figures for the paid plans themselves, so an annual cost cannot be computed from what we read; the terms do state monthly or annual billing, a 20% annual saving, auto-renewal with 30-day notice, and non-refundable payments. 3 4 8 10
The Academic Researcher
The free tier is fully specified — unlimited forms and seats, 1000 responses per month, forms keep collecting past the limit until the count resets on the 1st — and billing period, the 20% annual saving, auto-renewal with 30-day notice and the non-refundable policy are public, along with plan gating for permissions, signatures and white-label emails. We found no public price figures for the paid plans on the captured pages, so I cannot compute a year's cost for my faculty from public information alone. 3 8
The Data Protection Officer
The free tier is defined precisely — unlimited forms and seats, 1000 responses/mo, no credit card — with no per-seat charges, forms that keep collecting past the limit until the count resets on the 1st, an annual option advertised as "Save 20%", discounts for non-profits, students, startups and educational institutions, and plan gating stated for Salesforce, granular permissions and EU hosting. But we found no plan price figures, paid-plan response limits, overage prices or VAT treatment on the captured pricing pages, so a buyer cannot compute an annual cost from what I read; cancellation requires written notice at least 30 days before renewal and all payments are final. 3 4 8 10
The Skeptic
The captured pricing page documents the free tier — unlimited forms and seats, 1,000 responses per month, no credit card — states there are no per-seat charges, marks which features begin on which plan, and explains that over-limit forms keep collecting until the monthly reset, which is refreshingly concrete. But no price figures for the paid plans appear in the captured material, annual billing is described only as saving 20%, EU hosting needs a support conversation after upgrading, further SSO providers are behind a contact request, and we found no public information on VAT treatment or the Enterprise plan's price. 3 10 8 4 6
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Fillout
Is Fillout European?
No. whats-best.ai classifies Fillout as Rest of world.
Where does Fillout store data?
Not stated on the vendor’s pages as of 28 Oct 2026.
Does Fillout have a free plan?
Yes. Fillout has a free plan, per the vendor’s page captured 28 Oct 2026.
What are the best alternatives to Fillout?
As of 3 Nov 2026, the panel rates Formbricks (4/5), easyfeedback (3.5/5) and Netigate (3.5/5) highest among the other 19 Forms & Surveys products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Formbricks (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Fillout alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 28 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Open source, Legal entity, Hosting location, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 13 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 12 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.fillout.com Checked 28 Oct 2026 Details →
- 2 Integrations page www.fillout.com Checked 28 Oct 2026 Details →
- 3 Pricing page www.fillout.com Checked 28 Oct 2026 Details →
- 4 GDPR page www.fillout.com Checked 28 Oct 2026 Details →
- 5 Subprocessor list www.fillout.com Checked 28 Oct 2026 Details →
- 6 Security page www.fillout.com Checked 28 Oct 2026 Details →
- 7 Privacy policy www.fillout.com Checked 28 Oct 2026 Details →
- 8 Terms of service www.fillout.com Checked 28 Oct 2026 Details →
- 9 Form & survey building — found from sitemap www.fillout.com Checked 28 Oct 2026 Details →
- 10 Form & survey building — found from sitemap www.fillout.com Checked 28 Oct 2026 Details →
- 11 Distribution, response collection & workflows — found from sitemap www.fillout.com Checked 28 Oct 2026 Details →
- 12 Distribution, response collection & workflows — found from sitemap www.fillout.com Checked 28 Oct 2026 Details →
- 13 Survey analysis & reporting — found from sitemap www.fillout.com Checked 28 Oct 2026 Details →