Forms & Surveys
Formbricks
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Formbricks GmbH · formbricks.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Formbricks at a glance
- Vendor
- Formbricks GmbH
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention Germany source, captured 28 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates Formbricks 4/5, the mean of 6 judges. Formbricks is an open-source (AGPLv3) survey and experience-management platform from Formbricks GmbH of Kiel, offered as a cloud hosted in Germany or self-hosted on your own infrastructure. how scores are made
- As of
- Vendor pages captured 28 Oct 2026 to 1 Nov 2026; evaluated by the panel 29 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Formbricks is an open-source (AGPLv3) survey and experience-management platform from Formbricks GmbH of Kiel, offered as a cloud hosted in Germany or self-hosted on your own infrastructure. The bench's highest scores go to hosting and administration at 8 to 9 and form building at a steady 8: seventeen question types, branching with AND/OR rules and a fallback, multi-language surveys with right-to-left scripts, deployment by Docker or a Helm chart on your own PostgreSQL, SAML or OIDC single sign-on, and seats unlimited on every plan. Analysis and reporting sits at a flat 7, with no public information on significance testing, weighting, or SPSS and R exports. The visible splits are narrow — sovereignty runs 7 to 8 — and the flagged splits flag nothing: the higher scores credit German hosting and a public DPA, while the lower ones weigh US-headquartered parents behind the server locations and Stripe Inc. processing billing data in the USA. Pricing transparency scores 3 to 4: no plan prices are published, and the vendor quotes after a first call.
Speaks for it
- Form building scored 8 with seventeen question types, branching with AND/OR rules and a fallback, and multi-language surveys with right-to-left support in one master survey.
- Self-hosting by Docker, Helm chart or one-click script keeps responses in your own PostgreSQL and uploads in your S3-compatible storage — hosting and administration scored 8 to 9.
- Collection supports single-use links in batches of up to 5,000 with your own IDs, offline collection that syncs later, and signed retried webhooks on a documented REST API.
- The data processing agreement is public, with audit rights including an independent auditor and two weeks' written notice of subprocessor changes with a right to object.
- Direct SQL on the documented PostgreSQL data model connects to Power BI, Tableau, Superset, Looker and Snowflake for reproducible numbers.
Held against it
- Analysis and reporting scored 7, and we found no public information on significance testing, weighting, or SPSS and R exports.
- Server locations sit on AWS and Google Cloud with US-headquartered parents, Stripe Inc. is named processing billing data in the USA, and the captured pages give different figures for where Stripe processes billing data.
- The captured pages give different pictures on AI training: privacy pages state data is never used as training input, while the terms state AI inputs may be used for model training subject to the AI subprocessor's opt-out.
- We found no public information on field-level encryption or masking of sensitive answers, cookie controls on the form itself, or a named data protection officer.
- Dedicated cloud and managed hosting are marked as coming, and the captured pages differ on whether they run today.
Best for
- You need the survey platform on your own infrastructure, with responses in your PostgreSQL, uploads in your S3-compatible storage, mail through your own SMTP and SSO via SAML or OIDC.
- You want advanced authoring — branching, recall piping, multi-language surveys — with seats unlimited on every plan.
- You push completed responses into BI tools such as Power BI, Tableau or Superset through direct PostgreSQL access.
- Your legal review starts from a public DPA with audit rights, subprocessor notice and objection rights.
Avoid if
- You field multi-wave samples and depend on managed invitations with reminder waves or panel sourcing — the academic and market researchers scored collection 7, citing these gaps.
- Your analysts need significance testing, weighting or SPSS and R exports inside the tool.
- You need a processing chain with no US-headquartered providers — ask the vendor: the public pages we read do not show it
- You must budget from public prices, which the vendor publishes none of, quoting instead after a first call.
The scores
| Criterion | Panel median |
|---|---|
| Form & survey building | 4 of 5 |
| Distribution, response collection & workflows | 4 of 5 |
| Survey analysis & reporting | 3.5 of 5 |
| Consent, GDPR & respondent data | 3.5 of 5 |
| Hosting choice, teams & portability | 4 of 5 |
| European sovereignty | 3.5 of 5 |
Form & survey building
Show reasoningHide reasoning
How this is scored
What can be built without code: question and field types, conditional logic and branching, piping and hidden fields, calculations, multi-page forms and progress, templates, design and branding, multiple languages, and accessible output for respondents.
0 — Not a form or survey builder; questions cannot be authored in the product.
3 — A builder with the common question types and a few templates; logic, branding or languages are basic or not described.
5 — A drag-and-drop builder with a wide range of question types, conditional logic that shows, hides or skips questions, multi-page forms, a template library, and the customer's logo, colours and fonts.
8 — Advanced logic with piping, hidden fields, calculations and scoring, randomisation, surveys translated into several languages from one master, reusable question libraries, custom CSS or themes, and accessible forms with a named standard (WCAG 2.1 AA or BITV) stated.
10 — Best-in-class authoring: complex research designs (loops, quotas in logic, conjoint or MaxDiff), versioned forms with change history, a published accessibility conformance report, and every element of a form available through the API.
The Market Researcher
Seventeen question types with branching on any answer, hidden field or variable, AND/OR rules and a fallback cover the skip patterns my waves need, and recall piping plus variables that keep score give me quizzes and conversational flow. Multiple languages live in one survey with RTL support and browser-language detection, branding carries our logo and colours, and an accessibility conformance report is published. I found no public information on conjoint or MaxDiff types or versioned forms with change history, so I stop short of the top. 11 10 17
The Operations Manager
Seventeen question types including file upload, contact info, address and consent, branching on any answer, hidden field or variable with AND/OR rules and a fallback, recall and variables for piping and scoring, multi-language surveys in one master with RTL support, and branding with logo, colours and backgrounds — a colleague could build these without IT. Hundreds of templates are published and an accessibility conformance report (VPAT) is available. We found no public information on reusable question libraries or version history for forms. 11 10 17
The HR Lead
Seventeen question types including NPS, CSAT and a consent checkbox, branching with AND/OR and a fallback, hidden fields, recall piping and scoring variables, all inside one multi-language survey with right-to-left support and browser-language detection — enough for a pulse check in every department. Branding with our logo, colours and backgrounds, hundreds of templates, and an accessibility conformance report are documented; we found no public information on reusable question libraries or a named accessibility standard. 10 11 17
The Academic Researcher
Seventeen question types including matrix grids, ranking and a rich-text consent field, branching on answers, hidden fields and variables with AND/OR rules and a fallback, recall piping, scoring variables, option randomisation, and multi-language surveys kept in one master with right-to-left scripts, plus hundreds of templates including the System Usability Scale and an accessibility conformance report (VPAT) — that covers nearly everything my ethics board and I need to author an instrument. We found no public information on reusable question libraries, versioned forms with change history, or loops and quotas inside the logic. 10 11 17
The Data Protection Officer
Seventeen question types including a consent checkbox and multiple endings, branching with AND and OR rules and a fallback, recall and variables for piping and scoring, random answer order on single-select, and one master survey carrying every translation with right-to-left support is the advanced authoring level. Branding covers logo, colours, card styles and backgrounds, and an accessibility conformance report (VPAT) is stated as available. We found no public information on versioned forms with change history, and the conformance report is described as available rather than published against a named standard. 11 10 17
The Skeptic
Seventeen question types, branching with AND/OR and a fallback, recall piping, hidden fields, quiz variables, multi-language surveys with RTL mirroring in one dataset and a template library put this at the advanced tier, and an accessibility conformance report is available. I found no public information on reusable question libraries or a named accessibility standard, so it stays short of the top. 11 10 17 12
Distribution, response collection & workflows
Show reasoningHide reasoning
How this is scored
How forms reach people and what happens to an answer: share links, embedding, QR codes, email invitations with reminders, contact lists and panels, offline or kiosk collection, file uploads, payments and signatures inside the form, notifications, approval or assignment of submissions, and automations that pass a response on to other tools.
0 — No way to collect responses from other people; the product only analyses data collected elsewhere.
3 — A share link and an embed code, with responses visible in the product; invitations, notifications and onward workflows are basic or not described.
5 — Links, embedding and QR codes, email notifications on submission, file uploads, a few native integrations (spreadsheets, CRM, chat) plus a connector service such as Zapier or Make, and either email invitations with reminders or payments inside the form.
8 — Invitations to managed contact lists with reminders and unique links, response quotas and closing rules, offline or kiosk collection, submissions routed for approval or assignment, conditional notifications, documented webhooks and a REST API to read and write responses.
10 — Collection at research and process scale: panel or sample sourcing, multi-channel distribution (email, SMS, web, app intercept) with deduplication, workflows with branching and audit trail, and every response event exposed to the customer's systems in real time with a stated delivery guarantee.
The Market Researcher
Single-use links in batches up to 5,000 with our own IDs, close-by-response-count rules, scheduled opening, offline collection that syncs later, and signed retried webhooks with a documented REST API cover most of my fielding mechanics. Workflows email the response owner and can follow up with the respondent, with per-step run logs and routing on selected endings. I found no public information on invitation campaigns with reminder waves to a managed contact list or on panel sourcing, which is exactly where my three-wave sampling lives. 11 12 13
The Operations Manager
Links, QR codes, website embeds without an SDK, the first question inside an email, single-use links in batches up to 5,000 with my own IDs, closing rules by date or response count, and offline collection that syncs when the connection returns — exactly what event registration and on-site damage reports with photos need. A completed response triggers workflows that email the owning team the full response, post to Slack, or fan out natively to Google Sheets, Airtable and Notion and through Zapier, Make or n8n into HubSpot, Salesforce or Jira, with signed retried webhooks and a documented REST API. We found no public information on managed email invitations with reminders, or on payments or signatures inside the form. 11 12 13
The HR Lead
Single-use links in batches of up to five thousand carrying our own employee IDs, surveys that open and close on a date or at a response count, offline collection that syncs when the connection returns, and partial answers saved as people go — that is company-wide collection done properly. Completions can reach the owning team through workflows with a per-step run log, or flow out through signed, retried webhooks, the REST API and the usual automation platforms; we found no public information on email invitations with reminders to a contact list. 11 12 13
The Academic Researcher
Single-use links in batches of up to 5,000 with my own IDs, open and close by date or response count, offline collection that syncs later, partial-response capture and PIN protection give me the collection controls a study needs, while signed and retried webhooks plus a documented REST API that reads and writes responses move every answer into my systems. Workflows route completions by chosen ending to owners with the full response attached and log every run step by step; we found no public information on managed invitations with scheduled reminders or approval routing of submissions. 11 12 13
The Data Protection Officer
Single-use links in batches of up to 5,000 using the customer's own IDs, scheduled open and close with a response-count stop, offline collection that syncs when the connection returns, and signed webhooks with retries plus a documented REST API for reading and writing responses cover the advanced collection level. Workflows route each completed response to the owning team with per-step run logs, and connectors run through Zapier, Make, n8n, native Google Sheets, Airtable, Notion and Slack. We found no public information on invitations to managed contact lists with reminders or SMS distribution. 11 12 13 17
The Skeptic
Links, QR codes, an email-embedded first question, website and webview embeds, offline collection, up to 5,000 single-use links per batch, closing rules by date or response count, signed retried webhooks on an OpenAPI-backed API that reads and writes surveys, responses, contacts and webhooks, plus automation platforms and workflows that route completions to owners with run logging. I found no public information on reminder cycles to managed contact lists, SMS or panel sourcing, which caps it below research scale. 11 13 12 17
Survey analysis & reporting
Show reasoningHide reasoning
How this is scored
What the product does with the answers: live results and charts, filters and segments, cross-tabulation, NPS, CSAT and other standard scores, open-text and sentiment analysis, shareable dashboards and reports, and exports to the formats analysts use (CSV, Excel, SPSS, R).
0 — No view of results inside the product; submissions can only be forwarded or downloaded one at a time.
3 — A table of responses with simple charts per question and a CSV export; filters, comparisons and report sharing are basic or not described.
5 — Charts per question, filters and segments, at least one comparison or cross-tab view, standard scores such as NPS, shareable or exportable reports (PDF, presentation), and exports to CSV and Excel.
8 — Cross-tabulation with significance testing, weighting, open-text coding or sentiment analysis, trend reports across survey waves, dashboards for different audiences with permissions, and SPSS or R exports with labels.
10 — A research-grade analysis environment: statistical models beyond cross-tabs (driver analysis, regression), benchmarks, text analytics with themes the customer can edit, and every analysis reproducible from documented exports or an analytics API.
The Market Researcher
NPS, CSAT and CES come as ready-made measures, results group and filter by answer, country, language and sentiment, and every comment is tagged by topic and sentiment — my open answers get themes before the board meeting without a spreadsheet. The AI chart builder answers prompts like NPS by country this quarter, dashboards carry read-only or edit access per team, and responses export to CSV and Excel. I found no public information on significance testing, weighting or SPSS exports, though direct PostgreSQL access to every typed response field is documented for deeper analysis. 15 1 11 14
The Operations Manager
Ready-made NPS, CSAT and CES measures, dashboards with grouping and filtering by answer, source, country, device, sentiment and emotion, and export to CSV or Excel cover the day-to-day. AI tags comments by topic and sentiment in any language, and responses sit in PostgreSQL so Power BI, Tableau, Superset or plain SQL can query them directly alongside revenue and CRM tables. We found no public information on significance testing, weighting, trend reports across waves, or SPSS and R exports. 15 14
The HR Lead
I get per-question drop-off, ready-made NPS, CSAT, rating and sentiment measures, grouping and filtering by question, answer, country, device and language, and exports to CSV and Excel, with topic and sentiment tagging in any language. Every number is reproducible through the documented data model and direct SQL or BI connections to the PostgreSQL database. We found no public information on significance testing, weighting, trend reports across waves — or on hiding results below a minimum group size, which my works council will insist on. 11 14 15
The Academic Researcher
Live starts, completions and per-question drop-offs, NPS, CSAT and CES measures, grouping and filtering across nine dimensions, matrix charts for Likert grids, dashboards shareable view-only, AI topic and sentiment tagging, and CSV/Excel exports, with a documented data model, direct SQL on PostgreSQL and Power BI, Tableau, Superset, Looker or Snowflake connectivity for reproducibility. We found no public information on cross-tabulation with significance testing, weighting, or exports to SPSS or R with labels — the formats my faculty's analysts need. 1 11 14 15
The Data Protection Officer
Ready-made NPS, CSAT, CES, rating and sentiment measures are built in, grouping and filtering runs across question, source, country, language, sentiment and emotion, and dashboards can be shared read-only or read-write. Open-text answers get AI topic and sentiment tagging in any language, and the documented PostgreSQL data model with Power BI, Tableau, Superset, Snowflake and dbt access is a strong analysis path beyond the usual exports. We found no public information on significance testing, weighting or SPSS and R exports. 15 1 14 11
The Skeptic
Charts with ready-made NPS, CSAT, CES, rating and sentiment measures, grouping and filtering by source, country, device, language and emotion, dashboards shared at Read or Read & Write, AI topic-and-sentiment tagging, an AI chart builder, and direct PostgreSQL access feeding Superset, Tableau, Power BI, Looker and dbt with a documented data model. I found no public information on significance testing, weighting, trend reports across waves or SPSS and R exports, so it sits below the research tier. 15 14 13 1
Consent, GDPR & respondent data
Show reasoningHide reasoning
How this is scored
What the product gives the customer to collect personal data lawfully: consent and privacy-notice fields, anonymous surveys that really drop IP addresses and identifiers, retention periods and automatic deletion, handling of access and erasure requests, encryption of responses, a data processing agreement, and controls over cookies and tracking on the form itself.
0 — The product collects no personal data from respondents, so there is nothing to protect; or it is a different kind of product.
3 — A privacy policy and a statement of GDPR compliance, with a checkbox field usable for consent; anonymity, retention and deletion are not described.
5 — A data processing agreement offered to customers, a consent or privacy-notice field, an anonymous mode that does not store IP addresses, responses deletable by the customer, and encryption in transit and at rest stated.
8 — Retention periods with automatic deletion, tools for access and erasure requests per respondent, field-level encryption or masking of sensitive answers, forms that set no tracking cookies by default, a published list of technical and organisational measures, and a named data protection officer.
10 — Data protection by design and evidenced: end-to-end or customer-key encryption of responses, documented data minimisation defaults, a DPA with audit rights and subprocessor change notice, records of consent kept with each response, and an independent audit of the privacy controls published.
The Market Researcher
Anonymize stops storing country, IP and device details with IP capture off by default, a consent checkbox cannot be pre-checked, individual submissions can be deleted from the dashboard for erasure requests, and deleted data leaves backups within 90 days. The public DPA publishes technical and organisational measures, audit rights with independent auditors, breach notification without undue delay and two-week subprocessor change notice, with encryption in transit and at rest stated. I found no public information on field-level masking of sensitive answers, tracking-cookie defaults on the form itself, or a named data protection officer. 11 16 7 3 4
The Operations Manager
An anonymize option stops storing country, IP address and device details with IP capture off by default, a consent checkbox cannot be pre-checked, submissions can be deleted from the dashboard to answer erasure requests, and deleted data is purged from backups within 90 days. The data processing agreement is public, grants audit rights with an independent auditor, gives two weeks' notice of subprocessor changes with a right to object, and encryption of TLS 1.3 in transit and AES-256 at rest is stated. We found no public information on a named data protection officer, tracking-cookie controls on the form itself, or field-level masking of sensitive answers. 16 11 7 3
The HR Lead
The anonymize option stops storing country, IP address and device details, IP capture is off unless switched on, the consent checkbox cannot be pre-checked, submissions can be deleted individually from the dashboard, deleted data leaves the backups within ninety days, and everything is TLS 1.3 in transit and AES-256 at rest. The public data processing agreement grants audit rights with an independent auditor and two weeks' notice before any subprocessor change, with data deleted thirty days after termination. We found no public information on customer-set automatic retention schedules, cookie controls on the form itself, or a named data protection officer. 3 4 7 11 16
The Academic Researcher
An anonymise mode that stops storing country, IP and device details with IP capture off unless switched on, an opt-in consent checkbox that cannot be pre-checked, a public data processing agreement with standard contractual clauses, two-week subprocessor change notice with objection rights, audit rights including an independent auditor, breach notification without undue delay, per-submission deletion from the dashboard with 90-day backup removal and 30-day post-termination deletion, and encryption in transit and at rest stated. We found no public information on field-level encryption or masking of sensitive answers, default cookie behaviour on the form itself, a named data protection officer, or consent records kept with each response. 3 4 7 9 11 16
The Data Protection Officer
A public data processing agreement with audit rights, two weeks' written notice of sub-processor changes with an objection right, technical and organisational measures in an annex, and breach notification without undue delay is exactly the paperwork I require before sign-off. Anonymize mode stops storing country, IP address and device details with IP capture off unless switched on, opt-in consent is a checkbox that cannot be pre-checked, submissions can be deleted from the dashboard to honour erasure requests, and deleted data leaves the backups within 90 days. We found no public information on field-level encryption or masking, tracking-cookie defaults on the form itself, or a named data protection officer. 16 11 7 3 4
The Skeptic
A public DPA with audit rights, two-week subprocessor change notice with objection, breach notification, deletion-or-return with certification on termination, technical and organisational measures in a published annex, encryption in transit and at rest, an anonymize mode that drops country, IP and device with IP capture off by default, consent checkboxes that cannot be pre-checked, and per-submission deletion from the dashboard. It stops short of the top because I found no public information on field-level encryption or masking, cookie controls or a named data protection officer — and the captured pages give different pictures on AI training, with the privacy pages stating data is never training input while the terms state AI inputs may be used for model training subject to the subprocessor's opt-out. 7 9 11 16 3 4
Hosting choice, teams & portability
Show reasoningHide reasoning
How this is scored
What the customer may choose about where and how the product runs and who uses it: a selectable data region or EU-only hosting, self-hosting or an on-premise edition, team workspaces with roles and permissions, single sign-on, an audit log, custom domains and white-labelling, and a complete export of forms and responses that another tool can import.
0 — A single-user tool with no export of forms or responses.
3 — Shared access for a team and a response export; data location, roles and single sign-on are not described.
5 — Hosting location stated with an EU option, team workspaces with at least two roles, single sign-on on a higher plan, a custom domain or removed vendor branding, and an export of all responses.
8 — EU-only hosting selectable per account or a self-hosted edition, granular roles per form or folder, SSO with SAML and user provisioning, an audit log, white-labelling, and forms and responses exportable in a documented format with an API.
10 — Full control over operation: an open-source or on-premise edition with feature parity, customer-chosen region per workspace, administrative APIs, a documented migration path in and out, and an uptime commitment with a published status history.
The Market Researcher
The whole platform is open source under AGPLv3 and runs on our own infrastructure via a one-click script, Docker or Kubernetes, with cloud survey data stored in Germany and a Management API plus documented data model to move forms and responses out. SAML and OIDC single sign-on, workspace roles at read, write and manage, and audit logs are documented, and self-hosting adds a custom public domain and our own sender address. I found no public information on user provisioning or a per-workspace region choice in the cloud service. 17 11 13 14
The Operations Manager
An open-source edition runs in my own infrastructure — Docker or Kubernetes, my PostgreSQL, my S3-compatible storage for file uploads, my identity provider with SAML or OIDC — and the cloud service is hosted in Germany. Roles at read, write and manage level per workspace plus per-survey Read and Read & Write access, audit logs, and a custom public domain for self-hosted surveys are documented, and responses export to CSV or Excel, the API, or plain SQL with the data model documented. We found no public information on user provisioning such as SCIM, white-labelling, or a published status history. 17 11 13
The HR Lead
The AGPLv3 core can be self-hosted with Docker or Kubernetes, responses sitting in our own PostgreSQL and uploads in our own S3-compatible storage, the cloud runs in Germany, SSO speaks SAML or OIDC, audit logs exist, seats are unlimited, and roles govern dashboards, workflows, integrations and API keys. Responses leave via CSV, Excel, the REST API or plain SQL. The captured pages differ on whether the dedicated cloud and managed hosting options run today or are still announced as coming. 1 2 11 17
The Academic Researcher
I can self-host the AGPLv3 core via Docker, Helm or a one-click script or use the Germany-hosted cloud, with SAML or OIDC single sign-on, audit logs, read, write and manage roles scoped per workspace, unlimited seats, a custom public domain for surveys, and responses exportable by API, CSV or Excel or readable straight from my own PostgreSQL. The licence-key model means the open-source edition is not the full suite, and we found no public information on user provisioning, per-form role granularity, or a published status history. 1 2 5 11 13 17
The Data Protection Officer
The self-hosted edition keeps responses, contacts and settings in the customer's own PostgreSQL, file uploads in their S3-compatible storage and mail through their own SMTP, with SAML or OIDC single sign-on, audit logs, and roles that separate read from write access to workflows, integrations and API keys scoped per workspace — and the vendor states no third-party access, not even itself. Responses export to CSV, Excel, direct SQL or the documented REST API against a published data model, with container images and a Helm chart making the way in and out realistic. We found no public information on user provisioning or a published uptime history, and the dedicated and managed cloud options are stated as coming. 17 13 1 15 11
The Skeptic
Self-hosting by Docker, Helm chart or one-click script, your PostgreSQL, S3-compatible storage, your SMTP, SAML/OIDC single sign-on, roles at read, write and manage per workspace, audit logs, pretty URLs and your own public domain, on an AGPLv3 code base, with a 30-day post-termination migration window and data return. The dedicated-cloud and managed options in the EU or Saudi Arabia are marked as coming, so a selectable region is not yet something a buyer can take, and white-labelling is implied by self-hosting rather than stated. 17 11 13 1 9 5
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where forms and responses are hosted, and who the subprocessors are (hosting, email delivery, payment providers, analytics, AI features). Independently sourced by the sovereignty pipeline; responses often carry personal and sometimes special-category data, so the whole chain counts, not only the database.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (email, analytics, AI features, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The Market Researcher
Formbricks GmbH is named in a German imprint with a Kiel address, survey data is stored in Germany, and the privacy policy and DPA annex carry the subprocessor list, with Microsoft and OpenAI Ireland named for AI and Stripe Payments Europe Ltd. in Dublin for billing. ISO 27001 and SOC 2 Type II are stated alongside a public DPA on standard contractual clauses with change notice and objection rights. The captured pages still flag US-headquartered parents behind the cloud infrastructure and Stripe Inc. processing billing data in the USA, and I found no public information on ownership, which keeps this below the top band. 8 3 7 17 6
The Operations Manager
Formbricks GmbH of Kiel contracts and hosts survey data in Germany, publishes its data processing agreement, lists subprocessors — OpenAI Ireland for AI and Stripe's Dublin entity for payments are named — and states ISO 27001 and SOC 2 Type II. The captured privacy policy also flags US-headquartered parents behind the server locations (AWS, Google Cloud) and Microsoft as an AI provider, with billing data separately processed in the USA, though AI can instead run on self-hosted or Germany-hosted models. Ownership of the company is not described on the captured pages. 8 3 7 9 6 17
The HR Lead
The vendor is Formbricks GmbH of Kiel, survey data is stored in Germany, the data processing agreement is public with the subprocessor list in its annex and named AI providers, and ISO 27001 and SOC 2 Type II are stated. Ownership is not documented and subprocessor locations are only partly named: the terms name Stripe's Dublin entity for payment while the privacy policy names Stripe Inc. in the USA, and servers in Germany and the EU sit on US-headquartered cloud parents, which is flagged as a US Cloud Act exposure. 3 7 8 9 17
The Academic Researcher
The contracting entity is Formbricks GmbH in Kiel under German law, survey data is stated to be stored in Germany, the data processing agreement is public with SCC-based processor clauses and an approved subprocessor list in its annex, AI models and embeddings are described as hosted in Germany, and ISO 27001 and SOC 2 Type II are stated. The privacy policy shows parts of the chain reaching US-parented providers — Amazon and Google infrastructure and Stripe for billing — and named AI providers include Microsoft and OpenAI Ireland; the captured pages also give different figures for where Stripe processes billing, and we found no public information on ownership or on the scope of the certifications. 3 4 6 7 8 9 17
The Data Protection Officer
Formbricks GmbH of Kiel is the contracting entity, cloud survey data is encrypted and stored in Germany, AI models and embeddings run in Germany on the vendor's own infrastructure, and the data processing agreement and sub-processor list are public, with Stripe Payments Europe Ltd. in Dublin named for payments and ISO 27001 and SOC 2 Type II stated. The captured privacy policy shows all listed server locations in Germany and the EU, but on AWS and Google Cloud with US-headquartered parents, and Stripe Inc. is separately named processing billing data in the USA, so a US Cloud Act exposure remains in the chain. We found no public information on the ownership structure, and the certificates are available on request rather than published with their scope, so the chain is European in entity and hosting but not end to end. 8 3 5 7 17 6
The Skeptic
A German entity in Kiel, cloud hosting in Germany, AI models and embeddings on Formbricks-owned German infrastructure, a public DPA, and ISO 27001 with SOC 2 Type II stated. The chain is not European end to end: server locations sit on AWS and Google Cloud under US parents, Stripe Inc. is named as processing billing data in the USA, Microsoft and OpenAI Ireland appear as AI providers, and I found no public information on ownership or the parent company — self-hosting is the only documented way to remove the chain. 8 3 5 6 9 17 7
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per plan and per user, response or submission limits and what happens above them, which features (logic, branding removal, SSO, EU hosting, analysis modules) need a higher plan, add-ons, minimum term and the free tier's limits.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, responses or features is unclear.
5 — Plans are public with prices and their main limits (users, responses, forms), but at least one commonly needed piece (SSO, EU hosting, extra responses, branding removal) is unpriced or "on request".
8 — Every plan priced publicly with its limits, overage or extra-response prices, feature differences per plan in a comparison table, billing period, VAT treatment and cancellation terms stated.
10 — Complete price computability: annual cost derivable for a given number of users, responses and features, with every add-on, enterprise option, support level and data-return term published.
The Market Researcher
The Community Edition is free forever and includes the builder, every question type, logic and multi-language surveys, and the paid model is an annual license metered by monthly responses and workspaces with unlimited seats. Overage billing, non-carryover of unused responses, net-of-tax treatment, the refund policy, suspension and cancellation are all spelled out in the terms. The pricing page states the team quotes after a first call, so I cannot compute a real annual cost from public pages alone. 2 9 11 1
The Operations Manager
The mechanics are stated plainly: an annual license priced by responses and workspaces with unlimited seats, overage responses billed separately (self-hosted keeps running and settles at renewal), unused responses expiring each cycle, terms of one to three years with longer terms cheaper, cancellation at any time through the end of the billing period, and fees stated net of tax. But no plan prices are published — "We quote after a first call" — and the free tier's response limits are not stated, so a buyer cannot compute the annual cost from public pages. For my worry about the bill jumping when responses spike, the model is clear but the figures are not. 2 9 1 15
The HR Lead
The Community Edition is free forever and the paid model is an annual license priced by responses and workspaces with unlimited seats, but no prices are published — the vendor quotes after a first call. The terms do spell out that unused responses expire each cycle, overage responses are billed separately, terms run one to three years with longer terms costing less per year, payments are non-refundable, taxes are extra, and cancelling keeps access to the end of the billing period. As a buyer I still cannot compute our annual cost from public pages alone. 2 9
The Academic Researcher
A free tier with no credit card and a 15-day trial, a free self-hosted Community Edition, and an unusually well-documented model — an annual licence priced by responses per month and workspaces, unlimited seats on every plan, overage responses billed separately with no carry-over, one- to three-year terms, VAT-exclusive net prices, cancellation and suspension rules — are all public. No plan prices are published, however; a quote comes after a first call, so a buyer cannot compute the real annual cost from public pages alone. 2 9 10
The Data Protection Officer
The structure is public — an annual license priced by responses per month and workspaces, unlimited seats, one- to three-year terms with longer terms costing less per year, overage responses billed separately, unused responses expiring, fees exclusive of taxes, and cancellation at any time with access to the end of the billing period — and a free plan and a free-forever Community Edition exist with a 15-day trial and no credit card. The paid prices themselves are not published: the vendor quotes after a first call. I cannot compute an annual cost for a given workload from the public pages alone. 2 9 10 11
The Skeptic
The mechanics are unusually well documented: an annual license priced by responses per month and workspaces, unlimited seats, one-, two- or three-year terms, overage billed separately, unused responses not carried over, net prices excluding taxes, cancellation anytime, non-refundable — but not one euro figure is public, and the pricing page says a quote comes after a first call. A buyer cannot compute a single annual cost without a call, so the genuinely free Community Edition and the contract mechanics only lift it above the bottom. 2 9 1 10
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Formbricks
Is Formbricks European?
Yes. whats-best.ai classifies Formbricks as EU-Made.
Where does Formbricks store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention Germany as hosting location, per the vendor’s page captured 28 Oct 2026.
Does Formbricks have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to Formbricks?
As of 3 Nov 2026, the panel rates easyfeedback (3.5/5), Netigate (3.5/5) and QuestionPro (3.5/5) highest among the other 19 Forms & Surveys products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is easyfeedback (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Formbricks alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 28 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Open source, Hosting location, Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 13 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 10 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage formbricks.com Checked 28 Oct 2026 Details →
- 2 Pricing page formbricks.com Checked 28 Oct 2026 Details →
- 3 GDPR page formbricks.com Checked 28 Oct 2026 Details →
- 4 Security page formbricks.com Checked 28 Oct 2026 Details →
- 5 AI and privacy page formbricks.com Checked 28 Oct 2026 Details →
- 6 Privacy policy formbricks.com Checked 28 Oct 2026 Details →
- 7 Data processing agreement formbricks.com Checked 28 Oct 2026 Details →
- 8 Legal notice formbricks.com Checked 28 Oct 2026 Details →
- 9 Terms of service formbricks.com Checked 28 Oct 2026 Details →
- 10 Form & survey building — found from sitemap formbricks.com Checked 28 Oct 2026 Details →
- 11 Form & survey building — found from sitemap formbricks.com Checked 28 Oct 2026 Details →
- 12 Distribution, response collection & workflows — found from sitemap formbricks.com Checked 28 Oct 2026 Details →
- 13 Distribution, response collection & workflows — found from sitemap formbricks.com Checked 28 Oct 2026 Details →
- 14 Survey analysis & reporting — found from sitemap formbricks.com Checked 28 Oct 2026 Details →
- 15 Survey analysis & reporting — found from sitemap formbricks.com Checked 28 Oct 2026 Details →
- 16 Consent, GDPR & respondent data — found from sitemap formbricks.com Checked 28 Oct 2026 Details →
- 17 Hosting choice, teams & portability — found from sitemap formbricks.com Checked 28 Oct 2026 Details →
- 18 Code repository (open-source licence) — found from the homepage github.com Checked 1 Nov 2026 Details →