Forms & Surveys
LimeSurvey
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by LimeSurvey GmbH · www.limesurvey.org
Compare with SurveyMonkey → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
LimeSurvey at a glance
- Vendor
- LimeSurvey GmbH
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 28 Oct 2026
- Panel verdict
- The AI panel rates LimeSurvey 3/5, the mean of 6 judges. LimeSurvey is an open-source survey platform from LimeSurvey GmbH of Hamburg, offered as a cloud service and as a free self-hosted Community Edition under GPLv2. how scores are made
- As of
- Vendor pages captured 28 Oct 2026 to 1 Nov 2026; evaluated by the panel 29 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
LimeSurvey is an open-source survey platform from LimeSurvey GmbH of Hamburg, offered as a cloud service and as a free self-hosted Community Edition under GPLv2. The bench scores it strongest at form building, where five of six judges gave 9 on 28+ question types, conjoint/CBC and maxDiff research methods, relevance equations and quick translation across 80+ languages. Collection and workflows holds at 7 on mass invitations with bounce handling, quotas and unique access codes per respondent. It is weakest at analysis and reporting, scored 5-6: filtering, charts and exports to SPSS, R and Stata are documented, with no public information on cross-tabulation, significance testing, weighting or open-text analysis. Pricing transparency splits 6 against 7 — four judges hold back over the contact-sales Corporate plan and the absence of published overage prices. Consent and data protection divides 6 against 7 over undocumented retention automation and per-respondent erasure tools. One split is anomalous: the data protection officer's computed scores stand at 0 across every criterion while their written rationale cites the same documented strengths and gaps as the rest of the bench.
Speaks for it
- Form building scored 9 from five of six judges on 28+ question types, conjoint/CBC and maxDiff research methods, relevance equations and 80+ languages with quick translation.
- Collection and workflows scored 7 from those five judges for mass invitations and reminders with bounce handling, quotas and unique access codes per respondent.
- Hosting and administration scored 7-8 on a free GPLv2 self-hosted Community Edition, a choice of seven hosting regions, and data stored in Germany on Hetzner Online GmbH hardware.
- Sovereignty scored 6-7 on a named Hamburg controller, third-country transfers only under EU standard contractual clauses or an adequacy decision, and AI functions running on an open-source model in the provider's own infrastructure.
- Responses export to SPSS, R, Stata, CSV, Excel and PDF, with public statistics and a data integrity check documented.
Held against it
- Analysis and reporting scored 5-6, with no public information on cross-tabulation, significance testing, weighting or open-text and sentiment analysis.
- Responses are by default not encrypted at rest, with encryption configurable only for certain question types and participant fields.
- No public information on retention periods with automatic deletion of responses or per-respondent access and erasure tooling.
- The Corporate plan carrying SSO, SAML/LDAP and the dedicated server is contact sales only, with no public information on extra-response or overage prices.
- ISO 27001 is stated as in progress rather than achieved, and no public information on a complete subprocessor list with locations.
Best for
- You run multilingual research or academic surveys and need conjoint/CBC, maxDiff, randomisation, quotas and exports to SPSS or R.
- Your faculty or team can operate its own infrastructure — the Community Edition is downloadable free of charge under GPLv2 for self-hosting.
- You must document a European chain for an ethics board or works council: a Hamburg controller, responses stored within Germany, third-country transfers only under EU standard contractual clauses or an adequacy decision, and AI functions on an open-source model in the provider's own infrastructure.
- You invite and remind large participant panels, using quotas, unique access codes per respondent, bounce handling and the option of your own mail server.
Avoid if
- You need cross-tabulation, significance testing, weighting or open-text coding inside the product — the documented analysis tools are filtering, charts, quick statistics and export, and the market researcher expects to finish analysis in SPSS by hand.
- You require encryption at rest by default for all responses — the pages state data is by default not encrypted at rest, with encryption configurable only for certain question types and participant fields.
- You need a guaranteed availability commitment — the terms offer only reasonable efforts toward 99% calculated per month, with no guarantee.
- You need SSO or a dedicated server on a self-service budget — both sit on the Corporate plan, which is contact sales with custom pricing.
The scores
| Criterion | Panel median |
|---|---|
| Form & survey building | 4.5 of 5 |
| Distribution, response collection & workflows | 3.5 of 5 |
| Survey analysis & reporting | 3 of 5 |
| Consent, GDPR & respondent data | 3.5 of 5 |
| Hosting choice, teams & portability | 3.5 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 3 of 5 |
Form & survey building
panel disagrees
Show reasoningHide reasoning
How this is scored
What can be built without code: question and field types, conditional logic and branching, piping and hidden fields, calculations, multi-page forms and progress, templates, design and branding, multiple languages, and accessible output for respondents.
0 — Not a form or survey builder; questions cannot be authored in the product.
3 — A builder with the common question types and a few templates; logic, branding or languages are basic or not described.
5 — A drag-and-drop builder with a wide range of question types, conditional logic that shows, hides or skips questions, multi-page forms, a template library, and the customer's logo, colours and fonts.
8 — Advanced logic with piping, hidden fields, calculations and scoring, randomisation, surveys translated into several languages from one master, reusable question libraries, custom CSS or themes, and accessible forms with a named standard (WCAG 2.1 AA or BITV) stated.
10 — Best-in-class authoring: complex research designs (loops, quotas in logic, conjoint or MaxDiff), versioned forms with change history, a published accessibility conformance report, and every element of a form available through the API.
The Market Researcher
The authoring evidence is research-grade: conjoint/CBC and maxDiff methods, quotas, piping and micro-tailoring, relevance equations, randomisation of questions and groups, 28+ question types including NPS, 80+ languages with quick translation, 800+ templates, reusable questionnaire labels and custom HTML/CSS/JS, with WCAG 2.2 AA named. That covers nearly everything my four-language waves need; we found no public information on versioned forms with change history or a published accessibility conformance report, which holds it just short of the top. 1 2 3 4 8
The Operations Manager
Everything my colleagues need to build without IT is documented: 28+ question types including matrix variants, skip logic with piping and valuation rules, randomisation, relevance equations, 800+ templates, custom HTML/CSS design, and 80+ languages with quick translation. Accessibility is stated against WCAG 2.2 AA and research methods like conjoint and MaxDiff go well past routine form work; we found no public information on form versioning with change history or a published accessibility conformance report. 1 2 4 8
The HR Lead
The captured pages document 28+ question types including nine matrix variants and an NPS type, skip logic with piping, relevance equations and randomisation of questions and groups, reusable questionnaire labels, 80+ languages with quick translation, custom HTML/CSS/JS design, and WCAG 2.2 AA named, plus conjoint/CBC, MaxDiff and quotas among the research methods. We found no public information on versioned forms with change history or a published accessibility conformance report. 1 2 3 4
The Academic Researcher
The authoring evidence reaches research level: randomisation of questions and groups, relevance equations, piping and micro-tailoring, 28+ question types including matrix variants and semantic differential, quota setting, reusable questionnaire labels, custom HTML/CSS/JavaScript, surveys in 80+ languages, and WCAG 2.2 AA stated by name, with conjoint/CBC and MaxDiff methods listed for research designs. We found no public information on versioned forms with change history or a published accessibility conformance report, which keeps it just short of the top. 1 2 3 4
The Data Protection Officer
Authoring is documented at research level: 28+ question types including conjoint/CBC and MaxDiff, quotas, relevance equations, piping and micro-tailoring, randomisation of questions and groups, 800+ templates with a template builder, 80+ languages, custom HTML/CSS/JS and reusable questionnaire labels, and accessibility stated against WCAG 2.2 AA. We found no public information on versioned forms with change history or a published accessibility conformance report, which is what separates the top level. 1 2 3 4 8 9
The Skeptic
This is genuinely deep authoring: 28+ question types including nine matrix variants, skip logic, piping, relevance equations, randomisation of questions and groups, 80+ languages with quick translation, custom HTML/CSS/JS, more than 800 templates, a named WCAG 2.2 AA standard, and research designs such as conjoint/CBC and maxDiff on top. We found no published accessibility conformance report and no public information on versioned forms with change history, which is what keeps the top slot closed. 1 2 3 4 8 9
Distribution, response collection & workflows
panel disagrees
Show reasoningHide reasoning
How this is scored
How forms reach people and what happens to an answer: share links, embedding, QR codes, email invitations with reminders, contact lists and panels, offline or kiosk collection, file uploads, payments and signatures inside the form, notifications, approval or assignment of submissions, and automations that pass a response on to other tools.
0 — No way to collect responses from other people; the product only analyses data collected elsewhere.
3 — A share link and an embed code, with responses visible in the product; invitations, notifications and onward workflows are basic or not described.
5 — Links, embedding and QR codes, email notifications on submission, file uploads, a few native integrations (spreadsheets, CRM, chat) plus a connector service such as Zapier or Make, and either email invitations with reminders or payments inside the form.
8 — Invitations to managed contact lists with reminders and unique links, response quotas and closing rules, offline or kiosk collection, submissions routed for approval or assignment, conditional notifications, documented webhooks and a REST API to read and write responses.
10 — Collection at research and process scale: panel or sample sourcing, multi-channel distribution (email, SMS, web, app intercept) with deduplication, workflows with branching and audit trail, and every response event exposed to the customer's systems in real time with a stated delivery guarantee.
The Market Researcher
Closed-access surveys with a participants table and unique access codes, mass mailing of invitations and reminders with bounce handling, customisable email templates and the option to use our own mail server, quotas, scheduled start and end, and panel integration with end URLs and external parameters — this is exactly the invitation-and-reminder machinery my waves run on. Embedding, QR codes, password-protected links and an XML-RPC/JSON-RPC API round it out; we found no public information on offline or kiosk collection, approval routing or webhooks. 1 2 4
The Operations Manager
Distribution and participant management are covered well: open or closed access with unique access codes per respondent, mass mailing of invitations and reminders, embedding, QR codes, captcha, save-and-resume, quotas, scheduled start and end, and upload storage on the plans, so the photos on our damage reports would land. The captured pages do not show payment or signature capture in the form, approval routing, notifications on arrival, webhooks, or native connectors to a CRM or spreadsheet; onward automation rests on the XML-RPC/JSON-RPC API and paid custom plugins. 1 2 4
The HR Lead
Invitations and reminders go through mass mailing to a survey participants table with unique access codes per respondent, automatic bounce handling, quotas and scheduled start and end times, alongside QR codes, embedding, password-protected links, panel integration and a RemoteControl API via XML-RPC/JSON-RPC. We found no public information on approval routing, conditional notifications, webhooks or offline collection. 1 2 4
The Academic Researcher
Distribution is built for panels: mass mailing of invitations and reminders, a participants table with unique access codes per respondent, open and closed access modes, quota setting, scheduled start and end times, panel integration with end URLs and URL parameters, QR codes, embedding, and a RemoteControl API over XML-RPC/JSON-RPC. We found no public information on offline or kiosk collection, approval routing of submissions, conditional notifications, or webhooks, so I cannot place it higher. 1 2 4
The Data Protection Officer
Distribution and follow-up are well documented: QR codes, embedding, password-protected links, closed-access surveys with unique access codes per respondent, mass mailing of invitations and reminders with bounce handling, quotas, scheduled start and end times, panel integration with predefined end URLs and external parameters, plus a RemoteControl API. We found no public information on approval or assignment of submissions, conditional notifications, webhooks, or offline and kiosk collection. 1 2 4
The Skeptic
Embedding, QR codes, password-protected links, open or closed access with unique access codes per respondent, mass invitations and reminders with bounce handling and the option of your own mail server, quotas and panel integration with end URLs and URL parameters, scheduled start and end, and a RemoteControl API via XML-RPC/JSON-RPC. We found no public information on webhooks, approval routing, or offline and kiosk collection, and the API is not described as REST. 1 2 4
Survey analysis & reporting
panel disagrees
Show reasoningHide reasoning
How this is scored
What the product does with the answers: live results and charts, filters and segments, cross-tabulation, NPS, CSAT and other standard scores, open-text and sentiment analysis, shareable dashboards and reports, and exports to the formats analysts use (CSV, Excel, SPSS, R).
0 — No view of results inside the product; submissions can only be forwarded or downloaded one at a time.
3 — A table of responses with simple charts per question and a CSV export; filters, comparisons and report sharing are basic or not described.
5 — Charts per question, filters and segments, at least one comparison or cross-tab view, standard scores such as NPS, shareable or exportable reports (PDF, presentation), and exports to CSV and Excel.
8 — Cross-tabulation with significance testing, weighting, open-text coding or sentiment analysis, trend reports across survey waves, dashboards for different audiences with permissions, and SPSS or R exports with labels.
10 — A research-grade analysis environment: statistical models beyond cross-tabs (driver analysis, regression), benchmarks, text analytics with themes the customer can edit, and every analysis reproducible from documented exports or an analytics API.
The Market Researcher
I see charts, filtering, a real-time response summary, quick statistics and exports to SPSS, R, Stata, CSV, Excel and PDF, with NPS available as a question type. But we found no public information on cross-tabulation with significance testing, weighting, or open-text coding and sentiment analysis — so before the board meeting I would still be exporting to SPSS and theming open answers by hand. 1 2 4
The Operations Manager
Live response summaries, filtering, graphs and quick statistics with graphical export cover day-to-day use, and exports go to CSV, Excel, PDF, SPSS, R and Stata plus public statistics. We found no public information on cross-tabulation with significance testing, weighting, or open-text and sentiment analysis. 1 2 4
The HR Lead
Responses can be filtered, charted, monitored in real time and exported to SPSS, R, Stata, CSV, Excel and PDF, with quick graphical statistics and backend data entry. We found no public information on cross-tabulation with significance testing, open-text or sentiment analysis, or trend reports across survey waves. 1 2 4
The Academic Researcher
Live response summaries, filtering, graphs and charts, quick statistics with graphical evaluation, and exports to SPSS, R, Stata, CSV, Excel and PDF cover the minimum my faculty needs, though the pages do not state whether variable and value labels survive the SPSS and R exports. We found no public information on cross-tabulation with significance testing, weighting, or open-text coding and sentiment analysis, which is what would lift this to research grade. 1 2 4
The Data Protection Officer
The documented analysis covers filtering, graphs and charts, a real-time response summary, quick statistics with graphical evaluation, backend data entry, a data integrity check, a Net Promoter Score question type, and exports to SPSS, R, Stata, CSV, Excel and PDF. We found no public information on cross-tabulation with significance testing, weighting, open-text or sentiment analysis, trend reports across waves, or audience-specific dashboards with permissions. 1 2 3 4
The Skeptic
Real-time response monitoring, filtering, graphs and quick statistics with export, public statistics, a data integrity check, and exports to SPSS, R, Stata, CSV, Excel and PDF — the formats researchers actually use. We found no public information on cross-tabulation, significance testing, weighting, or open-text and sentiment analysis, so the export formats are strong but the analysis environment beyond charts and filters is undescribed. 1 2 4
Consent, GDPR & respondent data
panel disagrees
Show reasoningHide reasoning
How this is scored
What the product gives the customer to collect personal data lawfully: consent and privacy-notice fields, anonymous surveys that really drop IP addresses and identifiers, retention periods and automatic deletion, handling of access and erasure requests, encryption of responses, a data processing agreement, and controls over cookies and tracking on the form itself.
0 — The product collects no personal data from respondents, so there is nothing to protect; or it is a different kind of product.
3 — A privacy policy and a statement of GDPR compliance, with a checkbox field usable for consent; anonymity, retention and deletion are not described.
5 — A data processing agreement offered to customers, a consent or privacy-notice field, an anonymous mode that does not store IP addresses, responses deletable by the customer, and encryption in transit and at rest stated.
8 — Retention periods with automatic deletion, tools for access and erasure requests per respondent, field-level encryption or masking of sensitive answers, forms that set no tracking cookies by default, a published list of technical and organisational measures, and a named data protection officer.
10 — Data protection by design and evidenced: end-to-end or customer-key encryption of responses, documented data minimisation defaults, a DPA with audit rights and subprocessor change notice, records of consent kept with each response, and an independent audit of the privacy controls published.
The Market Researcher
A named data protection officer, a data processing agreement in the customer account, anonymous survey mode, SSL-encrypted transport with configurable encryption of participant fields and of certain response types at rest, session-only cookies claimed exempt from consent, and third-country transfers only under standard contractual clauses or adequacy decisions. Free accounts are deleted after 24 months of non-use; we found no public information on tools for access and erasure requests per respondent. 2 5 7 10 11
The Operations Manager
A data processing agreement is stored in the customer account, a named data protection officer is published, anonymous surveys are a first-class mode, transport uses SSL with daily encrypted backups, and the cookie FAQ explains only strictly necessary session cookies are set so no consent banner is needed. Encryption of responses at rest is configurable per question type and participant field rather than on by default, and we found no public information on retention automation or tooling for access and erasure requests per respondent. 1 5 10 11
The HR Lead
Anonymous surveys with an explicit anonymous mode, a data processing agreement in the customer account, a named data protection officer, 2048-bit SSL in transit, configurable always-encrypted storage for sensitive answers and participant fields, and the stated position that only strictly necessary session cookies are set cover most of what my works council asks about. We found no public information on customer-defined retention periods with automatic deletion or on tooling for per-respondent access and erasure requests. 2 5 7 10 11
The Academic Researcher
The basics my ethics board asks about are documented: anonymous surveys, a data processing agreement stored in the customer account, a named data protection officer, 2048-bit SSL in transit, encryption at rest configurable for specific question types and participant fields, third-country transfers only under standard contractual clauses, and a statement that no profiles of survey participants are created; the vendor states its session cookies are strictly necessary and therefore exempt from consent. We found no public information on consent or privacy-notice fields as such, retention periods with automatic deletion of responses, or tools for access and erasure requests per respondent. 1 5 10 11
The Data Protection Officer
The contractual layer is solid: a data processing agreement stored in the customer account, a named data protection officer, anonymous surveys, 2048-bit SSL in transit, configurable encryption at rest for selected question responses and participant fields, third-country transfers only on standard contractual clauses or an adequacy decision, and a documented position that session cookies are strictly necessary. We found no public information on a dedicated consent or privacy-notice field, whether the anonymous mode drops IP addresses, retention periods with automatic deletion of responses, or per-respondent access and erasure tooling, and encryption at rest is not the default. 1 5 7 10 11
The Skeptic
A data processing agreement sits in the customer account, a data protection officer is named, anonymous surveys are an explicit option with the vendor stating it stores no personal data from surveys, third-country transfers run only on standard contractual clauses or adequacy, session cookies are argued strictly necessary without consent, and specific question-type responses and participant fields can be encrypted. I hold it below the top bands because the encryption FAQ itself says data is by default not encrypted at rest, we found no statement that the anonymous mode drops IP addresses, and no public information on response retention with automatic deletion or respondent-level access and erasure tools. 1 2 5 10 11
Hosting choice, teams & portability
panel disagrees
Show reasoningHide reasoning
How this is scored
What the customer may choose about where and how the product runs and who uses it: a selectable data region or EU-only hosting, self-hosting or an on-premise edition, team workspaces with roles and permissions, single sign-on, an audit log, custom domains and white-labelling, and a complete export of forms and responses that another tool can import.
0 — A single-user tool with no export of forms or responses.
3 — Shared access for a team and a response export; data location, roles and single sign-on are not described.
5 — Hosting location stated with an EU option, team workspaces with at least two roles, single sign-on on a higher plan, a custom domain or removed vendor branding, and an export of all responses.
8 — EU-only hosting selectable per account or a self-hosted edition, granular roles per form or folder, SSO with SAML and user provisioning, an audit log, white-labelling, and forms and responses exportable in a documented format with an API.
10 — Full control over operation: an open-source or on-premise edition with feature parity, customer-chosen region per workspace, administrative APIs, a documented migration path in and out, and an uptime commitment with a published status history.
The Market Researcher
A self-hosted Community Edition under GPLv2, hosting region choice including the EU with data stored in Germany at Hetzner, SAML/LDAP single sign-on on the Corporate plan, white-label and custom domains, and exports of questions, surveys and responses alongside an API give a research team real control. We found no public information on granular per-form roles or an audit log, and availability is described as reasonable efforts toward 99% per month with no guarantee. 1 4 5 7
The Operations Manager
This is where they stand out for an operations buyer: a free GPLv2 self-hosted Community Edition, a choice of seven hosting regions with data stored in Germany on Hetzner hardware, SSO with SAML and LDAP on the Corporate plan, white-label and custom domains, and exports in documented formats backed by a remote-control API. We found no public information on an audit log or granular roles per form or folder. 1 2 4 5 7
The HR Lead
A free GPLv2 self-hosted Community Edition, selectable data centers (EU, US, and more) with data stored in Germany on Hetzner, SSO with SAML and LDAP on the Corporate plan, white-label domains and survey import/export with an API are all documented. We found no public information on an audit log or granular per-form roles, and the terms state only reasonable efforts toward 99% availability. 1 4 5 7
The Academic Researcher
The Community Edition under GPLv2, downloadable for self-hosting, is exactly the licence my faculty can run itself, and the cloud offers a choice of hosting regions including the EU, with data stored in Germany on Hetzner infrastructure; SSO with SAML and LDAP sits on the Corporate plan, white-label domains and custom branding on Expert, and questions and surveys can be imported and exported. We found no public information on granular roles per form or folder, an audit log, or user provisioning, which is what separates a department-grade platform from a team one. 1 4 5 7
The Data Protection Officer
Control over operation is unusually good: a self-hosted Community Edition under GPLv2, a choice of hosting regions with EU and German hosting, SSO with SAML and LDAP on the Corporate plan, white-label and custom domains, import and export of questions and surveys, documented export formats and a RemoteControl API. We found no public information on granular roles per form or folder, user provisioning, or an audit log, and the 99% availability is offered as reasonable efforts without a guarantee. 1 2 4 5 7
The Skeptic
Seven selectable hosting regions including the EU with data stored in Germany on named Hetzner hardware, a free self-hosted GPLv2 Community Edition, SSO with SAML and LDAP on the Corporate plan, white-label domains with branding removal, and responses exportable in six documented formats alongside the RemoteControl API. We found no public information on an audit log or granular per-form roles, and the 99% availability clause is a reasonable-efforts commitment rather than a guarantee. 1 4 5 7
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where forms and responses are hosted, and who the subprocessors are (hosting, email delivery, payment providers, analytics, AI features). Independently sourced by the sovereignty pipeline; responses often carry personal and sometimes special-category data, so the whole chain counts, not only the database.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (email, analytics, AI features, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The Market Researcher
LimeSurvey GmbH of Hamburg is the contracting entity and data controller, responses are hosted on named German infrastructure (Hetzner Online GmbH, Gunzenhausen) where the hoster is stated to have no direct access, and Zoho is named as a subprocessor engaged under EU standard contractual clauses. ISO 27001 is stated as in progress, and we found no public information on ownership or a complete subprocessor list with their locations. 1 4 5 7
The Operations Manager
The chain that matters to us is documented and European: LimeSurvey GmbH of Hamburg is the contracting entity with a German register number and VAT ID, responses sit on Hetzner Online GmbH hardware in Gunzenhausen, Germany, a DPA is published, third-country transfers use EU standard contractual clauses, and the AI functions run on an open-source model in provider-controlled infrastructure. The gaps keep it short of the top: ISO 27001 is stated only as in progress, one subprocessor (Zoho) is named rather than a published list with locations, and we found no public information on ownership. 1 4 5 6 7
The HR Lead
The contracting entity is LimeSurvey GmbH in Hamburg with a register number and German VAT ID, hosting runs on named German infrastructure (Hetzner in Gunzenhausen), the AI functions run on an open-source model in the provider's own infrastructure, and the named third-country processor Zoho is covered by EU standard contractual clauses. ISO 27001 is stated only as in progress, the data processing agreement is stored in the customer account rather than published, and we found no public information on a complete subprocessor list with locations. 1 4 5 6 7
The Academic Researcher
The chain I must document in the ethics file is largely proven: the contracting entity is LimeSurvey GmbH of Hamburg, data is stored in Germany on Hetzner Online GmbH infrastructure, a data processing agreement exists, transfers to third countries run only on standard contractual clauses, the named subprocessor Zoho is covered by such clauses, and the AI functions run on an open-source model in provider-controlled infrastructure. ISO 27001 is stated as in progress rather than achieved, and we found no public information on the company's ownership or a complete subprocessor list with locations, so I stop short of the higher level. 1 5 6 7
The Data Protection Officer
The core chain is European and named: LimeSurvey GmbH registered in Hamburg, data stored within Germany on hardware hosted by Hetzner Online GmbH of Gunzenhausen with a statement that Hetzner has no direct access, a data processing agreement available, a named data protection officer, and the Zoho subprocessor disclosed with EU standard contractual clauses. The rest of the chain is not listed with locations, we found no public information on ownership, and ISO 27001 is stated as in progress rather than achieved. 1 5 6 7
The Skeptic
LimeSurvey GmbH of Hamburg is the named controller with a register entry and VAT ID, responses sit in Germany on Hetzner hardware the hoster cannot log into, third-country transfers run only on standard contractual clauses or an adequacy decision, Zoho is named as a subprocessor under such clauses, and — the part I always check — the AI functions run on an open-source model in the provider's own infrastructure with no external AI calls. ISO 27001 is described as in progress rather than achieved, and we found no locations stated for subprocessors beyond the hoster. 1 4 5 6 7
Pricing transparency
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per plan and per user, response or submission limits and what happens above them, which features (logic, branding removal, SSO, EU hosting, analysis modules) need a higher plan, add-ons, minimum term and the free tier's limits.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, responses or features is unclear.
5 — Plans are public with prices and their main limits (users, responses, forms), but at least one commonly needed piece (SSO, EU hosting, extra responses, branding removal) is unpriced or "on request".
8 — Every plan priced publicly with its limits, overage or extra-response prices, feature differences per plan in a comparison table, billing period, VAT treatment and cancellation terms stated.
10 — Complete price computability: annual cost derivable for a given number of users, responses and features, with every add-on, enterprise option, support level and data-return term published.
The Market Researcher
Basic at 34€/month billed monthly, Expert at 29€/month billed annually and Business at 75€/month billed annually are published with their user, response and storage limits, VAT (19%) included, support levels per plan, and online cancellation on two weeks' notice. But single sign-on sits on the Corporate plan, which is contact sales, and we found no public information on overage or extra-response prices — a real question when a wave blows past 10,000 responses a year. 4 7
The Operations Manager
Plan prices, limits and VAT are public: Expert at 29€/month billed annually with 10,000 responses/year and 3 admin users, Basic at 34€/month billed monthly with 1,000 responses/month and 250 MB upload storage, Business at 75€/month billed annually, plus two-week online cancellation and quarterly price-adjustment terms with notice. For a buyer like me the gaps are real: the Corporate plan with SSO and the dedicated server is 'Contact sales', the captured pages do not show the Business plan's response limits or the cost of exceeding a response limit, and plugin installation carries extra fees, so the cost of a growing response volume is not computable from these pages alone. 4 7
The HR Lead
Basic is 34€ per month billed monthly, Expert 29€ and Business 75€ per month billed annually, all including 19% VAT, with stated limits for Basic (1 admin user, 1,000 responses per month, 250 MB) and Expert (3 admin users, 10,000 responses per year, 1 GB) and a two-week online cancellation right. The Corporate plan carrying SSO, SAML and the dedicated server is "Contact sales", and we found no public information on overage or extra-response prices or the Business plan's user and response limits. 4 7
The Academic Researcher
Three plans are priced publicly with their limits — Expert at "29€*/ month billed annually", Basic at "34€*/ month billed monthly", Business at "75€*/ month billed annually", all stated as including VAT (19%), with limits such as 1 admin and 1,000 responses per month on Basic and 3 admins and 10,000 responses per year on Expert — and online cancellation with two weeks' notice is in the terms. The Corporate plan carrying SSO, LDAP/SAML and a dedicated server is contact sales only, and we found no public information on extra-response or overage prices or the free tier's usage limits. 4 7
The Data Protection Officer
Most of the annual cost is computable from public pages: Basic at 34€*/ month billed monthly, Expert at 29€*/ month billed annually, Business at 75€*/ month billed annually, all prices including VAT (19%), with plan limits such as 1 000 responses/month and 250 MB upload on Basic and 10 000 responses/year on Expert, online termination at two weeks' notice, and quarterly price adjustments with advance notice. The Corporate plan is Contact sales with custom pricing, we found no public information on overage or extra-response prices, and plugin installation and updates carry extra fees that are not priced. 4 7
The Skeptic
Prices for three plans are public with billing period and VAT-inclusive figures (Basic at 34€/month billed monthly, Expert at 29€/month billed annually, Business at 75€/month billed annually), Basic and Expert limits for users, responses and storage are stated, the free tier's inactivity rules are in the terms, and cancellation is online with two weeks' notice. The Corporate plan that carries SSO and the dedicated server is contact-sales only, the captured pricing page gives no limits for the Business plan, the pages give no price for extra responses or plugin installation and updates, and per the terms the free service may display the vendor's own and third parties' advertisements. 4 7
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about LimeSurvey
Is LimeSurvey European?
Yes. whats-best.ai classifies LimeSurvey as EU-Made.
Where does LimeSurvey store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does LimeSurvey have a free plan?
Yes. LimeSurvey has a free plan, per the vendor’s page captured 28 Oct 2026.
What are the best alternatives to LimeSurvey?
As of 3 Nov 2026, the panel rates Formbricks (4/5), easyfeedback (3.5/5) and Netigate (3.5/5) highest among the other 19 Forms & Surveys products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Formbricks (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: LimeSurvey alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 28 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Open source, Hosting location, Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 7 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (12)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.limesurvey.org Checked 28 Oct 2026 Details →
- 2 Features page (surveys) www.limesurvey.org Checked 28 Oct 2026 Details →
- 3 Features page (forms) www.limesurvey.org Checked 28 Oct 2026 Details →
- 4 Pricing page www.limesurvey.org Checked 28 Oct 2026 Details →
- 5 Privacy policy www.limesurvey.org Checked 28 Oct 2026 Details →
- 6 Legal notice www.limesurvey.org Checked 28 Oct 2026 Details →
- 7 Terms of service www.limesurvey.org Checked 28 Oct 2026 Details →
- 8 Form & survey building — found from sitemap www.limesurvey.org Checked 28 Oct 2026 Details →
- 9 Form & survey building — found from sitemap www.limesurvey.org Checked 28 Oct 2026 Details →
- 10 Consent, GDPR & respondent data — found from sitemap www.limesurvey.org Checked 28 Oct 2026 Details →
- 11 Consent, GDPR & respondent data — found from sitemap www.limesurvey.org Checked 28 Oct 2026 Details →
- 12 Code repository (open-source licence) — found from the homepage github.com Checked 1 Nov 2026 Details →