Forms & Surveys
Paperform
Provenance unknown Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 2 of 6 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Paperform · paperform.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Paperform at a glance
- Vendor
- Paperform
- Headquarters
- Incorporated in United States source, captured 3 Nov 2026
- Data hosting
- Outside the EU by default source, captured 3 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 3 Nov 2026
- Panel verdict
- The AI panel rates Paperform 2/5, the mean of 6 judges. Paperform is an online form and survey builder. how scores are made
- As of
- Vendor pages captured 3 Nov 2026; evaluated by the panel 3 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Paperform is an online form and survey builder. Scores peak for form building and collection and workflows, at 6 to 7, built on conditional logic, live Excel-style calculations, 30,000-plus templates, embeds, payments, e-signature and Stepper approval routing, with hosting and administration at 6 for workspaces, single sign-on and access controls. Analysis and reporting lands at 4 — submissions export to CSV, the vendor states direct Excel export is not supported, and we found no public information on filters, cross-tabulation or standard scores. Consent and data protection also sits at 4, with no public information on a data processing agreement or anonymous mode and deletion tied to deleting the account. The clearest split is sovereignty, one judge at 2 and four at 4: the low score cites a stated United States domicile and data that may be stored in the United States, Australia or Singapore, while the higher scores credit the Vienna Article 27 representative, standard contractual clauses and a public subprocessor list. One judge scored zero on every criterion, and no paid plan price appears on the captured pages.
Speaks for it
- Conditional show and hide logic, live Excel-style calculations and a 30,000-plus template library underpin form building scores of 6 to 7
- Collection spans standalone links, inline and popup embeds, email invitations, payments, e-signature and file uploads, with webhooks, Zapier, Make and Stepper approval routing
- Hosting and administration scored 6 on workspaces, single sign-on, granular access controls, custom domains and a documented two-tier API
- The privacy policy sets out controller and processor roles, an Article 27 representative in Vienna, standard contractual clauses and a public subprocessor list
- A free plan and a seven-day trial with no credit card required are public
Held against it
- Analysis and reporting rests on CSV export and AI Insights summaries — the vendor states direct Excel export is not supported — with no public information on filters, cross-tabulation or standard scores
- We found no public information on a data processing agreement, an anonymous mode, or encryption of responses in transit and at rest
- The policy states personal information cannot be deleted except by also deleting the account, under purpose-based retention
- The policy states a United States domicile while the legal contact gives a New South Wales address, and data may be stored in the United States, Australia or Singapore
- A connected AI assistant can receive submissions including respondents' personal information, though it can be disconnected in settings, and Google Analytics is used on the services
Best for
- You need a general-purpose builder with conditional logic and live calculations for pricing, bookings or lead capture
- Your team wants submissions routed into CRMs, spreadsheets and chat through native integrations, Zapier, Make, webhooks or Stepper approvals
- You manage several clients or brands and need workspaces, branded themes and custom domains
- You analyse responses downstream in your own tools, where a CSV export is sufficient
Avoid if
- You need in-tool analysis such as cross-tabulation, filters or standard scores, since submissions export to CSV and the vendor states direct Excel export is not supported
- You must delete respondents' answers on a set schedule, as the policy ties deleting personal information to also deleting the account
- Your respondents' data must stay in the EU by default, as the EU region appears only as an Enterprise secondary region and data may be stored in the United States, Australia or Singapore
- Your compliance review cannot accept Google Analytics on the service or an AI assistant path that can receive submissions including respondents' personal information
The scores
| Criterion | Panel median |
|---|---|
| Form & survey building | 3 of 5 |
| Distribution, response collection & workflows | 3.5 of 5 |
| Survey analysis & reporting | 2 of 5 |
| Consent, GDPR & respondent data | 2 of 5 |
| Hosting choice, teams & portability | 3 of 5 |
| European sovereignty | 2 of 5 |
Form & survey building
panel disagrees
Show reasoningHide reasoning
How this is scored
What can be built without code: question and field types, conditional logic and branching, piping and hidden fields, calculations, multi-page forms and progress, templates, design and branding, multiple languages, and accessible output for respondents.
0 — Not a form or survey builder; questions cannot be authored in the product.
3 — A builder with the common question types and a few templates; logic, branding or languages are basic or not described.
5 — A drag-and-drop builder with a wide range of question types, conditional logic that shows, hides or skips questions, multi-page forms, a template library, and the customer's logo, colours and fonts.
8 — Advanced logic with piping, hidden fields, calculations and scoring, randomisation, surveys translated into several languages from one master, reusable question libraries, custom CSS or themes, and accessible forms with a named standard (WCAG 2.1 AA or BITV) stated.
10 — Best-in-class authoring: complex research designs (loops, quotas in logic, conjoint or MaxDiff), versioned forms with change history, a published accessibility conformance report, and every element of a form available through the API.
The Market Researcher
Conditional show/hide logic, live calculation fields with Excel-style functions and switch rules, AI-generated forms and scoring, guided one-question-at-a-time or classic layouts, 30,000+ templates and full theme branding cover the questionnaire basics well. I found no public information on piping, hidden fields, randomisation, reusable question libraries, quotas in logic or a named accessibility standard; translations surface only as API endpoints rather than a multilingual master survey, which is a gap for my four-language waves. 1 3 10
The Operations Manager
A colleague could build real forms without IT: conditional logic to show or hide fields, a doc-style editor, 30,000+ templates, branded themes and custom domains, and live calculations using Excel-style functions including a switch function for pricing. It stops short of the top because the captured pages say nothing about piping, hidden fields, custom CSS, several languages from one master form, or a named accessibility standard. 1 3
The HR Lead
A doc-style editor with conditional show and hide logic, live Excel-style calculations and scoring, guided one-question-at-a-time or classic layouts, more than thirty thousand templates, and branded themes with custom domains — enough to stand up a credible engagement survey. We found no public information on piping, hidden fields, randomisation, or a stated accessibility standard such as WCAG or BITV, which is the first question my works council would ask. Translations appear only indirectly, through API endpoints for creating and updating them on the Business and Enterprise plans. 1 3 10
The Academic Researcher
A doc-style editor with conditional show/hide logic, live calculation fields using Excel-style functions and a switch function, AI-generated calculations and scoring, guided one-question-at-a-time or classic layouts, and a 30,000+ template library covers the structure of a questionnaire, and the developer API can create, update and delete translations. For an ethics-board submission, though, I found no public information on randomisation of question or item order, piping, hidden fields, or a named accessibility standard such as WCAG or BITV, and no validated-scale question library is described. 1 3 10
The Data Protection Officer
The builder is well evidenced on logic and calculation — conditional show/hide fields, Excel-style functions with a switch function driving live pricing, AI drafting, guided one-question-at-a-time or classic layouts, and a library of 30,000-plus templates with branded themes and custom domains. Translation endpoints in the API hint at multi-language forms, but I found no public information on piping, hidden fields, randomisation, or any stated accessibility standard, which is what I would want before signing off. 1 3 10
The Skeptic
The builder is documented with conditional logic to show and hide fields, live Excel-style calculations and scoring including switch functions, guided one-question-at-a-time or classic layouts, a 30,000+ template library, branded themes with custom domains, and AI drafting of whole forms. Piping, hidden fields, randomisation, accessible output to a named standard and custom CSS are not described on the captured pages, so it sits above the solid builder level but well short of research-grade authoring. 1 3
Distribution, response collection & workflows
panel disagrees
Show reasoningHide reasoning
How this is scored
How forms reach people and what happens to an answer: share links, embedding, QR codes, email invitations with reminders, contact lists and panels, offline or kiosk collection, file uploads, payments and signatures inside the form, notifications, approval or assignment of submissions, and automations that pass a response on to other tools.
0 — No way to collect responses from other people; the product only analyses data collected elsewhere.
3 — A share link and an embed code, with responses visible in the product; invitations, notifications and onward workflows are basic or not described.
5 — Links, embedding and QR codes, email notifications on submission, file uploads, a few native integrations (spreadsheets, CRM, chat) plus a connector service such as Zapier or Make, and either email invitations with reminders or payments inside the form.
8 — Invitations to managed contact lists with reminders and unique links, response quotas and closing rules, offline or kiosk collection, submissions routed for approval or assignment, conditional notifications, documented webhooks and a REST API to read and write responses.
10 — Collection at research and process scale: panel or sample sourcing, multi-channel distribution (email, SMS, web, app intercept) with deduplication, workflows with branching and audit trail, and every response event exposed to the customer's systems in real time with a stated delivery guarantee.
The Market Researcher
Embedding inline or as a popup, standalone sharing, email notifications, file uploads, payments and e-signature are documented, along with email invitations, partial-entry capture, Stepper multi-step workflows routing approvals, documented webhooks and a tiered API. I found no public information on reminders to managed contact lists with unique links, response quotas and closing rules, or offline or kiosk collection — the sampling discipline my waves depend on. 1 3 8 10
The Operations Manager
Submissions land where we need them without copy and paste: email notifications, native integrations into CRMs, email, spreadsheets and chat plus Zapier and Make, documented webhooks and a REST API, and Stepper to route approvals between teams, with payments, e-signature and file uploads in the flow. Invitations by email exist, but I found nothing on managed contact lists with reminders, response quotas and closing rules, or offline collection. 1 3 8 10 11
The HR Lead
Responses can arrive through standalone links, inline or popup embeds, QR-code sharing, and email invitations, with email notifications, file uploads and payments on the form itself, plus e-signature through Papersign. Submissions can then be routed through Stepper for approvals and task hand-offs between teams, passed to other systems by webhook, Zapier or Make, and managed through a two-tier API. We found no public information on managed contact lists with reminders and unique links, response quotas, or offline collection. 1 3 4 8 10 11
The Academic Researcher
Sharing standalone pages, embedding inline or as a popup, email notifications, invitations sent by email, payments and signatures inside the form, file uploads, native integrations plus Zapier and Make, documented webhooks and a tiered REST API, and the Stepper builder routing approvals place this comfortably above basic link sharing. I found no public information on managed contact lists with reminders and unique respondent links, response quotas or closing rules, or offline and kiosk collection, which is where research-scale collection would need to sit. 1 3 8 10 11
The Data Protection Officer
Forms share as standalone pages, embed inline or as a popup, reach respondents by email invitation, take payments and generate documents for eSignature, and submissions feed a no-code workflow builder that routes approvals, with email notifications, native integrations, Zapier, Make, documented webhooks and a plan-gated REST API with write endpoints. I found no public information on managed contact lists with reminders and unique links, response quotas and closing rules, or offline or kiosk collection, so this stops short of research-scale collection. 1 3 8 10
The Skeptic
Links, inline and popup embeds, email notifications, email invitations, payments, e-signature via Papersign and file uploads (visible in the export documentation) are documented, alongside native integrations plus Zapier and Make, Stepper approval routing, documented webhooks and a two-tier API with write endpoints for forms and translations. Managed contact lists with reminders and unique links, response quotas and closing rules are not described, which keeps it below the research-scale collection level. 1 3 8 10 11
Survey analysis & reporting
panel disagrees
Show reasoningHide reasoning
How this is scored
What the product does with the answers: live results and charts, filters and segments, cross-tabulation, NPS, CSAT and other standard scores, open-text and sentiment analysis, shareable dashboards and reports, and exports to the formats analysts use (CSV, Excel, SPSS, R).
0 — No view of results inside the product; submissions can only be forwarded or downloaded one at a time.
3 — A table of responses with simple charts per question and a CSV export; filters, comparisons and report sharing are basic or not described.
5 — Charts per question, filters and segments, at least one comparison or cross-tab view, standard scores such as NPS, shareable or exportable reports (PDF, presentation), and exports to CSV and Excel.
8 — Cross-tabulation with significance testing, weighting, open-text coding or sentiment analysis, trend reports across survey waves, dashboards for different audiences with permissions, and SPSS or R exports with labels.
10 — A research-grade analysis environment: statistical models beyond cross-tabs (driver analysis, regression), benchmarks, text analytics with themes the customer can edit, and every analysis reproducible from documented exports or an analytics API.
The Market Researcher
Responses are held in the account for review, AI Insights summarises raw responses into readable reports, and submissions export to CSV, though the help pages state that exporting directly to Excel is not supported and point to CSV instead. I found no public information on cross-tabulation, significance testing, filters and segments, NPS or other standard scores, wave-over-wave trends, or SPSS and R exports — so I would still be pushing everything into a spreadsheet before the board sees it. 1 3 11
The Operations Manager
Responses are stored in the account for review, export to CSV (the vendor's help states "We don't support exporting directly to Excel"), and AI Insights turns raw responses into summaries and reports. The captured pages describe no charts per question, filters, cross-tabs, NPS or shareable dashboards, so I cannot credit more. 1 3 11
The HR Lead
Answers sit in the account for review and export as CSV from the submissions page, and the vendor's own help page states direct Excel export is not supported; AI Insights then turns raw responses into readable reports and summaries. We found no public information on filters and segments, cross-tabulation, NPS or other standard scores, trend views across waves, or SPSS and R exports. Without those, I cannot evidence the per-department reporting my surveys depend on. 1 3 6 7 11
The Academic Researcher
Responses can be reviewed and managed in the dashboard, exported as CSV, and AI Insights summarises raw responses into reports and summaries. For my statistical pipeline this is thin: the help pages state that exporting directly to Excel is not supported, and I found no public information on per-question charts, filters and cross-tabulation, standard scores, or exports to SPSS or R with variable labels intact — the things my faculty requires before analysis begins. 1 3 11
The Data Protection Officer
AI Insights turns raw responses into readable reports and summaries, responses export to CSV from the Submissions page (the vendor states direct Excel export is not supported), and captured pages are dedicated to results, reports and analytics. I found no public information on charts per question, filters and cross-tabulation, standard scores such as NPS, or SPSS or R exports, so the depth of analysis beyond AI summaries is not confirmed. 1 6 7 11
The Skeptic
Answers are stored in the account for review, submissions export to CSV from the dashboard — the vendor itself states direct Excel export is unsupported — and AI Insights turns raw responses into readable reports and summaries. We found no public information on filters, cross-tabs, standard scores such as NPS or shareable dashboards, so the analysis story rests on an AI summary and a CSV dump. 1 3 11
Consent, GDPR & respondent data
panel disagrees
Show reasoningHide reasoning
How this is scored
What the product gives the customer to collect personal data lawfully: consent and privacy-notice fields, anonymous surveys that really drop IP addresses and identifiers, retention periods and automatic deletion, handling of access and erasure requests, encryption of responses, a data processing agreement, and controls over cookies and tracking on the form itself.
0 — The product collects no personal data from respondents, so there is nothing to protect; or it is a different kind of product.
3 — A privacy policy and a statement of GDPR compliance, with a checkbox field usable for consent; anonymity, retention and deletion are not described.
5 — A data processing agreement offered to customers, a consent or privacy-notice field, an anonymous mode that does not store IP addresses, responses deletable by the customer, and encryption in transit and at rest stated.
8 — Retention periods with automatic deletion, tools for access and erasure requests per respondent, field-level encryption or masking of sensitive answers, forms that set no tracking cookies by default, a published list of technical and organisational measures, and a named data protection officer.
10 — Data protection by design and evidenced: end-to-end or customer-key encryption of responses, documented data minimisation defaults, a DPA with audit rights and subprocessor change notice, records of consent kept with each response, and an independent audit of the privacy controls published.
The Market Researcher
The privacy policy casts Paperform as processor and the customer as controller, appoints an EU representative in Vienna, cites standard contractual clauses, maintains a public subprocessor list and gives a free rights channel by email, and templates supply declaration and consent fields. I found no public information on an anonymous mode that drops IP addresses, retention with automatic deletion, encryption in transit and at rest, or a data processing agreement; the policy also confirms the AI assistant can reach submissions including respondents' personal data, and that Google Analytics runs on the service. 1 8 9
The Operations Manager
The privacy policy is strong on process: Paperform acts as processor for the customer as controller, EU Commission-approved standard contractual clauses cover transfers, a GDPR representative is appointed in Vienna, rights requests go to legal@paperform.co, and a DSAR template ships with a declaration and consent field. But no encryption of responses in transit and at rest, no anonymous mode dropping IP addresses, no automatic deletion at a retention date, and no data processing agreement are stated, and Google Analytics runs on the services. 1 8 9
The HR Lead
The privacy policy sets out controller and processor roles, an Article 27 representative in Vienna, standard contractual clauses for transfers and a free rights channel via legal@paperform.co, and templates provide declaration and consent fields; it also discloses that a connected AI assistant may receive submissions including respondents' personal information and that Google Analytics is used. We found no public information on an anonymous mode that drops IP addresses and identifiers, on a data processing agreement, or on encryption of responses in transit and at rest — the policy describes secure servers behind firewalls, while the homepage cites SOC 2 Type II. Retention is purpose-based, and the policy states personal information cannot be deleted except by also deleting the account, which sits badly with a works-council agreement requiring answers deleted on schedule. 1 8 9
The Academic Researcher
The privacy policy sets out controller and processor roles, standard contractual clauses for transfers, an Article 27 representative in Vienna, a rights channel at legal@paperform.co, purpose-based retention and a subprocessor list page, while the GDPR templates show that declaration, consent and DPO-detail fields are buildable and SOC 2 Type II is stated on the product pages. What an ethics board would still ask for is missing from the public record: I found no public information on a data processing agreement, an anonymous mode that does not store IP addresses, retention periods with automatic deletion, or encryption in transit and at rest, and the policy states the services may use Google Analytics and that a connected AI assistant can reach submissions including respondents' personal information, though it can be disconnected in settings. 1 8 9
The Data Protection Officer
The privacy policy states controller and processor roles, names an EU representative in Vienna, invokes standard contractual clauses for transfers, and gives a rights channel at legal@paperform.co, and a DSAR template shows consent and declaration fields can be authored. For my sign-off, though, I found no public information on an anonymous mode that drops IP addresses or on a data processing agreement; retention is purpose-based with no automatic deletion, the policy ties deletion of personal information to deleting the account, encryption is described only as secure servers behind firewalls, and the services may use Google Analytics cookies. 1 8 9
The Skeptic
The privacy policy names the customer as controller and Paperform as processor, appoints a GDPR representative in Vienna, cites standard contractual clauses, sets out rights channels and publishes a subprocessor list URL, and consent fields appear in templates. But we found no public information on a data processing agreement, an anonymous mode or IP-address dropping; encryption is described only as "secure servers behind firewalls", Google Analytics cookies run on the service, and the AI assistant can be fed submissions including respondents' personal information to Claude, ChatGPT, Gemini or Cursor. 1 8 9
Hosting choice, teams & portability
panel disagrees
Show reasoningHide reasoning
How this is scored
What the customer may choose about where and how the product runs and who uses it: a selectable data region or EU-only hosting, self-hosting or an on-premise edition, team workspaces with roles and permissions, single sign-on, an audit log, custom domains and white-labelling, and a complete export of forms and responses that another tool can import.
0 — A single-user tool with no export of forms or responses.
3 — Shared access for a team and a response export; data location, roles and single sign-on are not described.
5 — Hosting location stated with an EU option, team workspaces with at least two roles, single sign-on on a higher plan, a custom domain or removed vendor branding, and an export of all responses.
8 — EU-only hosting selectable per account or a self-hosted edition, granular roles per form or folder, SSO with SAML and user provisioning, an audit log, white-labelling, and forms and responses exportable in a documented format with an API.
10 — Full control over operation: an open-source or on-premise edition with feature parity, customer-chosen region per workspace, administrative APIs, a documented migration path in and out, and an uptime commitment with a published status history.
The Market Researcher
Workspaces per client and brand, SSO with granular access controls, custom domains, a CSV export of all submissions, a documented two-tier API, and Enterprise secondary regions with EU and Australian API URLs give a workable team setup. I found no public information on SAML and provisioning specifics, a product audit log, white-labelling beyond custom domains, or a documented export of the forms themselves. 1 10 11
The Operations Manager
Workspaces, granular access controls, SSO, SOC 2 Type II, custom domains and a CSV export of all responses are documented, and Enterprise customers get secondary API regions including the EU, though data is otherwise stored in the United States, Australia or Singapore. I found no public information on a self-hosted edition, SAML, per-form roles or an administrative audit log. 1 8 10 11
The HR Lead
Workspaces, single sign-on, granular access controls, branded themes with custom domains and SOC 2 Type II are stated up front, and Enterprise customers have secondary regions including the EU, visible in the API's regional URLs. Every response exports as CSV from the submissions page, and the two-tier API can write forms, webhooks and spaces. We found no public information on self-hosting, SAML detail with user provisioning, an administrative audit log, or white-labelling, and the EU region appears tied to Enterprise plans rather than selectable per account. 1 10 11
The Academic Researcher
Team workspaces, granular access controls, SSO, branded themes and custom domains, export of all submissions as CSV from the dashboard, and a documented tiered API put this solidly at the middle level, and Enterprise customers are given secondary regions including the EU via region-specific API URLs. I found no public information on a self-hosted or on-premise edition, SAML and provisioning detail, or a platform-level audit log, and the privacy policy names the United States, Australia and Singapore as data locations, so the EU region is an Enterprise arrangement rather than a choice open to a standard departmental plan. 1 8 10 11
The Data Protection Officer
Workspaces, single sign-on with granular access controls, branded themes and custom domains are documented, Enterprise customers can use a secondary EU region with regional API URLs, and responses export to CSV alongside a documented API — though large exports may arrive by email link hours later. I found no public information on self-hosting, SAML or user provisioning, a product-level audit log (audit logs appear only inside a compliance template description), or an export of the forms themselves in a documented format. 1 9 10 11
The Skeptic
An EU region exists only as an Enterprise "secondary region" alongside AU, per the regional API URLs, while workspaces, granular access controls, SSO, custom domains and a CSV export of all submissions are documented, with the Business API able to write forms, spaces and translations. SAML, user provisioning, per-form roles, white-labelling and self-hosting are not described, and the only audit-log mention sits inside a DSAR template rather than an administration feature. 1 10 11
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where forms and responses are hosted, and who the subprocessors are (hosting, email delivery, payment providers, analytics, AI features). Independently sourced by the sovereignty pipeline; responses often carry personal and sometimes special-category data, so the whole chain counts, not only the database.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (email, analytics, AI features, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The Market Researcher
The privacy policy says data may be transferred to and stored in the United States, Australia and Singapore and states a US domicile, while the contact address it gives is in Australia — the captured pages give different indications of where the vendor sits — and an EU region exists only as an Enterprise secondary region. Standard contractual clauses, an Art. 27 representative in Vienna and a public subprocessor list are positives; I found no public information on a data processing agreement, and SOC 2 is stated without an ISO 27001 scope. 1 8 10
The Operations Manager
The privacy policy states Paperform is domiciled in the United States while the contact address given is in Australia, with a GDPR representative in Vienna; data may be stored in the United States, Australia or Singapore, and the chain includes Google Analytics, Stripe and connectable AI assistants (Claude, ChatGPT, Gemini, Cursor) that can reach submissions including respondents' personal information. A subprocessor list is maintained at a public URL and SOC 2 Type II is stated, but the captured pages show an EU region only for Enterprise and no EU contracting entity or published data processing agreement. 1 8 10
The HR Lead
The privacy policy states a United States domicile while the legal contact names Paperform Pty. Ltd. at a New South Wales address, and information may be transferred to and stored on servers in the United States, Australia and Singapore; an Article 27 representative in Vienna and an Enterprise EU region soften that but do not make it a European default. A public subprocessor list is maintained at a stated URL, Stripe is named for payments, and SOC 2 Type II is claimed. We found no public information on a data processing agreement, on hosting options as a customer choice, or on where the subprocessors sit, so the chain behind employee survey data cannot be verified end to end. 1 8 10
The Academic Researcher
The captured pages give different figures for the vendor's base — a Summer Hill, NSW postal address for Paperform Pty. Ltd. alongside a policy statement that Paperform is domiciled in the United States — with information transferred to and/or stored in the United States, Australia or Singapore, and standard contractual clauses plus the Vienna representative as the stated safeguards. An EU region appears to exist for Enterprise secondary regions, but the chain runs through non-EU providers such as Stripe for payments, Google Analytics, and AI assistants including Claude, ChatGPT and Gemini that may access respondents' personal information, and I found no public information on a published data processing agreement or subprocessor locations. For a faculty that must keep respondent data in the EU, I could not sign this off without the Enterprise arrangement and the subprocessor list in hand. 1 8 10
The Data Protection Officer
The captured pages give different signals on the contracting entity — Paperform Pty. Ltd. with an Australian address, while the privacy policy states domicile in the United States — with data stored in the United States, Australia or Singapore and an EU region only for Enterprise. A subprocessor list is published at a public URL with Stripe named for payments, SOC 2 Type II is stated, and an EU representative exists, but I found no public information on a published data processing agreement or named hosting infrastructure, and the AI assistant path can send submissions including respondents' personal information to customer-chosen assistants such as Claude, ChatGPT, Gemini or Cursor. 1 8 10
The Skeptic
Paperform Pty. Ltd. is domiciled in the United States with a New South Wales address, and personal data "may be" transferred to and stored in the United States, Australia, Singapore or other countries; Google Analytics runs on the service and the MCP server can send submissions with respondents' personal information to Claude, ChatGPT, Gemini or Cursor. A GDPR representative in Vienna, standard contractual clauses and a published subprocessor list URL soften this, but we found no public information on a data processing agreement, and the EU region is an Enterprise secondary region rather than a default. 8 10
Pricing transparency
not rated — the vendor publishes no price
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per plan and per user, response or submission limits and what happens above them, which features (logic, branding removal, SSO, EU hosting, analysis modules) need a higher plan, add-ons, minimum term and the free tier's limits.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, responses or features is unclear.
5 — Plans are public with prices and their main limits (users, responses, forms), but at least one commonly needed piece (SSO, EU hosting, extra responses, branding removal) is unpriced or "on request".
8 — Every plan priced publicly with its limits, overage or extra-response prices, feature differences per plan in a comparison table, billing period, VAT treatment and cancellation terms stated.
10 — Complete price computability: annual cost derivable for a given number of users, responses and features, with every add-on, enterprise option, support level and data-return term published.
The Market Researcher
A free plan, a seven-day trial with no credit card and free template use are public, and the API help reveals the plan ladder (Pro, Business, Enterprise) and which plans get which API tier. I found no public information on plan prices, user or response limits, overage charges, add-ons, billing period or cancellation terms, so a real annual cost cannot be computed from these pages. 1 7 10
The Operations Manager
Public pages show a free plan, templates usable for free, a trial that is "Free for 7 days. No credit card needed.", and help pages spelling out which plans get which API tiers. No plan price, response or submission limit, or overage terms appear anywhere I read, and whether the bill jumps with response count is exactly what I need to know before retiring our PDF forms. 1 3 7 10
The HR Lead
A free plan and a seven-day trial without a credit card are public, and the API help page names Pro, Business and Enterprise as the plans carrying API access, but no prices, response or seat limits, or plan comparison appear on the captured pages. I cannot compute an annual cost for a six-hundred-person company from this, and features like the EU region sit behind an Enterprise conversation with no published price. 1 7 10
The Academic Researcher
A free tier, a seven-day trial with no credit card needed, and the plan names Pro, Business and Enterprise are visible through the API availability notes, but I found no public information on any per-plan price, response or user limits, overage terms, or a feature comparison. A departmental buyer cannot compute the annual cost of a study from these pages, including which tier is needed for logic, branding removal, SSO or the EU region. 1 7 10
The Data Protection Officer
A free plan, a 7-day trial without a credit card and free templates are public, and the API pages reveal plan names — Pro, Business, Enterprise, legacy Agency — with API access varying by plan. I found no public information on prices for any paid plan, response or submission limits, or what logic, branding removal or EU hosting cost, so a real annual cost cannot be computed from the captured pages. 1 7 10
The Skeptic
A free plan and a 7-day trial with no credit card required are public, and the API help page maps the Standard API to Pro, Business and Enterprise plans and the Business API to Business and Enterprise. But no paid plan carries a price on the captured pages, and we found no public information on response or user limits, overages, billing terms or VAT treatment, so a buyer cannot compute a real annual cost. 1 7 10
European sovereignty — proven facts
2 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in US ⚠ unverified | 0/2 pts | 8 Report an error |
|---|---|---|---|
| Hosting location | Outside the EU ⚠ unverified | 0/4 pts | 8 Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Paperform
Is Paperform European?
Not determined: the vendor’s pages as captured do not say where Paperform is based. Its vendor, Paperform, is incorporated in United States, per the vendor’s page captured 3 Nov 2026.
Where does Paperform store data?
Paperform stores customer data outside the EU by default, per the vendor’s page captured 3 Nov 2026.
Does Paperform have a free plan?
Yes. Paperform has a free plan, per the vendor’s page captured 3 Nov 2026.
What are the best alternatives to Paperform?
As of 3 Nov 2026, the panel rates Formbricks (4/5), easyfeedback (3.5/5) and Netigate (3.5/5) highest among the other 19 Forms & Surveys products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Formbricks (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Paperform alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 3 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. The finding comes from a privacy policy's domicile statement rather than an imprint or company register, so the incorporation country is inferred from domicile.
- Weak sourcing — Hosting location. The policy says data "may be" stored at those servers rather than stating where it is stored by default, and no subprocessor list or hosting page is included in the excerpts.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 21 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
Sources (11)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page paperform.com Checked 3 Nov 2026 Details →
- 2 Form & survey building — found from sitemap paperform.com Checked 3 Nov 2026 Details →
- 3 Form & survey building — found from sitemap paperform.com Checked 3 Nov 2026 Details →
- 4 Distribution, response collection & workflows — found from sitemap paperform.com Checked 3 Nov 2026 Details →
- 5 Distribution, response collection & workflows — found from sitemap paperform.com Checked 3 Nov 2026 Details →
- 6 Survey analysis & reporting — found from sitemap paperform.com Checked 3 Nov 2026 Details →
- 7 Survey analysis & reporting — found from sitemap paperform.com Checked 3 Nov 2026 Details →
- 8 Consent, GDPR & respondent data — found from sitemap paperform.com Checked 3 Nov 2026 Details →
- 9 Consent, GDPR & respondent data — found from sitemap paperform.com Checked 3 Nov 2026 Details →
- 10 Hosting choice, teams & portability — found from sitemap paperform.com Checked 3 Nov 2026 Details →
- 11 Hosting choice, teams & portability — found from sitemap paperform.com Checked 3 Nov 2026 Details →