# Qualtrics — Forms & Surveys

Qualtrics by Qualtrics LLC holds a panel rating of 1.5/5 from 6 AI judges (category median 3/5), as of 2026-10-29. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Qualtrics LLC (https://www.qualtrics.com)
- Category: [Forms & Surveys](https://whats-best.ai/software/forms-and-surveys.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/forms-and-surveys/qualtrics
- Alternatives: https://whats-best.ai/software/forms-and-surveys/qualtrics/alternatives ([markdown](https://whats-best.ai/software/forms-and-surveys/qualtrics/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-10-29 · oldest source captured 2026-10-28

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Qualtrics LLC
- Headquarters: Not stated on the vendor’s pages as of 28 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 28 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 28 Oct 2026

## The panel's verdict

Qualtrics LLC of Provo, Utah sells an experience-management and survey research platform for enterprises. The bench scores it strongest on consent and data protection, where five of six judges gave 5-6 for documented consent-form building, GDPR erasure that deletes personal data from survey responses, tickets and contacts, customer control over what is collected, retained and deleted, and redaction of sensitive data. Hosting and administration clustered at 4 on single sign-on with multi-factor authentication, bring-your-own-key encryption and project approval workflows. The genuine split is sovereignty, with scores spread from 0 to 3: stated safeguards — transfers under EU or UK adequacy decisions or EU Standard Contractual Clauses, ISO 27001, SOC 2 Type 2, named representatives in Dublin and London — sit against hosting location, ownership and subprocessors that no captured page describes, plus AI-training and advertising-partner disclosures. The data protection officer judge scored zero on every criterion, citing possible IP collection from respondents, AI training and advertising-partner sharing. Analysis and reporting also split, and no prices appear on any captured page.

**Speaks for it:**
- Consent-form building, GDPR erasure that reaches personal data in survey responses, tickets and contacts, and redaction or restriction of sensitive data are all documented.
- The customer decides what data is collected, retained and deleted.
- Single sign-on with multi-factor authentication, restricted internal access, project approval workflows and bring-your-own-key encryption are documented on the security page.
- Transfers rely on EU or UK adequacy decisions or EU Standard Contractual Clauses, with an EU representative (Qualtrics Ireland Limited, Dublin) and a UK representative named.
- ISO 27001, SOC 2 Type 2, HITRUST and FedRAMP certifications are stated.

**Held against it:**
- Hosting location, ownership and the subprocessor chain are not described on the captured pages.
- The privacy statement says survey respondents' IP addresses may be collected for fraud prevention, and an anonymous mode is not documented.
- Cross-tabulation, standard scores such as NPS, and exports to SPSS, R, CSV or Excel are not described on the captured pages.
- Email invitations with reminders, response quotas, and a documented response API or webhooks are not described on the captured pages.
- The privacy statement discloses AI processing of personal information including model training (in a policy that excludes customer platform data) and sharing of certain personal information with advertising partners.

**Best for:**
- You run employee engagement, 360 feedback, brand or market research programmes and need documented consent, erasure and sensitive-data controls for a works council or ethics review.
- Your security review requires single sign-on with multi-factor authentication and customer-managed encryption keys before any tool is adopted.
- You depend on built-in frameworks, benchmarks and AI-guided study design rather than configuring research methodology from scratch.

**Avoid if:**
- You must guarantee respondents anonymity: the privacy statement documents that IP addresses may be collected from survey respondents for fraud prevention.
- You need to verify where responses are hosted and which subprocessors touch them before signing: the contracting entity is Qualtrics, LLC of Provo, Utah, and the statement describes transfers to affiliates and third parties in other jurisdictions.
- Your analyst workflow depends on cross-tabulation, NPS and SPSS exports you can verify in advance: the only portable export described on the captured pages serves individual privacy requests.
- You need a cost figure before engaging sales — ask the vendor: the public pages we read do not show it

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Market Researcher | The Operations Manager | The HR Lead | The Academic Researcher | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Form & survey building | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 0/5 | 1/5 |
| Distribution, response collection & workflows | 2/5 | 1.5/5 | 2/5 | 1.5/5 | 0/5 | 2/5 |
| Survey analysis & reporting | 1.5/5 | 1.5/5 | 2/5 | 1.5/5 | 0/5 | 1/5 |
| Consent, GDPR & respondent data | 3/5 | 3/5 | 3/5 | 3/5 | 0/5 | 2.5/5 |
| Hosting choice, teams & portability | 2/5 | 2/5 | 2/5 | 2/5 | 0/5 | 2/5 |
| European sovereignty | 1/5 | 0.5/5 | 1.5/5 | 1.5/5 | 0/5 | 1/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2/5** | **2/5** | **2/5** | **2/5** | **0/5** | **1.5/5** |

### The judges

- **The Market Researcher** (v1.0): Runs customer and brand studies for a mid-sized consumer-goods company, three waves a year in four languages. Wants logic and quotas that keep the sample clean, invitations with reminders, cross-tabs and NPS without exporting to a spreadsheet first, and open answers grouped into themes before the board meeting.
- **The Operations Manager** (v1.0): Replaces paper and PDF forms at a service company: event registrations, supplier onboarding, damage reports with photos, order requests with a payment. Wants forms a colleague can build without IT, file uploads, a submission that lands in the right inbox and the CRM or spreadsheet without copy and paste, and a price that does not jump when the response count does.
- **The HR Lead** (v1.0): Runs the yearly engagement survey and pulse checks for a German company of six hundred, with the works council reading every question. Wants anonymity that is real and stated, results hidden below a minimum group size, reports per department that managers can read, and answers that are deleted when the agreement with the works council says so.
- **The Academic Researcher** (v1.0): Runs questionnaire studies at a European university and has to satisfy the ethics board before the first respondent sees a question. Wants complex branching, randomisation and validated scales, an informed-consent page that is part of the instrument, exports to SPSS and R with labels intact, and a licence the faculty can host or at least keep in the EU.
- **The Data Protection Officer** (v1.0): Signs off every form tool a department wants to use and has found health data in a feedback form before. Wants a data processing agreement and a subprocessor list on the vendor's own pages, consent fields and an anonymous mode that drops IP addresses, retention periods that delete on their own, EU hosting the customer can choose, and roles that keep responses away from people who do not need them.
- **The Skeptic** (v1.0): Has seen a "free form builder" put its logo on every customer survey and charge per response the month the campaign worked. Reads "GDPR compliant" with no data processing agreement behind it, "anonymous" surveys that still log IP addresses, "EU hosting" on the enterprise plan only, and AI analysis features with no word on where the answers go — and asks whether the responses can leave with the customer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- AI training: yes [S5]
- Authorized agent: yes [S5]
- Dispute resolution: free of charge · ICDR-AAA [S5]
- Dpf certified: yes · yes · yes · Qualtrics LLC [S5]
- Dpf transfers reliance: adequacy decisions · EU Standard Contractual Clauses · no [S5]
- Fedramp HIPAA: yes · yes [S2]
- Ftc jurisdiction: Federal Trade Commission [S5]
- Hitrust: HITRUST · yes [S4]
- International transfers: yes [S5]
- ISO 27001: ISO 27001 · yes [S4]
- ISO 42001: ISO 42001 · yes [S4]
- Minors under 16: no [S5]
- No sale of data: no [S5]
- Security measures: organizational, technical and administrative [S5]
- Shares with ad partners: yes [S5]
- SOC 2 datacenter: SOC 2 [S4]
- SOC 2 type2: SOC 2 Type 2 · yes [S4]
- Transfer safeguards: EU/UK adequacy decisions · EU Standard Contractual Clauses [S5]
- Vulnerability disclosure: yes [S4]

**Data**
- Access portable format: yes [S5]
- Anonymized data use: yes · no [S5]
- Call recordings: yes [S5]
- Deletion right: yes [S5]
- Ip collection surveys: fraud prevention and security · yes [S5]
- Retention: retained only as long as necessary per retention policies and applicable laws [S5]
- Retention policies: Retention Policies [S3]
- Session replay: no · yes · yes · no [S5]

**Integrations**
- Forrester recognition: Strong Performer in Forrester Wave Experience Research Platforms [S2]
- Marketplace: Marketplace, Integrations, Partners programs listed [S1]

**Legal**
- Address: privacy@qualtrics.com · 333 W River Park Drive, Provo, Utah 84604, USA [S5]
- Australian small business amendment: yes [S6]
- Children age minimum: 16 [S5]
- Contracting entity: Qualtrics, LLC [S6]
- Eea representative: Qualtrics Ireland Limited · One Clarendon Row, Dublin 2, Ireland [S5]
- Gtc single terms set: one set of foundational GTC terms applies to all Qualtrics contracts [S6]
- Gtc translated languages: 8 · Spanish (Spain) · Spanish (Mexico) · Portuguese (Portugal) · Portuguese (Brazil) · French · Italian · German · Japanese [S6]
- Hq locations: Provo, Utah · Seattle [S5]
- Last updated: 2026-04-23 [S5]
- Online payments amendment: yes [S6]
- Policy scope processor: Policy excludes customer data; Qualtrics acts as service provider/data processor for XM Platform data [S5]
- Product terms incorporated: https://www.qualtrics.com/legal/customers/product-terms/ · yes [S6]
- Right to appeal: yes [S5]
- Termscout certification: yes · TermScout · Customer Favorable [S6]
- Translations not binding: no · yes [S6]
- UK representative: QUL Technologies Limited · 5 New Street Square, London, United Kingdom, EC4A 3TW [S5]
- US federal government amendment: yes [S6]

**Product**
- Admin reports: yes [S4]
- Agentic research: AI guides study design to synthesis [S2]
- Automation: Automated recommendations and responses, intelligent automation [S1]
- Brand communication research: yes [S2]
- Builtin frameworks: Built-in frameworks, benchmarks, and playbooks [S1]
- Byok data isolation: yes [S4]
- Capabilities list: Voice Of Customer · Omnichannel Experience Management · Employee Engagement · 360 Development Feedback · Market & Audience Understanding [S1]
- Connected insights: yes [S2]
- Consent form: Building a Consent Form use case documented [S3]
- Cost consolidation: Unified platform eliminates redundant vendors, predictable pricing [S2]
- Data confidentiality: yes [S4]
- Data retention backups: yes · yes · yes [S4]
- Encryption in transit: yes · yes [S4]
- GDPR erasure controls: GDPR right to erasure; delete personal data in survey responses, tickets, contacts [S4]
- Human synthetic panels: AI-powered synthetic respondents combined with human panels [S2]
- Incident response plan: yes [S4]
- Industries: Healthcare · Financial services · Public sector [S2]
- Industries: Healthcare · Financial services · Public sector [S1]
- ISMS: yes [S4]
- Market research audiences: yes [S2]
- Omnichannel feedback: Omnichannel feedback / Voice of the Customer [S1]
- Physical security: yes · yes · yes [S4]
- Product innovation research: yes [S2]
- Project approval controls: yes [S4]
- Research grade model: Research-grade model trained on millions of real responses [S2]
- Research module: Accelerated Research: concept testing, feature optimization, pricing validation [S1]
- Security operations center: yes · yes [S4]
- Sensitive data controls: Redact and restrict gathering of sensitive data or PII [S4]
- Simulation: Simulation [S1]
- SSO MFA: yes · yes [S4]
- Synthetic audiences: yes [S2]
- Unified platform: Single platform unifying market, product & innovation, UX, and brand research [S2]
- Usage metrics defined: yes [S6]
- UX research: yes [S2]
- Xm platform: XM Data & AI Platform, next generation of Experience Management [S1]

**Support**
- California tollfree: yes [S5]
- Channels: Community · Customer Success Hub · Product documentation · Developer resources · Training and certification · System status [S4]
- Data protection complaints: privacy@qualtrics.com · yes [S5]
- Demo request: Demo request form available on homepage [S1]
- Faq resource: yes [S6]
- Marketing optout: unsubscribe link in marketing emails · yes [S5]
- Privacy requests form: Privacy Request Form with identity verification [S5]
- Resources: Community · Customer Success Hub · Product documentation · Developer resources · Training and certification · System status [S1]
- Support resources: Community · Customer Success Hub · Product documentation · Developer resources · Training and certification · System status [S2]

## Questions

### Is Qualtrics European?

No. whats-best.ai classifies Qualtrics as Rest of world.

### Where does Qualtrics store data?

Not stated on the vendor’s pages as of 28 Oct 2026.

### Does Qualtrics have a free plan?

Not stated on the vendor’s pages as of 28 Oct 2026.

### What are the best alternatives to Qualtrics?

As of 3 Nov 2026, the panel rates [Formbricks (4/5)](https://whats-best.ai/software/forms-and-surveys/formbricks), [easyfeedback (3.5/5)](https://whats-best.ai/software/forms-and-surveys/easyfeedback) and [Netigate (3.5/5)](https://whats-best.ai/software/forms-and-surveys/netigate) highest among the other 19 Forms & Surveys products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Formbricks](https://whats-best.ai/software/forms-and-surveys/formbricks) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Qualtrics alternatives](https://whats-best.ai/software/forms-and-surveys/qualtrics/alternatives).

## Head-to-head

- [Qualtrics vs SurveyMonkey](https://whats-best.ai/compare/qualtrics-vs-surveymonkey.md)

## What this page leaves out

- We found no public information on pricing on the pages we read (qualtrics.com, qualtrics.com/market-research, qualtrics.com/support/survey-platform/getting-started/data-protection-privacy, qualtrics.com/platform/security, qualtrics.com/privacy-statement, qualtrics.com/legal/customers/gtcs). If the vendor publishes it somewhere else, send us the page.
- 13 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.qualtrics.com/ (checked 2026-10-28)
- [S2] Features page (market research): https://www.qualtrics.com/market-research/ (checked 2026-10-28)
- [S3] Data protection documentation: https://www.qualtrics.com/support/survey-platform/getting-started/data-protection-privacy/ (checked 2026-10-28)
- [S4] Security page: https://www.qualtrics.com/platform/security/ (checked 2026-10-28)
- [S5] Privacy policy: https://www.qualtrics.com/privacy-statement/ (checked 2026-10-28)
- [S6] Terms of service: https://www.qualtrics.com/legal/customers/gtcs/ (checked 2026-10-28)

---

Cite as: whats-best.ai, "Qualtrics — Forms & Surveys", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/forms-and-surveys/qualtrics

Corrections: https://whats-best.ai/correct/1116?target=page