Forms & Surveys
Typeform
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Typeform SL · www.typeform.com
Compare with Tally → Compare with Jotform → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Typeform at a glance
- Vendor
- Typeform SL
- Headquarters
- Not stated on the vendor’s pages as of 28 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 28 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 28 Oct 2026
- Panel verdict
- The AI panel rates Typeform 3/5, the mean of 6 judges. Typeform is a forms-and-surveys platform from Typeform SL of Barcelona, and the bench scores it highest on collection and workflows (6 to 7), crediting 28 question types, links, embeds, a 25,000-contact database with CSV import, file uploads, webhooks, a public API and Zapier. how scores are made
- As of
- Vendor pages captured 28 Oct 2026; evaluated by the panel 29 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Typeform is a forms-and-surveys platform from Typeform SL of Barcelona, and the bench scores it highest on collection and workflows (6 to 7), crediting 28 question types, links, embeds, a 25,000-contact database with CSV import, file uploads, webhooks, a public API and Zapier. Consent and data protection also reaches 6 to 7, on a published data processing agreement with Standard Contractual Clauses, a named Data Protection Officer, AES-256 at rest and TLS 1.2 or higher in transit, and surveys that are anonymous by default and collect no IP addresses. Form building and hosting and administration cluster at 6. Analysis and reporting is the weakest area, and the bench genuinely splits from 4 to 6: judges writing for everyday reporting credit AI topic and sentiment detection, while judges needing research-grade output point to no public information on cross-tabulation, weighting, or SPSS and R exports, and no named export format. Sovereignty spans 5 to 7 over AWS hosting, an Enterprise-only EU data center choice and AI features governed by OpenAI's terms; pricing transparency spans 5 to 7 over Enterprise contact-sales gates.
Speaks for it
- No-code drag-and-drop builder with 28 question types, conditional logic and branching, multilingual forms and a 3,000+ template library.
- Responses arrive by link, embed, payment and file upload into a 25,000-contact database, with webhooks, a public API, Zapier and named integrations including Google Sheets and Salesforce.
- Published data processing agreement with Standard Contractual Clauses, a named Data Protection Officer, AES-256 at rest and TLS 1.2 or higher in transit, and surveys anonymous by default that collect no IP addresses.
- Four plans priced publicly at 25, 49, 84 and 242 EUR/mo (Growth Flow after a 14-day trial with credit card required) with user counts and monthly response limits, and responses above the limit are simply not collected.
- AI detects topics and sentiment in open answers, NPS auto-calculates, and reports can be generated and shared.
Held against it
- We found no public information on cross-tabulation, significance testing, weighting, or SPSS and R exports, and the response download's format is not named.
- Single sign-on, the choice of US or EU data center and custom domains sit on Enterprise at contact sales, and extra responses carry no public price.
- The service terms grant a worldwide, royalty-free, sublicensable licence over respondent data for providing and improving the service.
- Quantitative Insights is activated by default and its usage is governed by OpenAI's terms and conditions.
- We found no public information on offline or kiosk collection, reminder invitations on unique per-respondent links, or response quotas with closing rules.
Best for
- You build branded event registrations, supplier onboarding or lead forms and need payments, file uploads and responses flowing into Google Sheets, HubSpot or Salesforce.
- You run NPS or pulse surveys and want auto-calculated scores, drop-off views, shareable reports and AI topic and sentiment summaries.
- You need a documented GDPR baseline for a compliance review — published DPA with SCCs, named DPO, anonymous-by-default surveys — with a US-or-EU data center choice available on Enterprise.
Avoid if
- Your statistical colleagues need cross-tabulation, weighting or SPSS and R exports; analysis and reporting scores run as low as 4 on exactly those gaps.
- You cannot accept a worldwide, royalty-free, sublicensable licence over respondent data, or AI analysis governed by OpenAI's terms activated by default.
- You need enterprise controls without negotiating a contract, since single sign-on, the EU data center choice and custom domains sit on Enterprise at contact sales.
The scores
| Criterion | Panel median |
|---|---|
| Form & survey building | 3 of 5 |
| Distribution, response collection & workflows | 3.5 of 5 |
| Survey analysis & reporting | 2.5 of 5 |
| Consent, GDPR & respondent data | 3 of 5 |
| Hosting choice, teams & portability | 3 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 3 of 5 |
Form & survey building
Show reasoningHide reasoning
How this is scored
What can be built without code: question and field types, conditional logic and branching, piping and hidden fields, calculations, multi-page forms and progress, templates, design and branding, multiple languages, and accessible output for respondents.
0 — Not a form or survey builder; questions cannot be authored in the product.
3 — A builder with the common question types and a few templates; logic, branding or languages are basic or not described.
5 — A drag-and-drop builder with a wide range of question types, conditional logic that shows, hides or skips questions, multi-page forms, a template library, and the customer's logo, colours and fonts.
8 — Advanced logic with piping, hidden fields, calculations and scoring, randomisation, surveys translated into several languages from one master, reusable question libraries, custom CSS or themes, and accessible forms with a named standard (WCAG 2.1 AA or BITV) stated.
10 — Best-in-class authoring: complex research designs (loops, quotas in logic, conjoint or MaxDiff), versioned forms with change history, a published accessibility conformance report, and every element of a form available through the API.
The Market Researcher
A no-code drag-and-drop builder with 28 question types, conditional logic and branching, piping via the recall feature, multilingual forms, a 3,000-plus template gallery and full branding control cover most of what my three waves a year need. For the research end, we found no public information on calculations or scoring, randomisation, quotas inside logic, reusable question libraries or a stated accessibility standard, which holds it below the advanced authoring tier. 2 3 8 13
The Operations Manager
A drag-and-drop builder with no code needed, 28 question types, conditional logic and branching, a 3,000+ template library and brand kits with the customer's logo, colours and fonts are all documented, which covers the event registrations and supplier onboarding forms my colleagues build. Recall Information pipes earlier answers into later questions and forms can be created in multiple languages, but we found no public information on hidden fields, calculations, reusable question libraries, or any accessibility standard for respondents. 2 3 8 13
The HR Lead
The builder is drag-and-drop with 28 question types, conditional logic and branching, piping through the Recall Information feature, multilingual forms and a 3,000+ template library that includes anonymous survey templates, plus brand kits for logo, colours and fonts. We found no public information on calculations or scoring inside the form, hidden fields, randomisation of question order, or a stated accessibility standard such as WCAG or BITV, which my works council will ask about first. 2 3 8 13
The Academic Researcher
The no-code drag-and-drop builder offers 28 question types, Logic Jump branching and a Workflow panel, piping via Recall Information, forms in multiple languages, video and signature questions, and a 3,000-plus template library with Brand Kit themes — enough for a competent questionnaire. For an ethics-board-grade instrument I also need item randomisation, hidden fields, calculations and scoring, and a named accessibility standard such as WCAG, and we found no public information on any of those, so it stays in the middle band. 2 3 8 13
The Data Protection Officer
The drag-and-drop builder offers 28 question types, conditional logic and branching, a template library of more than 3,000, brand kits with the customer's logo, fonts and themes, piping through the Recall Information feature, welcome screens with media, video and signature questions, and forms in multiple languages. It is a capable authoring toolkit, but I found no public information on calculations or scoring, custom CSS, reusable question libraries, or a stated accessibility standard for respondents. 2 3 8 13
The Skeptic
A genuine no-code drag-and-drop builder: 28 question types, conditional logic with branching and Logic Jumps, piping through the Recall Information feature, 3,000+ templates, brand kits covering themes, fonts, logos and colours, multilingual forms, signature and video questions, and an AI agent that builds the form for you. We found no public information on calculations or scoring inside the form, hidden fields, randomisation, custom CSS, question libraries, or a named accessibility standard for respondents — and those are exactly what would separate the good from the excellent here. 2 3 8 13
Distribution, response collection & workflows
Show reasoningHide reasoning
How this is scored
How forms reach people and what happens to an answer: share links, embedding, QR codes, email invitations with reminders, contact lists and panels, offline or kiosk collection, file uploads, payments and signatures inside the form, notifications, approval or assignment of submissions, and automations that pass a response on to other tools.
0 — No way to collect responses from other people; the product only analyses data collected elsewhere.
3 — A share link and an embed code, with responses visible in the product; invitations, notifications and onward workflows are basic or not described.
5 — Links, embedding and QR codes, email notifications on submission, file uploads, a few native integrations (spreadsheets, CRM, chat) plus a connector service such as Zapier or Make, and either email invitations with reminders or payments inside the form.
8 — Invitations to managed contact lists with reminders and unique links, response quotas and closing rules, offline or kiosk collection, submissions routed for approval or assignment, conditional notifications, documented webhooks and a REST API to read and write responses.
10 — Collection at research and process scale: panel or sample sourcing, multi-channel distribution (email, SMS, web, app intercept) with deduplication, workflows with branching and audit trail, and every response event exposed to the customer's systems in real time with a stated delivery guarantee.
The Market Researcher
Distribution covers share links, embeds, email and social, Zapier and a documented webhooks and public API layer, with a 25,000-contact database, CSV import, automations from contact lists and scheduled dates, payments, file uploads, email and SMS follow-ups, and built-in panel recruitment in the research flow. What I cannot see is invitations with reminders and unique links, form-level response quotas with closing rules, or offline collection — exactly the machinery that keeps a quota-controlled sample clean. 3 7 8 11
The Operations Manager
File uploads (1 GB to 4 GB depending on plan), payments and partial responses, email notifications, native Google Sheets, HubSpot, Pipedrive and Salesforce integrations, plus Zapier and webhooks, mean a damage report with photos or a paid order request lands in the spreadsheet or CRM without copy and paste. A 25,000-contact database with CSV import and automation triggers exists, but we found no public information on invitations with reminders, QR codes, form closing rules, or routing submissions for approval. 3 7 8 11
The HR Lead
Sharing as a link or embedded in email and website, email notifications, follow-up emails and text messages, file uploads up to 4 GB, payments, a 25,000-contact database with CSV import, Zapier and hundreds of integrations, plus webhooks and a public API cover what our yearly distribution needs. Managed invitations with reminders on unique links, response quotas with automatic closing rules, and offline or kiosk collection are not described on the captured pages. 2 3 7 8 11
The Academic Researcher
Forms go out as links, email or website embeds, with file uploads, payments, partial responses, a 25,000-contact database with CSV import, automations triggered by contact changes or a scheduled date, follow-up emails and SMS, documented webhooks, a public API, and even built-in panel access for recruiting and screening study participants. We found no public information on reminder invitations with unique per-respondent links, response quotas with closing rules, or offline and kiosk collection, which is what would take it to the top band for panel studies. 3 7 8 11
The Data Protection Officer
Responses can arrive by share link, embeds in email, social and websites, in-form payments and signatures, and file uploads, backed by email notifications, a 25,000-contact database with CSV import, scheduled and contact-triggered automations, email and SMS follow-ups, webhooks, a public API, Zapier plus named native integrations, and panel access for recruiting research participants. Response caps stop collection at the plan limit rather than billing an overage. I found no public information on QR codes, offline or kiosk collection, unique single-use links, or approval routing with an audit trail. 3 7 8 11
The Skeptic
Links, email and website embeds, file uploads with per-plan storage caps, payments and signature questions, contact lists up to 25,000 with CSV import and bulk management, automated follow-ups by email and SMS, lead routing and scoring, reCAPTCHA and duplicate protection, documented webhooks, a public API, Zapier and a long list of named native apps — most of what a working team needs to get answers and act on them. We found no public information on email invitations with reminders as a managed flow, response quotas or closing rules, offline or kiosk collection, or submissions routed for approval, and QR codes are not described on the captured pages. 2 3 7 8 11
Survey analysis & reporting
Show reasoningHide reasoning
How this is scored
What the product does with the answers: live results and charts, filters and segments, cross-tabulation, NPS, CSAT and other standard scores, open-text and sentiment analysis, shareable dashboards and reports, and exports to the formats analysts use (CSV, Excel, SPSS, R).
0 — No view of results inside the product; submissions can only be forwarded or downloaded one at a time.
3 — A table of responses with simple charts per question and a CSV export; filters, comparisons and report sharing are basic or not described.
5 — Charts per question, filters and segments, at least one comparison or cross-tab view, standard scores such as NPS, shareable or exportable reports (PDF, presentation), and exports to CSV and Excel.
8 — Cross-tabulation with significance testing, weighting, open-text coding or sentiment analysis, trend reports across survey waves, dashboards for different audiences with permissions, and SPSS or R exports with labels.
10 — A research-grade analysis environment: statistical models beyond cross-tabs (driver analysis, regression), benchmarks, text analytics with themes the customer can edit, and every analysis reproducible from documented exports or an analytics API.
The Market Researcher
Live results give completion rates, drop-off and answer patterns, filters, auto-generated shareable reports, automatic NPS scoring, and AI topic and sentiment detection that groups open answers — most of what I want before a board meeting. But we found no public information on cross-tabulation, significance testing, weighting, or SPSS and R exports, so my cross-tabs would still begin in a spreadsheet. 3 10 11 13
The Operations Manager
NPS scores auto-calculate, reports can be generated and shared, completion rates and drop-off analysis are shown, responses can be downloaded, and AI detects key topics and sentiment in open text. We found no public information on cross-tabulation, weighting, trend reports across waves, or the export formats analysts use such as CSV, Excel, SPSS or R. 3 10 11 13
The HR Lead
Live reporting shows completion rate, drop-off per question, performance over time, auto-generated shareable reports, auto-calculated NPS, and AI topic and sentiment detection on open answers. I found no public information on cross-tabulation, weighting, trend reports across survey waves, exports to SPSS or R, or the filters, per-department report views and minimum group-size suppression that would let me hand each manager their own department results safely. 2 3 10 11 13
The Academic Researcher
Live reporting covers completion rates, question drop-off analysis, performance over time, auto-calculated NPS, shareable auto-generated reports, and AI detection of topics and sentiment in open answers, with a plain response download. The export format is never named, and we found no public information on cross-tabulation with significance testing, weighting, or SPSS or R exports with value labels — the very thing my statistical colleagues ask for — so it sits below the research-grade band. 3 10 11 13
The Data Protection Officer
Live reporting covers completion rates, drop-offs and performance over time, NPS is auto-calculated with reports that can be generated and shared, and AI detects topics and sentiment with the ability to ask questions of the data, plus search and filter across responses. Beyond those views I found no public information on cross-tabulation with significance testing, weighting, or exports to SPSS or R; only a general download of responses is described. Good for everyday reporting, short of a research-grade analysis environment. 3 10 11 13
The Skeptic
Built-in analytics show completion rate, drop-off and performance over time with aggregated answers per question, NPS auto-calculates with reports you can generate and share, and the AI detects topics and sentiment — that sentiment piece is high-end material, and Research Flow adds AI analysis, highlight reels and shareable reports. But we found no public information on cross-tabulation with significance testing, weighting, audience-specific dashboards, or exports to SPSS or R, and the response download carries no named format, so this sits just above the middle of the scale. 2 3 10 11 13
Consent, GDPR & respondent data
Show reasoningHide reasoning
How this is scored
What the product gives the customer to collect personal data lawfully: consent and privacy-notice fields, anonymous surveys that really drop IP addresses and identifiers, retention periods and automatic deletion, handling of access and erasure requests, encryption of responses, a data processing agreement, and controls over cookies and tracking on the form itself.
0 — The product collects no personal data from respondents, so there is nothing to protect; or it is a different kind of product.
3 — A privacy policy and a statement of GDPR compliance, with a checkbox field usable for consent; anonymity, retention and deletion are not described.
5 — A data processing agreement offered to customers, a consent or privacy-notice field, an anonymous mode that does not store IP addresses, responses deletable by the customer, and encryption in transit and at rest stated.
8 — Retention periods with automatic deletion, tools for access and erasure requests per respondent, field-level encryption or masking of sensitive answers, forms that set no tracking cookies by default, a published list of technical and organisational measures, and a named data protection officer.
10 — Data protection by design and evidenced: end-to-end or customer-key encryption of responses, documented data minimisation defaults, a DPA with audit rights and subprocessor change notice, records of consent kept with each response, and an independent audit of the privacy controls published.
The Market Researcher
A published data processing agreement with SCCs, a named data protection officer, technical and organisational measures, and encryption in transit and at rest; surveys are anonymous by default with no IP collection, and a cookie consent widget exists. Retention with automatic deletion is shown mainly for inactive free accounts, respondent requests are handled by forwarding them to me rather than with in-product tools, and the cookie widget requires a separate vendor account on a higher plan. 4 5 12 13
The Operations Manager
A published data processing agreement with the customer as controller, AES-256 at rest and TLS in transit, a named data protection officer, technical and organisational measures in the agreement's annex, and respondent requests forwarded to the customer give a solid baseline. Anonymous surveys that do not collect IP addresses or identifying information are documented, but a cookie-consent widget needs a PRO+ account plus a separate Axeptio account, and we found no public information on customer-set retention periods with automatic deletion or field-level masking of sensitive answers. 4 5 12 13
The HR Lead
Surveys are anonymous by default and anonymous mode collects no IP addresses or identifiers, the data processing agreement is published with Annex II measures and a named data protection officer, encryption in transit and at rest is stated, data is deleted or returned on termination, and an optional GDPR cookie consent widget exists. Missing for me are a retention period with automatic deletion I can align to the works council agreement, per-respondent access and erasure tooling, and field-level masking; the service terms also grant a worldwide sublicensable licence over respondent data for service improvement, and the Quantitative Insights feature is activated by default and governed by OpenAI's terms — that alone will cost me a long meeting. 4 5 7 12 13
The Academic Researcher
Unusually well documented for an ethics submission: a published DPA with Typeform as processor, a named Data Protection Officer, the Spanish Data Protection Authority as supervisory body, AES-256 at rest and TLS 1.2 or higher in transit, technical and organisational measures in the DPA annex, breach notification within GDPR deadlines, and surveys that are anonymous by default and collect no IP addresses so long as no identifying fields or URL tracking parameters are used. Cookie consent needs an Axeptio widget that requires a PRO+ account plus a separate Axeptio account, and we found no public information on field-level masking of sensitive answers, configurable per-survey retention with automatic deletion, or consent records stored with each response. 4 5 12 13
The Data Protection Officer
The data processing agreement is published on the vendor's own pages with a named data protection officer, technical and organisational measures, SCCs, audit rights capped at one per year at the customer's cost, and a subprocessor list, while the terms state AES-256 at rest and TLS 1.2 or higher in transit. Anonymous mode is real: surveys are anonymous by default and anonymous surveys collect no IP addresses or identifying information, though the cookie-consent control arrives through a third-party Axeptio widget that requires a higher-tier account. Retention deletes on its own only for inactive free accounts after 24 months, I found no public information on a dedicated consent field or field-level encryption, and the terms take a worldwide, sublicensable licence over respondent data for providing and improving the service. 4 5 7 12 13
The Skeptic
More than a GDPR sticker: a published data processing agreement with technical and organisational measures, TLS 1.2/1.3 and AES-256 encryption, a named data protection officer, anonymous surveys that by the vendor's own words collect no IP addresses or identifying information, delete-or-return on termination, data subject requests forwarded to the customer, and an Axeptio cookie-consent widget. What holds it back: we found no public information on field-level encryption or masking, forms that set no tracking cookies by default, or consent records kept with each response — and the service terms take a worldwide, royalty-free, sublicensable, transferable licence over respondent data for providing and improving the service, aggregated, which a skeptic reads twice. 4 5 7 12 13
Hosting choice, teams & portability
Show reasoningHide reasoning
How this is scored
What the customer may choose about where and how the product runs and who uses it: a selectable data region or EU-only hosting, self-hosting or an on-premise edition, team workspaces with roles and permissions, single sign-on, an audit log, custom domains and white-labelling, and a complete export of forms and responses that another tool can import.
0 — A single-user tool with no export of forms or responses.
3 — Shared access for a team and a response export; data location, roles and single sign-on are not described.
5 — Hosting location stated with an EU option, team workspaces with at least two roles, single sign-on on a higher plan, a custom domain or removed vendor branding, and an export of all responses.
8 — EU-only hosting selectable per account or a self-hosted edition, granular roles per form or folder, SSO with SAML and user provisioning, an audit log, white-labelling, and forms and responses exportable in a documented format with an API.
10 — Full control over operation: an open-source or on-premise edition with feature parity, customer-chosen region per workspace, administrative APIs, a documented migration path in and out, and an uptime commitment with a published status history.
The Market Researcher
An EU data center, SSO and custom domains sit behind the Enterprise plan, while team collaboration with assigned roles, shared workspaces whose admins can access activity logs, a custom subdomain, branding removal and response download through the API are documented on standard plans. We found no public information on SAML-based user provisioning, self-hosting, per-form permissions, or an export of the forms themselves. 2 3 4 7
The Operations Manager
Team workspaces with assigned roles and real-time collaboration, removable Typeform branding, custom subdomains and a full response download are documented, with single sign-on, custom domains and a choice of US or EU data center reserved for Enterprise. Administrators can access and export workspace activity logs and public APIs exist, but we found no public information on SAML or user provisioning detail, self-hosting, or a documented format for exporting the forms themselves to another tool. 2 3 4 7
The HR Lead
The choice between a US or an EU data center, single sign-on, a custom domain and the top support tier sit on Enterprise only, while shared workspaces with roles, branding removal and a custom subdomain come with the paid plans, and workspace administrators can access and export activity logs. We found no public information on granular roles per form or folder, SAML or user-provisioning detail, or a documented export and migration path — and the terms state the company is not obligated to keep a copy of our submissions. 2 3 4 7
The Academic Researcher
The privacy policy states information is processed from the European Economic Area, and an EU or US data centre can be chosen — but only on Enterprise, the same tier that gates SSO and a custom domain; shared workspaces with roles, real-time collaboration, branding removal on paid plans, custom subdomains and response download with a public API complete a solid mid-level picture. For faculty self-administration I would want a self-hosted edition, granular per-form permissions, SAML and provisioning detail, and a documented importable export format, and we found no public information on those. 2 3 4 7
The Data Protection Officer
The choice between a US or EU data center, SSO and custom domains sits on the Enterprise plan, branding removal and a custom subdomain come from Plus, and workspaces have assignable roles, custom permissions and activity logs an administrator can access and export. Responses can be downloaded and a public API exists, but I found no public information on SAML specifically, user provisioning, a self-hosted edition, or a documented export format for moving forms to another tool. EU hosting the customer can choose exists, at Enterprise price. 2 3 4 7
The Skeptic
Teams get shared workspaces with assigned roles and real-time collaboration, single sign-on on the Enterprise plan, a custom domain on Enterprise and a custom subdomain plus branding removal from Plus, organisation administrators can access and export activity logs, and responses are downloadable with a public API alongside. But the choice between a US or EU data center is Enterprise-only rather than a per-account EU default, and we found no public information on self-hosting, SAML-based provisioning, granular per-form or per-folder roles, or a documented export format another tool could import. 2 3 4 7 11
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where forms and responses are hosted, and who the subprocessors are (hosting, email delivery, payment providers, analytics, AI features). Independently sourced by the sovereignty pipeline; responses often carry personal and sometimes special-category data, so the whole chain counts, not only the database.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (email, analytics, AI features, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The Market Researcher
The contracting entity is Typeform SL in Barcelona with a Spanish registry entry, a published DPA under Spanish law with SCCs, ISO 27001 and SOC 2 certifications, and processing stated to happen primarily in the EEA, with a US or EU data center choice on Enterprise. The chain still runs through a US affiliate for engineering and support and hosting on AWS, the full subprocessor list sits behind an external help-centre link, and ownership is not stated on the captured pages. 3 4 5 6
The Operations Manager
Typeform, S.L. of Barcelona with a Spanish tax identification number is the contracting entity, the data processing agreement runs under Spanish law with SCC module 4 for transfers outside the EEA, SOC 2 Type II and ISO/IEC 27001:2022 are stated, and a subprocessor list is published behind a help-centre link. The captured pages give no confirmed default data residency, however: the data center choice is a US-or-EU option on Enterprise only and data is described as located in AWS, a US-headquartered host, while named affiliates in San Francisco, opt-in Okta authentication and AI features governed by OpenAI's terms all sit in the chain. 3 4 5 7
The HR Lead
The contracting entity is Typeform, S.L. of Barcelona with a Spanish tax identity, the data processing agreement is published under Spanish law, ISO 27001 and SOC 2 certifications are stated, and subprocessor categories with a published list are referenced, though the named list itself sits behind an external help-centre link. The captured pages give different statements on hosting — EEA processing and an Enterprise EU data center choice on one hand, customer data located in AWS and the San Francisco affiliate acting as joint controller for sales on the other — so the exposure through AWS and the US affiliate is mitigated by standard contractual clauses and Annex II measures rather than removed. 3 4 5 6
The Academic Researcher
The contracting entity is Typeform SL of Barcelona with a Spanish tax ID, the DPA is governed by Spanish law with the Spanish Data Protection Agency as authority, and SOC 2 Type II plus ISO/IEC 27001 and further certifications are published. However, the pricing pages locate customer data in AWS — a US-headquartered host — the EU data centre choice exists only on Enterprise, the full subprocessor list sits behind a help-centre link while named processors include a San Francisco affiliate, so an EU-resident chain end to end is not evidenced. 3 4 5 6
The Data Protection Officer
Contracting is with a Spanish company whose registry details and tax number are published, under a data processing agreement governed by Spanish law with SCCs for transfers, and SOC 2 plus ISO 27001-family certifications are stated. The chain still runs through a San Francisco affiliate and a joint controllership with it for US sales, hosting on AWS with no stated region, US providers for VideoAsk hosting and authentication, and the general subprocessor list behind a help-centre page. Ownership is not documented and I found no confirmation that responses are hosted in the EU by default, so I cannot place it at the top level. 3 4 5 6
The Skeptic
The paper is genuinely European — Typeform SL in Barcelona with a registry number, Spanish law and Spanish courts for the contract clauses, a published DPA with Standard Contractual Clauses, and SOC 2 and the ISO suite named. The chain is what worries me: the hosting actually named on these pages is Amazon Web Services, a US entity, the EU data center exists only on the Enterprise plan, the general subprocessor list sits behind a help-centre link, US customers are sold by the San Francisco affiliate as joint controller under Delaware law, and the quantitative insights feature is governed by OpenAI's terms and activated by default — with nothing on the captured pages saying where respondents' answers go for that. 3 4 5 6 7
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per plan and per user, response or submission limits and what happens above them, which features (logic, branding removal, SSO, EU hosting, analysis modules) need a higher plan, add-ons, minimum term and the free tier's limits.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, responses or features is unclear.
5 — Plans are public with prices and their main limits (users, responses, forms), but at least one commonly needed piece (SSO, EU hosting, extra responses, branding removal) is unpriced or "on request".
8 — Every plan priced publicly with its limits, overage or extra-response prices, feature differences per plan in a comparison table, billing period, VAT treatment and cancellation terms stated.
10 — Complete price computability: annual cost derivable for a given number of users, responses and features, with every add-on, enterprise option, support level and data-return term published.
The Market Researcher
Four plans are priced publicly — Basic at 25 EUR a month, Plus at 49, Business at 84 and Growth Flow at 242 after a 14-day trial — each with user counts, included responses and a maximum monthly response limit, plus priced action add-ons, a 30 percent yearly saving and a free tier, and terms stating responses beyond the limit are simply not collected. Enterprise, the only plan with SSO, EU hosting and custom domains, is contact sales, and we found no public information on VAT treatment, so I cannot compute a full annual cost from public pages alone. 3 7 11
The Operations Manager
Four plans are priced publicly in euros per month (25, 49, 84 and 242 EUR /mo) with users, included responses per month, maximum monthly response limits, file upload sizes and a feature comparison, plus a 30% annual discount and automation add-ons priced at 21 EUR /mo and 66 EUR /mo. Single sign-on, the EU data center and Enterprise are contact-sales only and extra-response add-ons are purchasable but unpriced publicly, and we found no public information on VAT treatment; the terms state responses above plan limits are simply not collected, so cost is predictable but volume is capped. 3 7 11
The HR Lead
Basic, Plus, Business and Growth Flow carry public monthly prices in euros with user counts and monthly response limits, a 30% yearly saving, priced automation add-ons and a free tier. But single sign-on, the EU data center and the custom domain sit on Enterprise at "contact sales", the price of extra responses and additional users is not stated, the free tier's response limit is not shown and VAT treatment is not described — so for a company of six hundred the real annual cost is not computable from public pages, and the legal notice reserves price changes at any time without notice. 3 7 11
The Academic Researcher
Four plans carry public prices — 25 EUR / mo Basic, 49 EUR / mo Plus, 84 EUR / mo Business, and 242EUR/mo after 14 days for Growth Flow with a credit card required — alongside a comparison table of included and maximum responses, users, file-upload and video limits, yearly billing labelled Save 30%, priced automation add-ons, non-refundable fees and a documented hard stop when response limits are reached. Enterprise, which gates SSO, HIPAA and the EU data centre choice, is contact sales only, and we found no public information on VAT treatment or the price of additional responses, so a university buyer cannot compute the full annual cost from public pages alone. 3 6 7 11
The Data Protection Officer
Four plans are priced in EUR with users, included and maximum monthly responses, file-upload limits, enrichment limits and a per-plan feature comparison, annual billing labelled "Yearly (Save 30%)", and automation add-ons at 21 EUR /mo and 66 EUR /mo, plus stated auto-renewal, non-refundable fees and a 30-day billing dispute window. Extra responses are sold as add-ons in account settings with no published unit price, Enterprise is contact sales, and I found no public information on VAT treatment. The free plan is described without a stated response cap. 3 7 11
The Skeptic
Unusually concrete for the category: 25, 49 and 84 EUR/mo for Basic, Plus and Business with users, included responses and maximum monthly response limits per plan, file upload, enrichment and video caps, a Growth Flow at 242 EUR/mo after a credit-card 14-day trial, automation add-ons at 21 and 66 EUR/mo, a stated 30% yearly saving, and terms that say responses above the limit are simply not collected. But single sign-on, the EU data center and HIPAA sit behind Enterprise 'contact sales', extra responses are purchasable without a public price, VAT treatment is not stated and prices may change at any time without notice — so the real annual cost is computable only up to the Enterprise door. 3 6 7 11
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Typeform
Is Typeform European?
Yes. whats-best.ai classifies Typeform as EU-Made.
Where does Typeform store data?
Not stated on the vendor’s pages as of 28 Oct 2026.
Does Typeform have a free plan?
Yes. Typeform has a free plan, per the vendor’s page captured 28 Oct 2026.
What are the best alternatives to Typeform?
As of 3 Nov 2026, the panel rates Formbricks (4/5), easyfeedback (3.5/5) and Netigate (3.5/5) highest among the other 19 Forms & Surveys products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Formbricks (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Typeform alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 28 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Open source, Legal entity, Hosting location, Hosting options, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 46 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 9 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.typeform.com Checked 28 Oct 2026 Details →
- 2 Features page (surveys) www.typeform.com Checked 28 Oct 2026 Details →
- 3 Pricing page www.typeform.com Checked 28 Oct 2026 Details →
- 4 Privacy policy www.typeform.com Checked 28 Oct 2026 Details →
- 5 Data processing agreement www.typeform.com Checked 28 Oct 2026 Details →
- 6 Legal notice www.typeform.com Checked 28 Oct 2026 Details →
- 7 Terms of service www.typeform.com Checked 28 Oct 2026 Details →
- 8 Distribution, response collection & workflows — found from sitemap www.typeform.com Checked 28 Oct 2026 Details →
- 9 Distribution, response collection & workflows — found from sitemap www.typeform.com Checked 28 Oct 2026 Details →
- 10 Survey analysis & reporting — found from sitemap www.typeform.com Checked 28 Oct 2026 Details →
- 11 Survey analysis & reporting — found from sitemap www.typeform.com Checked 28 Oct 2026 Details →
- 12 Consent, GDPR & respondent data — found from sitemap www.typeform.com Checked 28 Oct 2026 Details →
- 13 Consent, GDPR & respondent data — found from sitemap www.typeform.com Checked 28 Oct 2026 Details →