Forms & Surveys
Zoho Forms
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Zoho Corporation Private Limited · www.zoho.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Zoho Forms at a glance
- Vendor
- Zoho Corporation Private Limited
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 28 Oct 2026
- Panel verdict
- The AI panel rates Zoho Forms 3/5, the mean of 6 judges. Zoho Forms is the Zoho suite's online form builder, strongest on collection and workflows, weakest on analysis and reporting. how scores are made
- As of
- Vendor pages captured 28 Oct 2026 to 1 Nov 2026; evaluated by the panel 29 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Zoho Forms is the Zoho suite's online form builder, strongest on collection and workflows, weakest on analysis and reporting. Collection and workflows scores cluster at 7: kiosk and offline collection, payments via PayPal, Stripe, 2Checkout and RazorPay, signatures, webhooks on every plan and multi-level approvals. Form building follows at 6-7 (drag-and-drop, over 200 templates, nested logic), and consent and data protection at 6-8: the operations manager scored 8 for per-form encryption whose six-character access code even admins must enter, while the HR lead held 6 because automatic submission deletion appears only on Premium. Analysis and reporting clusters at 4: export is CSV and PDF, with no public information on cross-tabulation, NPS or SPSS exports. Pricing transparency scores 3-5: limits are public — free tier 3 forms and 500 submissions a month, Premium 100 users and 150,000 — but no price figure appears. Sovereignty scores 4-5; the captured pages give different statements on where data is held — an EU data centre on the German page, the USA, the EEA and other countries in the privacy policy.
Speaks for it
- Deep collection and routing: kiosk and offline collection, payments through PayPal, Stripe, 2Checkout and RazorPay, signatures, email and SMS notifications, webhooks on every plan, and multi-level approvals with delegation and auto-approve
- Field-level and per-form encryption with a six-character access code that even administrators must enter, and encrypted fields masked on export
- A named data protection officer at Zoho Corporation B.V. in Utrecht, a data processing agreement on request, 72-hour breach notification and published technical and organisational measures
- Plan limits are fully public, from the free tier (3 forms, 500 submissions a month, 200 MB) to Premium (100 users, 150,000 submissions a month, 10 GB)
- SAML single sign-on, multi-factor authentication, a customer audit log and a per-form change log are documented, where hosting and administration scores 6-7
Held against it
- Analysis and reporting clusters at 4: export stops at CSV and PDF, with no public information on cross-tabulation, NPS or CSAT, sentiment analysis, or SPSS, Excel and R exports
- No price figure appears for any plan or add-on — with VAT added on top and card-only payment for terms under a year, an annual cost cannot be computed from the captured pages
- The captured pages give different statements on where data is held: the German homepage states an EU data centre, while the privacy policy names the USA, the EEA and other countries
- Subprocessors are described as assessed but not listed with locations, and certifications are claimed only generically as industry standards
- Automatic submission deletion is documented only on the Premium plan, and data subject requests are routed through the customer
Best for
- You run operations-style workflows — leave requests, purchase orders, expense reports — that need multi-level approval routing, payments and signatures inside the form
- Your team collects responses in the field or at events, using kiosk mode, offline mobile collection or camera uploads
- You need respondent-data controls such as per-form encryption whose access code even administrators must supply
- You plan to export responses as CSV or PDF and do the analysis elsewhere, for example in spreadsheets or the Zoho Analytics integration
Avoid if
- You need survey analysis built in — cross-tabulation, significance testing, NPS or sentiment — since the documented output is a filtered table, shareable reports and CSV/PDF export
- You must compute an annual cost from published prices before purchase, and the captured pages show plan limits but no price figures
- Your compliance sign-off needs a fully verifiable chain — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Form & survey building | 3.5 of 5 |
| Distribution, response collection & workflows | 3.5 of 5 |
| Survey analysis & reporting | 2 of 5 |
| Consent, GDPR & respondent data | 3.5 of 5 |
| Hosting choice, teams & portability | 3 of 5 |
| European sovereignty | 2 of 5 |
| Pricing transparency | 2 of 5 |
Form & survey building
Show reasoningHide reasoning
How this is scored
What can be built without code: question and field types, conditional logic and branching, piping and hidden fields, calculations, multi-page forms and progress, templates, design and branding, multiple languages, and accessible output for respondents.
0 — Not a form or survey builder; questions cannot be authored in the product.
3 — A builder with the common question types and a few templates; logic, branding or languages are basic or not described.
5 — A drag-and-drop builder with a wide range of question types, conditional logic that shows, hides or skips questions, multi-page forms, a template library, and the customer's logo, colours and fonts.
8 — Advanced logic with piping, hidden fields, calculations and scoring, randomisation, surveys translated into several languages from one master, reusable question libraries, custom CSS or themes, and accessible forms with a named standard (WCAG 2.1 AA or BITV) stated.
10 — Best-in-class authoring: complex research designs (loops, quotas in logic, conjoint or MaxDiff), versioned forms with change history, a published accessibility conformance report, and every element of a form available through the API.
The Market Researcher
Drag-and-drop authoring with 200-plus templates, standard and card formats, multi-page forms, page and field rules with nested logic, dynamic comparison of two field values, conditional option filtering, calculations and custom CSS is a serious builder. For my four-language waves, though, I found no public information on translations managed from one master survey, piping, randomisation or a named accessibility standard. 1 2 8 9
The Operations Manager
A colleague could genuinely build without IT: a drag-and-drop builder, more than 200 templates, standard and card formats, subforms, calculation fields, and company branding with custom CSS. The logic engine is deep — field rules that show or hide based on earlier answers, page rules that skip whole pages, conditional option filtering in dropdowns, and nested conditions with subgroups. We found no public information on multi-language forms, piping, hidden fields or a named accessibility standard, which keeps it off the top band. 1 2 8 9 10
The HR Lead
A no-code drag-and-drop builder with over 200 templates, calculation fields, custom CSS, subforms, multi-page and card formats, and a genuinely advanced logic suite (page rules, conditional option filtering, nested conditions, dynamic comparison of two field values) is well documented. But we found no public information on piping, hidden fields, randomisation, reusable question libraries, multilingual master forms or a named accessibility standard such as WCAG or BITV — for a survey the works council reads, the missing accessibility statement matters to me. 1 2 8 9 11
The Academic Researcher
A no-code drag-and-drop builder with over 200 templates, multi-page and card formats, calculations, custom CSS and genuinely advanced conditional logic (field rules, page skip rules, conditional option filtering, nested conditions, dynamic field-to-field comparison) is documented. For my questionnaire work, though, I found no public information on question-order randomisation, piping, hidden fields, survey translation from one master, reusable question libraries or a named accessibility standard — randomisation alone is a hard requirement for my designs, and this caps an otherwise strong builder. 1 2 8 9
The Data Protection Officer
The builder is well documented: drag-and-drop authoring with a wide range of field types, field and page rules, nested conditions with subgroups, dynamic field comparison, calculations, custom CSS and subforms, over 200 templates and full branding with logos, colours and fonts. We found no public information on multi-language forms from one master, randomisation, or accessibility conformance to a named standard, which keeps this below the top band. 1 2 8 9 11
The Skeptic
A real drag-and-drop builder: field rules that show or hide questions, page rules that skip pages, conditional option filtering, rules that compare two field values dynamically, nested logic, calculations, subforms, custom CSS, card forms, save-and-resume and more than 200 templates. We found no public information on piping, hidden fields, randomisation, multi-language forms from one master, question libraries or a named accessibility standard, which is what the top tier would require. 1 2 8 9 11
Distribution, response collection & workflows
Show reasoningHide reasoning
How this is scored
How forms reach people and what happens to an answer: share links, embedding, QR codes, email invitations with reminders, contact lists and panels, offline or kiosk collection, file uploads, payments and signatures inside the form, notifications, approval or assignment of submissions, and automations that pass a response on to other tools.
0 — No way to collect responses from other people; the product only analyses data collected elsewhere.
3 — A share link and an embed code, with responses visible in the product; invitations, notifications and onward workflows are basic or not described.
5 — Links, embedding and QR codes, email notifications on submission, file uploads, a few native integrations (spreadsheets, CRM, chat) plus a connector service such as Zapier or Make, and either email invitations with reminders or payments inside the form.
8 — Invitations to managed contact lists with reminders and unique links, response quotas and closing rules, offline or kiosk collection, submissions routed for approval or assignment, conditional notifications, documented webhooks and a REST API to read and write responses.
10 — Collection at research and process scale: panel or sample sourcing, multi-channel distribution (email, SMS, web, app intercept) with deduplication, workflows with branching and audit trail, and every response event exposed to the customer's systems in real time with a stated delivery guarantee.
The Market Researcher
Distribution is unusually broad — share links, embedding, social sharing, QR and barcode scanning, kiosk mode, offline mobile collection, payments through PayPal, Stripe, 2Checkout and RazorPay, signatures, conditional email and SMS notifications, webhooks, Zapier and a deep approval-routing layer with multi-level approvals, task assignment and mobile approvals. But I found no public information on invitations to managed contact lists with reminders and unique links, response quotas or closing rules, or a REST API for responses — the parts a research wave actually runs on. 1 2 9 10 11
The Operations Manager
This is the paper-replacement heart of it: file uploads including photos straight from a phone camera, payments through PayPal, Stripe, 2Checkout and RazorPay, e-signatures, kiosk mode for events and offline collection on the mobile apps. Submissions trigger email and SMS notifications, route through multi-level approvals with auto-approve, task assignment and field-level approver permissions, and flow onward to CRM, spreadsheets, Salesforce, Slack or a thousand apps via Zapier, with webhooks on every plan including the free one. We found no public information on managed invitation lists with reminders and unique links, or on a documented REST API for reading and writing responses. 2 3 9 10 11
The HR Lead
Distribution is broad: share links and embeds, kiosk mode, offline collection in the mobile apps, payments and signatures inside the form, plus a strong routing suite with multi-level approvals, delegation, auto-approve/deny, per-stage contextual notifications and webhooks available on every plan including the free tier. We found no public information on managed contact-list invitations with reminders and unique links, response quotas, or a documented REST API, so it stays short of the top level. 2 3 9 10 11
The Academic Researcher
Links, embedding and social sharing, payments inside the form, signatures, offline and kiosk collection, multi-level approval routing with delegation, proxy and one-click decisions, conditional email and SMS notifications, task assignment and webhooks on every plan including the free tier are all documented, alongside Zapier and 150-plus app integrations. I found no public information on managed invitation lists with unique links and reminder schedules, response quotas with closing rules, or a documented REST API to read and write responses — reminders matter for response rates, so this stays below the research-scale collection level. 2 9 10 11
The Data Protection Officer
Distribution and onward handling are strong: links, embedding and QR codes, kiosk and offline collection, payments and signatures inside the form, e-mail and SMS notifications, webhooks on every plan, Zapier and 150-plus integrations, and multi-level approval routing with auto-approve, denial rules and post-approval integration triggers. We found no public information on managed invitation lists with reminders and unique links, response quotas and closing rules, or a REST API to read and write responses. 1 2 3 8 9 10 11
The Skeptic
Distribution and routing are documented in depth: links, embeds, pop-ups, social sharing, QR and barcode scanning, kiosk mode, offline collection, payments through PayPal, Stripe, 2Checkout and RazorPay, signatures, email and SMS notifications, task assignment, and multi-level approvals with delegation, auto-approve and real-time tracking, plus webhooks on every plan and Zapier claiming a thousand apps. We found no public information on invitations to managed contact lists with reminders and unique links, response quotas and closing rules, or a REST API for reading and writing responses. 1 2 3 8 9 10 11
Survey analysis & reporting
Show reasoningHide reasoning
How this is scored
What the product does with the answers: live results and charts, filters and segments, cross-tabulation, NPS, CSAT and other standard scores, open-text and sentiment analysis, shareable dashboards and reports, and exports to the formats analysts use (CSV, Excel, SPSS, R).
0 — No view of results inside the product; submissions can only be forwarded or downloaded one at a time.
3 — A table of responses with simple charts per question and a CSV export; filters, comparisons and report sharing are basic or not described.
5 — Charts per question, filters and segments, at least one comparison or cross-tab view, standard scores such as NPS, shareable or exportable reports (PDF, presentation), and exports to CSV and Excel.
8 — Cross-tabulation with significance testing, weighting, open-text coding or sentiment analysis, trend reports across survey waves, dashboards for different audiences with permissions, and SPSS or R exports with labels.
10 — A research-grade analysis environment: statistical models beyond cross-tabs (driver analysis, regression), benchmarks, text analytics with themes the customer can edit, and every analysis reproducible from documented exports or an analytics API.
The Market Researcher
What the pages document is a response table with custom filters, custom reports shared with the team, generic "detailed reports and analytics", and CSV or PDF export with encrypted fields masked on export. I found no public information on cross-tabulation, NPS or other standard scores, per-question charts, open-text coding or sentiment, or SPSS and Excel exports — so every board pack would start in a spreadsheet. 1 2 9 12
The Operations Manager
Results land in a table view with custom filters, custom reports can be built and shared with the team, and performance analytics are described — but the captured pages document export only as CSV and print-ready PDF. We found no public information on cross-tabulation, NPS or other standard scores, sentiment analysis, audience-specific dashboards, or Excel, SPSS and R exports; for heavy analysis we would push responses into Google Sheets or the Zoho Analytics integration rather than rely on the built-in reporting. 1 2 9 12
The HR Lead
Custom reports shareable with the team, a filtered table view, trend mention in general terms, and CSV and PDF exports are described. For a six-hundred-person engagement survey I need what we found no public information on: cross-tabulation, significance testing, NPS or other standard scores, open-text or sentiment analysis, per-department dashboards — and above all any rule hiding results below a minimum group size, which my works council would demand before a single question goes out. 1 2 9 12
The Academic Researcher
Custom reports shared with the team, analytics with trends, a table view with custom filters, and exports to CSV and PDF — optionally password-protected, with encrypted fields masked — are documented. The export story stops at CSV and PDF: I found no public information on cross-tabulation, significance testing, weighting, standard scores such as NPS, or SPSS and R exports with labels intact, which is precisely what my statistical pipeline requires, so everything would be re-coded by hand. 2 9 12
The Data Protection Officer
Custom reports shareable with the team, a table view with custom filters, trend tracking and CSV or PDF exports with password protection and masked encrypted fields are described. We found no public information on cross-tabulation, standard scores such as NPS or CSAT, or exports to Excel, SPSS or R, so this stays in the basic band. 1 2 9 12
The Skeptic
What is documented is a response table with custom filters, form-performance reports, shareable custom reports, and export to CSV and PDF with password protection and masked encrypted fields. We found no public information on cross-tabulation, standard scores such as NPS or CSAT, open-text or sentiment analysis, or exports to Excel, SPSS or R — this is export-and-glance rather than analysis. 1 2 9 12
Consent, GDPR & respondent data
Show reasoningHide reasoning
How this is scored
What the product gives the customer to collect personal data lawfully: consent and privacy-notice fields, anonymous surveys that really drop IP addresses and identifiers, retention periods and automatic deletion, handling of access and erasure requests, encryption of responses, a data processing agreement, and controls over cookies and tracking on the form itself.
0 — The product collects no personal data from respondents, so there is nothing to protect; or it is a different kind of product.
3 — A privacy policy and a statement of GDPR compliance, with a checkbox field usable for consent; anonymity, retention and deletion are not described.
5 — A data processing agreement offered to customers, a consent or privacy-notice field, an anonymous mode that does not store IP addresses, responses deletable by the customer, and encryption in transit and at rest stated.
8 — Retention periods with automatic deletion, tools for access and erasure requests per respondent, field-level encryption or masking of sensitive answers, forms that set no tracking cookies by default, a published list of technical and organisational measures, and a named data protection officer.
10 — Data protection by design and evidenced: end-to-end or customer-key encryption of responses, documented data minimisation defaults, a DPA with audit rights and subprocessor change notice, records of consent kept with each response, and an independent audit of the privacy controls published.
The Market Researcher
A data processing addendum is offered on request, TLS 1.2/1.3 and AES-256 at rest are stated, sensitive fields can be encrypted with each form locked behind a six-character access code even from admins and masked on export, third-party trackers are said to be absent, a Data Protection Officer is named in Utrecht, and Premium adds automatic submission deletion alongside a published post-cancellation schedule. We found no public information on an anonymous mode that drops IP addresses, per-respondent access and erasure tools, or consent records kept with each response. 2 3 4 5 6 12 14
The Operations Manager
Strong controls for respondent data: a data processing agreement offered on request, a named data protection officer with an EU address, breach notification within 72 hours, AES-256 at rest, TLS 1.2/1.3 in transit, plus field-level encryption and form encryption where even admins need the six-character access code to view data, with encrypted fields masked on export. Third-party tracking cookies are said to be fully disabled across Zoho sites, and detailed technical and organisational measures are published. Deletion after account cancellation runs within six months plus three more for backups, though automatic submission deletion is shown only on the Premium plan, and we found no public information on an anonymous mode that drops IP addresses. 2 4 5 6 14
The HR Lead
A DPA is available on request, a data protection officer is named at Zoho Corporation BV in Utrecht, encryption in transit and at rest is stated, fields can be encrypted with a per-form access code that even administrators must enter, exports mask encrypted fields and can be password-protected, and third-party tracking cookies are stated as fully disabled. However, we found no public information on an anonymous mode that withholds IP addresses or other identifiers, respondent access and erasure requests are routed only through the customer, and automatic submission deletion is listed solely under the Premium plan — deletion on a works-council timetable should not depend on the top tier. 2 3 4 5 6 12 14 15
The Academic Researcher
A data processing agreement on request, a named data protection officer at Zoho Corporation B.V. in Utrecht, a conducted impact assessment, 72-hour breach notification, TLS 1.2/1.3 and AES-256, per-form encryption with an access code even admins must supply, masking of encrypted fields on export, no third-party tracking cookies by default and a published catalogue of technical and organisational measures are all documented. For my ethics submissions the gaps are concrete: automatic submission deletion is documented only on the top paid plan, and I found no public information on an anonymous mode that does not store IP addresses or a built-in consent page as part of the instrument. 3 4 5 6 14
The Data Protection Officer
A signable data processing agreement is offered by e-mail, a data protection officer is named in Utrecht, encryption in transit and at rest plus field-level encryption and masked exports are stated, submissions can be deleted automatically on the Premium plan, and no third-party tracking cookies are used. We found no public information on an anonymous mode that drops IP addresses or a documented consent or privacy-notice field, and I would want the agreement published rather than sent only on request. 2 3 4 5 6 12 14
The Skeptic
The paperwork is unusually real: a data processing agreement on request, a named data protection officer in Utrecht, 72-hour breach notification, published technical and organisational measures, third-party tracking cookies stated as disabled, TLS 1.2/1.3 and AES-256, and field-level plus per-form encryption with a customer-held access code that even admins must enter, with encrypted fields masked on export. We found no public information on an anonymous mode that does not store IP addresses or on a consent field. Deletion is documented at account level (six-month active database cycle, backups three months later) with automatic submission deletion only on the Premium plan, and data subject requests are routed through the customer. 3 4 5 6 12 14
Hosting choice, teams & portability
Show reasoningHide reasoning
How this is scored
What the customer may choose about where and how the product runs and who uses it: a selectable data region or EU-only hosting, self-hosting or an on-premise edition, team workspaces with roles and permissions, single sign-on, an audit log, custom domains and white-labelling, and a complete export of forms and responses that another tool can import.
0 — A single-user tool with no export of forms or responses.
3 — Shared access for a team and a response export; data location, roles and single sign-on are not described.
5 — Hosting location stated with an EU option, team workspaces with at least two roles, single sign-on on a higher plan, a custom domain or removed vendor branding, and an export of all responses.
8 — EU-only hosting selectable per account or a self-hosted edition, granular roles per form or folder, SSO with SAML and user provisioning, an audit log, white-labelling, and forms and responses exportable in a documented format with an API.
10 — Full control over operation: an open-source or on-premise edition with feature parity, customer-chosen region per workspace, administrative APIs, a documented migration path in and out, and an uptime commitment with a published status history.
The Market Researcher
The German homepage states EU data-centre storage and the addendum process references the data center an account signed up in; SAML single sign-on, multi-factor authentication, an audit log over user updates and deletions, per-form change history, custom domains and removal of the Powered-by-Zoho footer on paid plans are all documented. We found no public information on a self-hosted edition, user provisioning, or any export beyond CSV and PDF — no API for moving forms or responses is described. 1 2 3 4 5 14
The Operations Manager
The German homepage states data is stored in an EU data center, and plans scale from one to a hundred users with team sharing, permissions and real-time collaboration. Single sign-on via SAML, multi-factor authentication, an audit log covering updates and deletions, custom domains and removal of the vendor footer on paid plans are all stated, and responses export as CSV or PDF with service data exportable on request. We found no public information on a self-hosted edition, user provisioning, a documented migration format or an uptime commitment. 1 2 3 5 12
The HR Lead
SAML single sign-on, multi-factor authentication, an audit log covering user updates and deletions, a per-form change log, per-form permissions and a custom domain are documented, with plan tiers defining user counts and paid plans removing the vendor footer. The German product page states EU storage in the company's own data centres while the privacy policy says personal data may be processed in the USA, the EEA and other countries — the captured pages give different figures for where data sits, which I could not resolve for the works council; we also found no public information on a self-hosted edition or an API-based export of all forms and responses. 1 3 4 5 6 10 12
The Academic Researcher
The German product page states that data is stored in a data centre within the EU, and team collaboration with permissions, custom domains, removal of the vendor footer on paid plans, SAML single sign-on, multi-factor authentication and audit logs are documented, with responses exportable to CSV and PDF. I found no public information on selecting an EU-only region per account, a self-hosted edition, user provisioning or a documented migration path in and out; also, the privacy policy describes processing in the USA, the EEA and other countries, so the captured pages give different pictures of where data runs. 1 2 5 12
The Data Protection Officer
An EU data centre is stated, and SAML single sign-on, an audit log covering updates and deletions, team sharing with permissions, a custom domain and removal of the vendor footer on paid plans are all documented alongside MFA. The captured pages give different figures for where data is held, the German page saying an EU data centre and the terms saying the USA, the EEA and other countries, and we found no public information on self-hosting or a documented export API. 1 2 3 5 6 12
The Skeptic
Team sharing with permissions, SAML single sign-on, multi-factor authentication, a customer audit log plus a per-form change log, custom domains and removal of the 'Powered by Zoho' footer on paid plans are all stated, with response export to CSV and PDF. The homepage says data is stored in an EU data center while the privacy policy says information may be processed, transferred and stored in the USA, the EEA and other countries — the captured pages give different statements on where data is held — and we found no public information on selecting an EU-only region per account, self-hosting, user provisioning, or a documented import and export format with an API. 1 2 3 5 6
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where forms and responses are hosted, and who the subprocessors are (hosting, email delivery, payment providers, analytics, AI features). Independently sourced by the sovereignty pipeline; responses often carry personal and sometimes special-category data, so the whole chain counts, not only the database.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (email, analytics, AI features, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The Market Researcher
Zoho Corporation B.V. in Utrecht is named as the EU privacy contact and the German homepage states EU data-centre storage, while the privacy policy says personal information may be processed in the USA, the EEA and other countries, safeguarded by EU standard contractual clauses, with an addendum available on request. Subprocessors are assessed but not listed with locations, and the certification claim is only an unnamed "certified for industry standards", so the chain is not verifiable end to end. 1 4 5 6
The Operations Manager
The vendor is Zoho Corporation Private Limited of Chennai, India, with Zoho Corporation BV in Utrecht named as the EU contact and data protection officer address. The German homepage states data is stored in an EU data center, while the privacy policy describes processing in the USA, the EEA and other countries under standard contractual clauses; a data processing agreement is offered by email rather than published, subprocessors are described as assessed but not listed, and certifications are referenced only generically as industry standards. 1 4 6
The HR Lead
The vendor is Zoho Corporation Private Limited of Chennai, an Indian company, with a named EU data protection contact at Zoho Corporation BV, Utrecht, a DPA offered on request and EU data-centre storage stated on the German homepage. But the captured pages give different figures for data location (the privacy policy names the USA, the EEA and other countries), no subprocessor locations are listed — only that sub-processors were assessed — certifications are referred to only generically as "industry standards", and ownership and contracting jurisdiction remain unconfirmed, so the chain cannot reach the upper levels. 1 4 6
The Academic Researcher
An EU data centre is claimed on the German homepage, an EU contact and data protection officer exist at Zoho Corporation B.V. in Utrecht, a DPA is available on request, and intra-group transfers are covered by EU standard contractual clauses. But the parent company sits in Chennai, no subprocessor list with locations is published (only that subprocessors were assessed), certifications are described only generically as industry standards, and the privacy policy itself describes processing in the USA, the EEA and other countries — the captured pages give different pictures of where personal data ends up, which is what an ethics board will press me on. 1 4 5 6
The Data Protection Officer
The vendor is Zoho Corporation Private Limited in Chennai with a named EU contact and data protection officer at Zoho Corporation B.V. in Utrecht, the German page states an EU data centre, transfers rely on standard contractual clauses, and a data processing agreement can be requested by e-mail. The captured pages give different figures for where data is held, no subprocessor list with locations is published, and certifications are claimed only generically as industry standards, so I cannot sign this chain off. 1 4 5 6
The Skeptic
The contracting vendor is Zoho Corporation Private Limited of Chennai, with a Dutch BV in Utrecht as EU and data protection contact; the German homepage claims EU datacenter storage while the privacy policy reserves processing in the USA, the EEA and other countries under standard contractual clauses — different statements about where responses may live. Subprocessors are said to have been assessed but no list with locations is published, the data processing agreement exists only on request by email, and certification is claimed only for unnamed 'industry standards'. The visible chain already runs through Apple and Google push services and PayPal, Stripe, 2Checkout and RazorPay for payments. 1 4 5 6 9
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per plan and per user, response or submission limits and what happens above them, which features (logic, branding removal, SSO, EU hosting, analysis modules) need a higher plan, add-ons, minimum term and the free tier's limits.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, responses or features is unclear.
5 — Plans are public with prices and their main limits (users, responses, forms), but at least one commonly needed piece (SSO, EU hosting, extra responses, branding removal) is unpriced or "on request".
8 — Every plan priced publicly with its limits, overage or extra-response prices, feature differences per plan in a comparison table, billing period, VAT treatment and cancellation terms stated.
10 — Complete price computability: annual cost derivable for a given number of users, responses and features, with every add-on, enterprise option, support level and data-return term published.
The Market Researcher
The captured pricing page publishes every tier's limits in detail — free with 3 forms, 500 submissions a month and 200 MB, up to Premium with 100 users, 150,000 submissions and 10 GB — plus feature placement (approvals from Standard, HIPAA and auto-deletion on Premium, footer removal on any paid plan), VAT charged on top and a seven-day non-renewal notice. But the captured pages give no price figure for any plan or add-on, so an annual cost cannot be computed from public information alone. 3 7
The Operations Manager
The pricing page lays out a clean ladder of limits — 500 submissions a month on the free tier, then 10,000, 25,000, 75,000 and 150,000 with 1, 10, 25 and 100 users — plus VAT treatment, card-only payment for terms under a year and a seven-day non-renewal notice, which tells us exactly where the response allowance sits per plan. But the captured pages show no price figure for any plan and no add-on prices, and features like HIPAA compliance, automatic deletion and SMTP are marked Premium-only without any price, so we cannot compute the annual cost from what was captured. 3 7
The HR Lead
Plan limits are fully public — from a free tier with 3 forms and 500 submissions a month up to 100 users and 150.000 submissions a month on Premium — alongside a clear feature gate per plan (approvals from Standard upward, HIPAA, SMTP and automatic deletion only on Premium, webhooks everywhere), VAT added on top, a seven-day non-renewal notice and card-only billing for terms under a year. Yet we found no public price figures for any plan and no add-on prices, so the real annual cost for a six-hundred-person company cannot be computed from the captured pages. 3 7
The Academic Researcher
The free tier and every paid plan are documented with user counts, monthly submission limits and file storage, together with which features sit on which plan (approvals from the second tier up, HIPAA compliance, SMTP and automatic deletion only on the top plan), VAT added on top of the listed prices, card-only payment for terms under a year, a seven-day non-renewal notice and the loss of trial data unless exported or upgraded. I found no public information on add-on prices or what happens above the monthly submission limits, so the faculty's true annual cost is not fully computable from the public pages I read. 3 7
The Data Protection Officer
The free tier's limits and every paid plan's user, submission and storage limits are public, with a feature table showing where approvals, HIPAA compliance, SMTP and webhooks sit, VAT stated as added on top and a seven-day non-renewal notice. We found no public information on the price figures of the paid plans or on what happens above the submission limits, so a buyer cannot yet compute an annual cost. 3 7
The Skeptic
Plan limits are unusually public: users, monthly submissions and storage for every tier, ten payment submissions on the free plan, approvals from the Standard plan, HIPAA and SMTP on Premium, branding removal on any paid plan, add-ons restricted to paid plans with the user add-on Premium-only, VAT charged on top, credit-card-only payment for terms under a year, and a seven-day non-renewal notice. We found no public information on the actual price of any plan, so a buyer cannot compute the annual cost from the captured pages. 3 7
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Zoho Forms
Is Zoho Forms European?
No. whats-best.ai classifies Zoho Forms as Rest of world.
Where does Zoho Forms store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Zoho Forms have a free plan?
Yes. Zoho Forms has a free plan, per the vendor’s page captured 28 Oct 2026.
What are the best alternatives to Zoho Forms?
As of 3 Nov 2026, the panel rates Formbricks (4/5), easyfeedback (3.5/5) and Netigate (3.5/5) highest among the other 19 Forms & Surveys products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Formbricks (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Zoho Forms alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 28 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Hosting location, Hosting options, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 12 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (16)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.zoho.com Checked 28 Oct 2026 Details →
- 2 Features page www.zoho.com Checked 28 Oct 2026 Details →
- 3 Pricing page www.zoho.com Checked 28 Oct 2026 Details →
- 4 GDPR page www.zoho.com Checked 28 Oct 2026 Details →
- 5 Security page www.zoho.com Checked 28 Oct 2026 Details →
- 6 Privacy policy www.zoho.com Checked 28 Oct 2026 Details →
- 7 Terms of service www.zoho.com Checked 28 Oct 2026 Details →
- 8 Form & survey building — found from sitemap www.zoho.com Checked 28 Oct 2026 Details →
- 9 Form & survey building — found from sitemap www.zoho.com Checked 28 Oct 2026 Details →
- 10 Distribution, response collection & workflows — found from sitemap www.zoho.com Checked 28 Oct 2026 Details →
- 11 Distribution, response collection & workflows — found from sitemap www.zoho.com Checked 28 Oct 2026 Details →
- 12 Survey analysis & reporting — found from sitemap www.zoho.com Checked 28 Oct 2026 Details →
- 13 Survey analysis & reporting — found from sitemap www.zoho.com Checked 28 Oct 2026 Details →
- 14 Consent, GDPR & respondent data — found from sitemap www.zoho.com Checked 28 Oct 2026 Details →
- 15 Consent, GDPR & respondent data — found from sitemap www.zoho.com Checked 28 Oct 2026 Details →
- 16 Imprint — found from the homepage www.zoho.com Checked 1 Nov 2026 Details →