# Zoho Forms — Forms & Surveys Zoho Forms by Zoho Corporation Private Limited holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-10-29. Provenance: Rest of world; sovereignty: not determined. - Vendor: Zoho Corporation Private Limited (https://www.zoho.com/forms/) - Category: [Forms & Surveys](https://whats-best.ai/software/forms-and-surveys.md) - Provenance (editorial classification): Rest of world - Canonical page: https://whats-best.ai/software/forms-and-surveys/zoho-forms - Alternatives: https://whats-best.ai/software/forms-and-surveys/zoho-forms/alternatives ([markdown](https://whats-best.ai/software/forms-and-surveys/zoho-forms/alternatives.md)) - Data as of: 2026-11-04 · evaluated 2026-10-29 · oldest source captured 2026-10-28 **AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology ## At a glance - Vendor: Zoho Corporation Private Limited - Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026 - Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026 - Free plan: Yes, per the vendor’s own page [S9] ## The panel's verdict Zoho Forms is the Zoho suite's online form builder, strongest on collection and workflows, weakest on analysis and reporting. Collection and workflows scores cluster at 7: kiosk and offline collection, payments via PayPal, Stripe, 2Checkout and RazorPay, signatures, webhooks on every plan and multi-level approvals. Form building follows at 6-7 (drag-and-drop, over 200 templates, nested logic), and consent and data protection at 6-8: the operations manager scored 8 for per-form encryption whose six-character access code even admins must enter, while the HR lead held 6 because automatic submission deletion appears only on Premium. Analysis and reporting clusters at 4: export is CSV and PDF, with no public information on cross-tabulation, NPS or SPSS exports. Pricing transparency scores 3-5: limits are public — free tier 3 forms and 500 submissions a month, Premium 100 users and 150,000 — but no price figure appears. Sovereignty scores 4-5; the captured pages give different statements on where data is held — an EU data centre on the German page, the USA, the EEA and other countries in the privacy policy. **Speaks for it:** - Deep collection and routing: kiosk and offline collection, payments through PayPal, Stripe, 2Checkout and RazorPay, signatures, email and SMS notifications, webhooks on every plan, and multi-level approvals with delegation and auto-approve - Field-level and per-form encryption with a six-character access code that even administrators must enter, and encrypted fields masked on export - A named data protection officer at Zoho Corporation B.V. in Utrecht, a data processing agreement on request, 72-hour breach notification and published technical and organisational measures - Plan limits are fully public, from the free tier (3 forms, 500 submissions a month, 200 MB) to Premium (100 users, 150,000 submissions a month, 10 GB) - SAML single sign-on, multi-factor authentication, a customer audit log and a per-form change log are documented, where hosting and administration scores 6-7 **Held against it:** - Analysis and reporting clusters at 4: export stops at CSV and PDF, with no public information on cross-tabulation, NPS or CSAT, sentiment analysis, or SPSS, Excel and R exports - No price figure appears for any plan or add-on — with VAT added on top and card-only payment for terms under a year, an annual cost cannot be computed from the captured pages - The captured pages give different statements on where data is held: the German homepage states an EU data centre, while the privacy policy names the USA, the EEA and other countries - Subprocessors are described as assessed but not listed with locations, and certifications are claimed only generically as industry standards - Automatic submission deletion is documented only on the Premium plan, and data subject requests are routed through the customer **Best for:** - You run operations-style workflows — leave requests, purchase orders, expense reports — that need multi-level approval routing, payments and signatures inside the form - Your team collects responses in the field or at events, using kiosk mode, offline mobile collection or camera uploads - You need respondent-data controls such as per-form encryption whose access code even administrators must supply - You plan to export responses as CSV or PDF and do the analysis elsewhere, for example in spreadsheets or the Zoho Analytics integration **Avoid if:** - You need survey analysis built in — cross-tabulation, significance testing, NPS or sentiment — since the documented output is a filtered table, shareable reports and CSV/PDF export - You must compute an annual cost from published prices before purchase, and the captured pages show plan limits but no price figures - Your compliance sign-off needs a fully verifiable chain — ask the vendor: the public pages we read do not show it ## Scores by judge and criterion Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion. | Criterion | The Market Researcher | The Operations Manager | The HR Lead | The Academic Researcher | The Data Protection Officer | The Skeptic | | --- | --- | --- | --- | --- | --- | --- | | Form & survey building | 3.5/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | 3.5/5 | | Distribution, response collection & workflows | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | | Survey analysis & reporting | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | | Consent, GDPR & respondent data | 3.5/5 | 4/5 | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | | Hosting choice, teams & portability | 3/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | | European sovereignty | 2.5/5 | 2/5 | 2/5 | 2.5/5 | 2/5 | 2/5 | | Pricing transparency | 2/5 | 2/5 | 2/5 | 2.5/5 | 2/5 | 1.5/5 | | **Weighted verdict** | **3/5** | **3/5** | **2.5/5** | **3/5** | **3/5** | **2.5/5** | ### The judges - **The Market Researcher** (v1.0): Runs customer and brand studies for a mid-sized consumer-goods company, three waves a year in four languages. Wants logic and quotas that keep the sample clean, invitations with reminders, cross-tabs and NPS without exporting to a spreadsheet first, and open answers grouped into themes before the board meeting. - **The Operations Manager** (v1.0): Replaces paper and PDF forms at a service company: event registrations, supplier onboarding, damage reports with photos, order requests with a payment. Wants forms a colleague can build without IT, file uploads, a submission that lands in the right inbox and the CRM or spreadsheet without copy and paste, and a price that does not jump when the response count does. - **The HR Lead** (v1.0): Runs the yearly engagement survey and pulse checks for a German company of six hundred, with the works council reading every question. Wants anonymity that is real and stated, results hidden below a minimum group size, reports per department that managers can read, and answers that are deleted when the agreement with the works council says so. - **The Academic Researcher** (v1.0): Runs questionnaire studies at a European university and has to satisfy the ethics board before the first respondent sees a question. Wants complex branching, randomisation and validated scales, an informed-consent page that is part of the instrument, exports to SPSS and R with labels intact, and a licence the faculty can host or at least keep in the EU. - **The Data Protection Officer** (v1.0): Signs off every form tool a department wants to use and has found health data in a feedback form before. Wants a data processing agreement and a subprocessor list on the vendor's own pages, consent fields and an anonymous mode that drops IP addresses, retention periods that delete on their own, EU hosting the customer can choose, and roles that keep responses away from people who do not need them. - **The Skeptic** (v1.0): Has seen a "free form builder" put its logo on every customer survey and charge per response the month the campaign worked. Reads "GDPR compliant" with no data processing agreement behind it, "anonymous" surveys that still log IP addresses, "EU hosting" on the enterprise plan only, and AI analysis features with no word on where the answers go — and asks whether the responses can leave with the customer. ## European sovereignty — proven facts Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined. | Dimension | Finding | Points | Source | |---|---|---|---| | Legal entity | Not determined | — | — | | Hosting location | Not determined | — | — | | Hosting options | Not determined | — | — | | Open source | Not determined | — | — | | Data processing agreement | Not determined | — | — | | Transfer impact assessment | Not determined | — | — | ## Key facts Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources). **Compliance** - Breach notification 72 hours: 72 [S4] - Breach notification channels: blogs, forums, social media · email to primary email address [S4] - Captcha: yes [S2] - Certifications: yes [S6] - Children min age: 16 [S6] - Custom domain sharing: yes [S2] - Data deletion option: FAQ question only; answer text not shown on captured page · yes [S15] - Data export option: FAQ question only; answer text not shown on captured page · yes [S15] - Dkim: yes [S2] - DPA available: Data Processing Addendum based on Model Contractual Clauses [S4] - DPA available: per Formular anfordern · yes [S6] - DPA request email: legal@zohocorp.com · admins email legal@zohocorp.com mentioning their data center [S4] - Dpia conducted: yes [S4] - Employee background checks: yes [S5] - Encryption at rest: data at rest encrypted based on sensitivity and risk [S4] - Ewr rights extended globally: yes [S6] - Field encryption: yes [S2] - Form audit: yes [S2] - GDPR: yes [S2] - GDPR baseline worldwide: GDPR controls implemented as baseline standard for all operations worldwide [S4] - GDPR breach notification: 72 [S5] - GDPR effective date: 2018-05-25 [S4] - Information asset register: Information Asset Register covering roles, data categories, access and purpose [S4] - Internal audits: yes · yes [S5] - Internal audits conducted: yes [S4] - ISMS: yes [S5] - No ad revenue: Zoho states it never sold user information to third parties for advertising purposes [S6] - No advertising monetization: no [S4] - No cc card storage default: no [S6] - No data selling: no · no [S15] - No third party tracking: yes [S1] - No third party tracking: no [S6] - Owasp framework: OWASP [S5] - Page updated: 12 January 2025 [S15] - Penetration testing: yes [S5] - Privacy contact email: privacy@zohocorp.com [S4] - Privacy contact email: privacy@zohocorp.com [S15] - Privacy policy URL: https://www.zoho.com/privacy.html · yes [S15] - Product GDPR assessment: all Zoho products individually assessed against GDPR with new privacy-control features [S4] - Scc transfers: EU Standardvertragsklauseln / Gruppenunternehmensvereinbarung [S6] - Ssl: SSL certification [S2] - Subprocessor assessment: sub-processors assessed and contract process streamlined [S4] - Third party cookies disabled: no [S6] - Trackers: yes · no [S15] **Data** - Account deletion active db: 6 · 3 [S6] - Backup deletion: 3 [S5] - Backup schedule: wöchentlich · AES-256 · täglich · 3 [S5] - Card number not stored: no [S6] - Data subject requests via customer: über den Kunden (Datenverantwortlichen) [S6] - Deletion schedule: 3 · 6 [S5] - Device disposal: degauss+shred · crypto_erase+shred [S5] - Dormant account cleanup: databases cleaned up by removing terminated and dormant accounts [S4] - Free account expiry: 120 [S5] - No ad monetization: no [S14] - Report export: CSV · PDF [S2] - Retention active db: 6 · 3 [S6] - Servicedata export deletion: yes · yes [S6] - Servicedata ownership: yes [S6] - Submission pdf: yes [S2] **Hosting** - Datacenter model: colocation · yes [S5] - EU datacenter: EU [S1] - International transfer: USA · EWR · andere Länder [S6] - Own datacentres: Zoho uses its own tools hosted in its own data centres [S14] **Integrations** - App forwarding: yes [S2] - Asana: Asana · Add new Zoho Forms submissions as tasks [S11] - Dropbox: Dropbox · Convert new Zoho Forms submissions into Dropbox files [S11] - Mailchimp: Mailchimp · Add new Zoho Forms submissions as subscribers [S11] - Named integrations: Microsoft 365 · Google Workspace · Salesforce · Zapier · Microsoft Teams · Google Sheets · Slack · OneNote · Trello · WordPress [S1] - Over 150 apps: 150+ [S1] - Quickbooks: QuickBooks · Add new Zoho Forms submissions as invoices [S11] - Slack: Slack · Send Slack messages for new Zoho Forms submissions [S11] - Utm tracking: Google Analytics · Facebook Pixel [S2] - Webhooks: yes [S2] - Zapier: Zapier · 1000 [S11] - Zapier no code: no [S11] - Zapier setup time: Einrichtung in wenigen Minuten [S11] - Zendesk: Zendesk · Add new Zoho Forms submissions as tickets [S11] - Zoho apps: CRM · Desk · Projects · SalesIQ · Recruit · Flow · Campaigns · Bigin · Sign · Mail · Creator · Connect · Notebook · Cliq · Analytics [S1] **Legal** - Dnt honored: no [S6] - GDPR addendum on request: yes [S6] - No sale of personal info: no [S6] - Policy last updated: 2022-03-02 [S6] - Privacy contact email: privacy@zohocorp.com [S6] - Terms updated: 2022-03-02 [S7] **Pricing** - Addon restrictions: yes · yes [S3] - Basic limits: 1 · 500 MB · 10000 [S3] - Fee changes next billing cycle: after current billing cycle [S7] - Free builder: yes [S1] - Free limits: 3 · 1 · 200 MB · 10 · 500 [S3] - Free signup: yes [S8] - Free signup: yes [S10] - Free trial data loss: purchase_paid_plan · purchase_upgrades · export_before_trial_end [S7] - Free trial duration: free plan duration (FAQ listed, answer not shown) [S3] - Free trial no warranty: yes · yes [S7] - Premium limits: 100 · 10 GB · 150000 [S3] - Professional limits: 25 · 5 GB · 75000 [S3] - Renewal notice period: 7 [S7] - Standard limits: 10 · 2 GB · 25000 [S3] - Subscriptions card only under one year: subscriptions with term under one year · credit_card_only [S7] - Taxes additional: MwSt. · yes [S7] - VAT note: local taxes such as VAT are added on top of listed prices [S3] **Product** - Access code: alphanumeric · 6 · yes [S14] - Admin proxy decisions: yes [S10] - Advanced field comparison: Advanced rules compare two field values dynamically [S8] - AI data use: RegEx-Parsing · Vorlagenzuordnung · künstliche Intelligenz · maschinelles Lernen · yes · yes [S6] - Analytics: yes [S2] - App integrations: yes · yes · yes · yes [S9] - Approval workflow: yes [S2] - Approval workflow: yes [S11] - Approval workflows: yes · yes [S9] - Approver field modification: yes [S10] - Approver routing: yes [S10] - Auto approve deny: yes [S10] - Auto deny: yes [S10] - Branching logic: yes [S2] - Branding: yes [S2] - Branding customization: logos · backgrounds · fonts [S1] - Calculation fields: yes [S2] - Camera upload: yes [S2] - Card forms: yes [S1] - Choice filtering: Conditional option filtering in Radio and Dropdown fields [S8] - Code recovery: Forgotten access code can be retrieved via registered email [S14] - Code sharing: Access code can be shared with teammates from the Share panel [S14] - Conditional logic: Conditional logic form builder [S8] - Conditional logic: yes [S9] - Conditional submission denial: Automatically reject submissions that don't meet conditions, with denial messages [S8] - Confirmation emails: yes [S2] - Contextual stage notifications: yes · yes [S10] - Custom css: yes [S2] - Custom designs templates: yes [S11] - Custom documents: yes [S2] - Custom domain: yes [S2] - Custom messages: yes [S2] - Customer audit log: alle Aktualisierungs- und Löschvorgänge · yes [S5] - Customer stats: 100K · 1.7B · 554K · 125M [S1] - Data isolation: yes [S5] - Data ownership: yes [S5] - Ddos protection: yes [S5] - Disaster recovery: near_realtime · yes [S5] - Dmarc: yes [S5] - Document merge: yes [S9] - Drag and drop: yes [S11] - Drag drop builder: yes [S9] - Embed webpages: yes [S2] - Encrypted field masking: yes [S12] - Encryption at rest: 256 · AES [S5] - Encryption in transit: 1.2 · 1.3 [S5] - Export formats: csv · pdf [S12] - Failsafe fallback: yes [S10] - Field form rules: yes [S11] - Field permissions: yes [S10] - Field rules: Field rules show/hide fields based on prior answers [S8] - Field types: 30 [S2] - Field types: >30 [S9] - Field types: Textfelder · Mehrfachauswahl · Optionsfelder · Zahlungsfelder · Datei-Uploads [S11] - Field validations: yes [S2] - Field visibility per level: yes [S10] - Form encryption: Form Encryption protects every submission with a secret access code controlled by the organization [S14] - Form formats: Standard · Kartenformulare [S9] - Form types: standard forms with pagination and logic · card forms [S1] - Free no custom branding: Free · custom branding · no [S3] - Free powered by removal: all paid plans · Powered by Zoho footer removal [S3] - Free tier: yes [S9] - Free tier features: yes · yes · yes · yes · PayPal · Stripe · 2Checkout [S9] - Free tier limits: yes [S9] - Geolocation: yes [S2] - Hsts: yes [S5] - Incident notifications: yes [S5] - Industry solutions: education · healthcare · e-commerce · construction · travel [S1] - Integration trigger on approval: yes [S10] - Invoices receipts: yes [S2] - Kiosk mode: yes [S2] - MFA: Touch-ID · Face-ID · Push · QR-Code · TOTP · YubiKey [S5] - Microsoft teams: yes [S2] - Mobile app: mobile app iOS and Android · yes [S3] - Mobile app: yes [S2] - Mobile app approvals: yes [S10] - Mobile apps: iOS · Android · yes [S11] - Mobile capabilities: offline data collection · geolocation · QR code scanner · e-signatures · file and image upload · card scanner · kiosk mode [S1] - Mobile offline: yes · yes [S9] - Multi level approvals: Multiple levels of approval; approvers at each level can approve or deny entries [S10] - Multi page forms: yes [S2] - Nested conditional logic: yes [S10] - Network segregation: yes [S5] - No code builder: yes · yes [S1] - No code builder: Drag-and-drop no-code form builder [S2] - Offline data collection: yes [S1] - Offline mode: yes [S2] - Offline permanent storage: yes [S12] - One click approve: yes [S10] - Opportunistic tls email: yes [S5] **Support** - Resources: User Guide, How Tos, Webinars, FAQs, What's New, Blogs, Ebooks, Tips & Tricks, Videos, Usecases [S10] - Security contact: security@zohocorp.com [S5] 44 more facts on the canonical page: https://whats-best.ai/software/forms-and-surveys/zoho-forms ## Questions ### Is Zoho Forms European? No. whats-best.ai classifies Zoho Forms as Rest of world. ### Where does Zoho Forms store data? Not stated on the vendor’s pages as of 1 Nov 2026. ### Does Zoho Forms have a free plan? Yes. Zoho Forms has a free plan, per [the vendor’s page captured 28 Oct 2026](https://whats-best.ai/evidence/11900). ### What are the best alternatives to Zoho Forms? As of 3 Nov 2026, the panel rates [Formbricks (4/5)](https://whats-best.ai/software/forms-and-surveys/formbricks), [easyfeedback (3.5/5)](https://whats-best.ai/software/forms-and-surveys/easyfeedback) and [Netigate (3.5/5)](https://whats-best.ai/software/forms-and-surveys/netigate) highest among the other 19 Forms & Surveys products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Formbricks](https://whats-best.ai/software/forms-and-surveys/formbricks) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Zoho Forms alternatives](https://whats-best.ai/software/forms-and-surveys/zoho-forms/alternatives). ## What this page leaves out - 12 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 8 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. - 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. ## Sources - [S1] Vendor homepage: https://www.zoho.com/de/forms/ (checked 2026-10-28) - [S2] Features page: https://www.zoho.com/de/forms/features.html (checked 2026-10-28) - [S3] Pricing page: https://www.zoho.com/de/forms/pricing.html (checked 2026-10-28) - [S4] GDPR page: https://www.zoho.com/gdpr.html (checked 2026-10-28) - [S5] Security page: https://www.zoho.com/de/security.html (checked 2026-10-28) - [S6] Privacy policy: https://www.zoho.com/de/privacy.html (checked 2026-10-28) - [S7] Terms of service: https://www.zoho.com/de/terms.html (checked 2026-10-28) - [S8] Form & survey building — found from sitemap: https://www.zoho.com/forms/conditional-logic.html (checked 2026-10-28) - [S9] Form & survey building — found from sitemap: https://www.zoho.com/forms/html-form-builder/ (checked 2026-10-28) - [S10] Distribution, response collection & workflows — found from sitemap: https://www.zoho.com/forms/approval-workflow.html (checked 2026-10-28) - [S11] Distribution, response collection & workflows — found from sitemap: https://www.zoho.com/forms/zapier-integrations.html (checked 2026-10-28) - [S12] Survey analysis & reporting — found from sitemap: https://www.zoho.com/forms/export-reports.html (checked 2026-10-28) - [S13] Survey analysis & reporting — found from sitemap: https://www.zoho.com/de/forms/export-reports.html (checked 2026-10-28) - [S14] Consent, GDPR & respondent data — found from sitemap: https://www.zoho.com/forms/form-encryption.html (checked 2026-10-28) - [S15] Consent, GDPR & respondent data — found from sitemap: https://www.zoho.com/privacy/privacy-faq.html (checked 2026-10-28) - [S16] Imprint — found from the homepage: https://www.zoho.com/de/impressum.html (checked 2026-11-01) --- Cite as: whats-best.ai, "Zoho Forms — Forms & Surveys", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/forms-and-surveys/zoho-forms Corrections: https://whats-best.ai/correct/1114?target=page