Compliance / Sub-processors
Sub-processor register
Last updated: 2026-10-27
Formward acts as a processor on your behalf and engages the sub-processors below to provide the Service. Every sub-processor that touches form-submission data is located in the EU/EEA, and Cloudflare Turnstile - the only US-touching processor that can ever see submission-adjacent data - is engaged only at your option, per form. Billing of paying customers is handled by Stripe Payments Europe, Limited in Ireland, which never receives form-submission data. Plausible Insights OÜ in the EU processes statistics about Formward's own website and dashboard and never receives form-submission data either. This register is the canonical, current list; it is referenced by our Data Processing Agreement.
| Sub-processor | Purpose | Location | Data processed | Scope |
|---|---|---|---|---|
| Hostup AB | Cloud hosting and the PostgreSQL database that stores submissions, account data, and backups | Sweden (EU) | Full submission payloads, account data, file attachments, hashed submitter IPs | Always |
| Mailjet (Sinch) | Transactional email delivery of submission-notification emails to form owners | EU (French data centre) | Recipient email address and notification content (which can echo submission fields) | Always |
| Mistral AI | AI enrichment of submissions (spam scoring, summarisation, lead scoring). On AI-enabled plans this is ON by default and can be switched off per form. | EU (France) | Submission content, only for forms on a plan with AI enabled and only when AI features are used. The description a visitor types into the form builder at formward.eu/build before signing up, when that builder is switched on; it is not stored. | AI plans, on by default |
| Cloudflare, Inc. | Optional anti-bot challenge (Cloudflare Turnstile), enabled per form by the customer | United States | Challenge data from the visitor's browser, such as the IP address and browser signals. No submission answers. Formward's own server does not send the submitter's IP address to Cloudflare unless the operator opts in to forwarding it. | Optional |
| Stripe Payments Europe, Limited | Subscription billing and payment processing for paying customers (merchant of record). Stripe never receives form-submission data. | Ireland (EU). Stripe may transfer some billing data to its US affiliates, including Stripe, Inc., under SCCs and the EU-US Data Privacy Framework. | The paying customer's name, email address, billing address, and payment-method details. No form-submission content or submitter PII. | Always |
| Plausible Insights OÜ | Website and dashboard statistics (Plausible Analytics) for Formward's own site, cookieless. Not used on hosted forms, customer Pages or embeds. | EU (Estonia; data hosted by Hetzner in Germany) | The page address with identifiers removed and only campaign tags kept, the referring site's host, browser user agent and IP address, for page views and two onboarding events with no further detail (account created, form created). Plausible derives location and device type from them and stores neither the IP address nor the user agent. No form-submission content. | Always |
Optional sub-processors
Mistral AI is engaged only for forms whose owner is on a plan that includes AI features. Free and Personal submissions are never sent for AI enrichment at all. Be aware that on the plans which do include AI, the AI features are on by default and can be switched off per form in the form's settings - unlike Cloudflare Turnstile below, which is off until you enable it. If you need to document a shorter processor list, turn the AI toggles off before your first submission. Mistral processes data within the EU (France).
Cloudflare Turnstile is off by default and used only on forms where you explicitly enable the anti-bot challenge. When enabled, the visitor's browser loads and solves the Turnstile widget, so Cloudflare (a US provider) processes challenge-related data from the browser. Formward's server-side verification call does not transmit the submitter's IP address to Cloudflare. To keep all processing in the EU/EEA, simply leave Turnstile disabled. See the transfer-impact statement for the safeguard posture.
Billing sub-processor (Stripe)
Payments are handled by Stripe Payments Europe, Limited (Ireland), our contracting entity. Stripe acts as merchant of record for subscription billing. To do so it processes the paying customer's own billing and payment data - name, email address, billing address, and payment-method details. Stripe may transfer some of this billing data to its US affiliates, including Stripe, Inc., under Standard Contractual Clauses and the EU-US Data Privacy Framework, where Stripe is certified.
This is distinct from your form data. Stripe never receives form-submission content or the personal data of the people who fill in your forms; that data stays within the EU/EEA sub-processors listed above. The Stripe touchpoint concerns only the billing relationship between Formward and its paying customers, in line with how most EU SaaS handles card payments. See the transfer-impact statement for the safeguard posture.
Statistics sub-processor (Plausible)
Alongside its own first-party, cookieless page-view counter, Formward uses Plausible Analytics (Plausible Insights OÜ, Estonia; data hosted by Hetzner in Germany) for statistics about its own website and signed-in dashboard. Page views are sent through Formward's own domain, nothing is stored on the visitor's device (only the visitor's own consent choice is read, so that a no is honoured), and Plausible never receives form-submission content. It is not used on hosted forms, customer Pages or embeds. See the Privacy Policy for exactly what each records.
Plausible is Formward's own processor for these statistics, about visitors to formward.eu and its signed-in users. It processes none of the personal data collected through your forms (Customer Personal Data under the DPA), so it is not a sub-processor for that data and section 7 of the DPA does not list it. It is listed here for transparency.
Change-notification commitment
We maintain the current sub-processor list on this page. Before we add or replace a sub-processor, we will give affected customers prior notice and a reasonable opportunity to object on legitimate data-protection grounds. If you object and we cannot reasonably accommodate the objection, you may terminate the affected part of the Service as set out in the DPA. Formward remains responsible to you for each sub-processor's performance of its obligations. To be notified of changes, contact privacy@formward.eu.