Use case · GDPR-compliant forms
Forms that keep data in the EU
Sometimes the requirement is simple to state and awkward to meet: the form data has to stay in the EU, and the GDPR paperwork has to be in order. A lot of form tools route data through non-EU infrastructure, which turns a simple form into a data-transfer question. With Formward, EU data residency is the default, not a configuration step.
What GDPR-clean means here
- Hosted in the EU. Run in Sweden, in EU data centres, with no non-EU infrastructure for personal data.
- EU-only sub-processors. Every third party that touches form-submission data is in the EU, and they are listed in our Privacy Policy. (Billing is handled by Stripe, as with most EU SaaS, and Stripe never receives form data.)
- Formward processes form data in the EU/EEA. Your form-submission data - the personal data of the people who fill in your forms - is stored and processed inside the EU/EEA. What leaves is what you route out: a notification mailbox hosted elsewhere, Sheets sync, or a webhook URL.
- Privacy-preserving defaults. Submitter IPs are salted-hashed (HMAC-SHA-256) on receipt, and any AI processing runs within the EU.
- DPA included. The Data Processing Agreement is published at formward.eu/dpa and can be accepted in your dashboard.
How Formward does it
You do not have to do anything special to get EU data residency: it applies to every form on every plan. For the specifics, read our security page and privacy policy. To wire up a form, see the docs or browse the form library.
Example
A consent-aware newsletter form. The data, and the consent record, are stored in the EU.
<form action="https://forms.formward.eu/f/your-endpoint" method="POST">
<input type="email" name="email" placeholder="Email" required />
<label>
<input type="checkbox" name="consent" value="yes" required />
I agree to receive emails and to the privacy policy.
</label>
<button type="submit">Subscribe</button>
</form>GDPR-clean by default
Start free. EU data residency on every plan, from the first submission.