Enterprise
A form backend your security team will sign off on
Formward runs entirely in the EU: hosting, database, and every sub-processor that touches submission data. For an enterprise buyer that means the usual procurement questions — residency, processor terms, access control, SSO — have straightforward answers instead of a US data-transfer assessment.
What's included
EU data residency
App and PostgreSQL run in Sweden on infrastructure operated by Hostup AB. Every sub-processor that touches submission data is in the EU/EEA — see the sub-processor register.
DPA and Article 30 record
A Data Processing Agreement is available from privacy@formward.eu, and our Article 30 record of processing is published in the compliance pack.
Audit log
Operator and admin actions on your account and submissions are recorded and visible in the audit viewer. The export from account settings covers your own actions; an org-wide export is not available yet.
Team seats and roles
Owner, admin, and member roles per organization, up to 50 seats on Business. Invite, revoke, and transfer ownership from the dashboard.
Single sign-on
Per-organization OIDC, so your team signs in through your own identity provider. See the SSO page for how it works.
Submission firewall
Per-form rate limiting and disposable-email blocking, on top of honeypot and spam filtering, to keep junk out of the forms your team relies on.
Scheduled exports
Automatic CSV or JSON exports of your submissions on a daily, weekly or monthly schedule, delivered by email or to our EU object storage. Delivery into your own warehouse or drive is not supported yet.
White-label hosted pages
Hosted form pages at your own custom slug under formward.eu/s/…, no Formward branding required.
What we do not have yet
We would rather you know this up front than find out during a security review. We do not hold a SOC 2 audit or ISO 27001 certification; both are on the roadmap and neither is claimed anywhere on this site. Single sign-on is configured over OIDC — SAML is not something you can set up yourself, so talk to us first if that is all your identity provider speaks.
Support and procurement
Every plan gets email support at support@formward.eu. Business customers get priority handling. For security questionnaires, a DPA, or volume beyond the 20,000 submissions on the Business plan, high volume or custom requirements — talk to sales@formward.eu.
Frequently asked questions
- Where does our form-submission data live?
- In Sweden, on infrastructure operated by Hostup AB. The application and PostgreSQL database run there, and every sub-processor that touches submission data — notification email via Mailjet (Sinch), optional AI enrichment via Mistral AI — is in the EU/EEA.
- Do you hold SOC 2 or ISO 27001?
- No. We do not currently hold a SOC 2 audit or ISO 27001 certification, and we do not claim either. Our security and data-protection posture is documented openly on our Security and Trust pages; a formal SOC 2 programme is on the roadmap.
- Do you support SCIM and SAML?
- SCIM yes, SAML not self-serve. SCIM 2.0 provisioning and deprovisioning ship on the Business plan, driven by a token you issue in the dashboard. Single sign-on is configured per organization over OIDC; if your identity provider only speaks SAML, contact sales@formward.eu.
- Can we get a DPA and see your record of processing?
- Yes. The Data Processing Agreement is published at formward.eu/dpa and can be accepted in-app from your dashboard, and our Article 30 record of processing and sub-processor register are published in the compliance pack.
- What support should we expect?
- Email support at support@formward.eu for every plan; Business customers get priority handling. For enterprise procurement, security questionnaires, or a DPA walkthrough, reach sales@formward.eu directly.
Talk to us before you commit
Bring your security questionnaire. We would rather answer it up front than have it surface a surprise later.