EU data residency
Form backend data residency in Europe
Data residency is a simple question with awkward answers for most form tools: where does the data physically live? With Formward, the answer is Europe. The application is self-hosted in Sweden, submissions and backups stay in the EU, and every sub-processor that touches submission data is in the EU/EEA. There is no region toggle to set — EU residency is the default on every plan.
Your form-submission data — and the personal data of the people who fill in your forms — does not leave the EU/EEA. The only third-country touchpoints are optional Cloudflare Turnstile (off unless you enable it) and Stripe for billing of paying customers, neither of which receives form-submission content.
Where your data lives
Every processor that handles form-submission data, and where it sits:
| Data | Location | Processor |
|---|---|---|
| Submissions, account data, file attachments, backups | Sweden (EU) | Hostup AB |
| Notification email delivery | France (EU) | Mailjet (Sinch) |
| Optional AI enrichment (paid plans) | France (EU) | Mistral AI |
The canonical, current list — including the billing sub-processor — is in our sub-processor register.
Why residency in Europe matters
Form submissions usually contain personal data. When the form backend is a US service running on US infrastructure, that personal data is stored or processed outside the EU, and you have to govern an EU–US transfer under Chapter V of the GDPR and account for US surveillance law (the issue at the heart of the Schrems II ruling). Keeping the data in the EU/EEA removes that transfer question for the submission data entirely — there is no third-country transfer to assess.
Europe versus US-hosted form tools
Formward
- Submission data stored in Sweden.
- EU-only sub-processors for submission data.
- Backups kept within the EU.
- No Chapter V transfer of submission data.
Typical US-hosted form tool
- Data stored or processed in the US.
- Sub-processors may include US providers.
- Backups may reside outside the EU.
- EU–US transfer governance required.
Frequently asked questions
- Where does Formward store form-submission data?
- Submissions, account data, file attachments, and backups are stored in Sweden on infrastructure operated by Hostup AB. The application and PostgreSQL database run on EU infrastructure. There is no US-based or non-EU cloud for personal data.
- Does any submission data leave the EU/EEA?
- No. By design, form-submission data and the personal data of the people who fill in your forms stays inside the EU/EEA. Every sub-processor that touches submission data — hosting, notification email, optional AI enrichment — is located in the EU.
- Are backups also kept in Europe?
- Yes. We take regular encrypted backups of the PostgreSQL database and keep them within the EU (Sweden). Data may persist in encrypted backups for a limited period after deletion before being overwritten on the normal rotation cycle.
- What about the US touchpoints I have heard about?
- There are two, and neither receives form-submission content. Cloudflare Turnstile is an optional anti-bot challenge that is off unless you enable it per form. Stripe processes the paying customer's own billing data to run subscription payments. Both are covered by Article 46 safeguards and documented in our transfer-impact statement.
- Do I need to configure anything to get EU data residency?
- No. EU data residency for submission data is the default on every form and every plan, including the free plan. There is no region setting to choose.
Keep your form data in Europe
Start free with 100 submissions a month. EU data residency on every plan, with no region to configure.