A GDPR form backend, hosted in the EU

What makes it GDPR-clean

• Hosted in the EU. The application, PostgreSQL database, uploaded files and encrypted backups are in Sweden on infrastructure operated by Hostup AB.
• EU-only sub-processors for submission data. Notification email goes through Mailjet (Sinch) from an EU data centre in France; optional AI enrichment runs on Mistral AI in France. Cloudflare Turnstile (US) is the one optional exception and sees challenge data only. The full list is in our sub-processor register.
• Keyed-hash submitter IPs. Submitter IP addresses are protected with a keyed hash (HMAC-SHA-256 using a secret server-side salt) on receipt. Raw IPs are never written to disk.
• Export and erasure, self-serve. From the Personal plan, the DSAR console finds a person's submissions across all your forms, exports them and erases them with a certificate. See handling data subject requests.
• Consent and retention per form. Consent capture stores the agreed text and time with each submission, on every plan. Retention deletes submissions and files automatically (fixed at 30 days on Free). Background on both is in our GDPR guide for web forms.
• Processor terms and records. Formward acts as your processor with a Data Processing Agreement available, and our Article 30 record of processing is published in the compliance pack.
• No ad or profiling trackers. We do not run advertising or profiling trackers on your visitors.

GDPR features by plan

The parts a compliance review usually asks about, and which plan includes them. Prices and limits are on the plans page; Free includes 50 submissions a month.

What stays your job

EU hosting is not the same as GDPR compliance. Formward is the processor; you are the controller, and these decisions are yours:

• A lawful basis for each form and a privacy notice that mentions it. The GDPR guide for web forms walks through both.
• Consent wording, if consent is your basis. See consent checkboxes.
• How long to keep submissions. See form data retention.
• Accepting the DPA in your account settings, and listing Formward in your own records.
• Checking any destination you add outside the EU, such as a Gmail inbox, Google Sheets or a US webhook. The transfer-impact statement explains which routes leave the EU.

Compared with US form backends

Many popular form backends are US companies running on US infrastructure. They are capable products, but for an EU business the form data itself then sits outside the EU, which turns a simple contact form into an EU-US data-transfer question under Chapter V of the GDPR.

Stated plainly, because the distinction matters. Formward's own storage and processing stay in the EU/EEA. Outside it, there is optional Cloudflare Turnstile (US), and billing through Stripe Payments Europe (Ireland), which may pass some billing data to Stripe in the US. Neither receives form-submission content. What leaves the EU is what you direct out of it - among them a notification mailbox hosted outside the EU (Gmail, for example), the autoresponder, which replies to whatever address a submitter typed, Google Sheets sync, and any webhook URL. You choose those destinations as the controller, and your data-flow map lists the ones each form has switched on; we can tell you where we send from, never where someone else's mailbox or server is. The full detail is in our transfer-impact statement.

It is still just an HTML form endpoint

GDPR-clean hosting does not mean a heavier integration. You point your existing form at a Formward endpoint and submit over a standard POST. There is no SDK to install and it is framework-agnostic. Send the Accept: application/json header or use fetch() for a JSON response. See the docs to wire one up.

A newsletter signup with a consent box. With consent capture switched on in the form's settings, Formward stores the configured consent text and the time with each submission that ticks it; the label should match that text word for word. More in consent checkboxes that hold up as proof.

Copy<form action="https://forms.formward.eu/f/<FORM_ID>" method="POST">
  <input type="email" name="email" placeholder="Email" required />
  <label>
    <input type="checkbox" name="_consent" required />
    Email me the monthly newsletter. I can unsubscribe at any time.
  </label>
  <input type="text" name="_gotcha" style="display:none" tabindex="-1" autocomplete="off" />
  <button type="submit">Subscribe</button>
</form>

Frequently asked questions

Does using Formward make my forms GDPR compliant?

Not on its own, and no form tool can promise that. Formward handles the processor side: EU storage, a published DPA, consent records, retention, IP pseudonymisation and erasure tools. You are still the controller, so you decide the lawful basis, write the privacy notice, choose retention, accept the DPA and assess any destination you send data to outside the EU.

What makes Formward a GDPR form backend?

Formward is hosted in Sweden, every sub-processor that touches form-submission data is in the EU/EEA (the optional Cloudflare Turnstile challenge, off unless you enable it, is the one US touchpoint on a form), submitter IP addresses are protected with a keyed hash on receipt, consent can be captured with proof on every plan, retention is set per form, and the Data Processing Agreement is published at formward.eu/dpa. Formward acts as your processor under the GDPR; the controller decisions stay with you.

Where is form-submission data stored?

Submissions, account data, file attachments, and backups are stored in Sweden on infrastructure operated by Hostup AB. Notification email goes through Mailjet's EU data centre and AI runs on Mistral AI in France. Data leaves the EU only through routes you choose, such as a notification mailbox hosted abroad, the autoresponder, Google Sheets sync or a webhook. The full map, including Cloudflare Turnstile and billing, is at formward.eu/eu-data-residency.

How are submitter IP addresses handled?

Submitter IP addresses are protected with a keyed hash (HMAC-SHA-256 using a secret server-side salt) immediately on receipt. Raw IP values are never written to disk, and the stored value cannot be linked back to an IP without the secret salt. They are used for abuse protection, not tracking.

Do you act as a controller or a processor?

Formward acts as a processor on your behalf for form-submission data. You remain the controller. Our Data Processing Agreement is published at formward.eu/dpa and, once signed in, you can accept it in your dashboard - we record the version and the time of acceptance. Questions about it go to privacy@formward.eu, and our Article 30 record of processing is published in the compliance pack.

Can the people who fill in my forms exercise their GDPR rights?

Yes. You can view, export and delete submissions in the dashboard, and from the Personal plan the DSAR console searches every form for a person's email address, exports what it finds as JSON and erases it with a certificate. Pseudonymised IP values share the lifetime of the submission they belong to unless you choose to remove them after 24 hours.

Do you hold a SOC 2 or ISO 27001 certification?

Not currently. We do not claim certifications we do not hold. Our security and data-protection posture is documented openly across our Security, Privacy, and compliance pages, and a formal SOC 2 programme is on the roadmap.