Resource
European form backends: where each one keeps your data
A form backend receives every answer people type into your forms, so where it stores them decides whether you have an international transfer to document. This list puts each provider's own statement next to its source, with the date we last checked it.
Four things are often mixed up: where a company is registered, its domain name, where it processes data and where it stores data. Only the last two decide where submissions live, and a US-owned provider can store data in Europe while a European company can use servers elsewhere.
Formward is in this list and is our own product, so this is not an independent review. We describe every provider, Formward included, with the same questions, and link the sources so you can check each line.
Basin
- Where it says it hosts data
- DigitalOcean, Canada
- Free plan
- Not in our summary: see the full comparison
Basin's GDPR page names DigitalOcean in Canada for hosting and the managed database, Hetzner in Germany for encrypted backups, and US providers for file storage, transactional email, DNS and firewall, payments, bot checks and AI. Canada has an EU adequacy decision; the US providers mean transfers you would need to document.
Checked 2026-10-27Formward vs BasinBasin GDPRBasin privacy policyBasin home pageBasin pricing
EmailJS
- Where it says it hosts data
- AWS, USA
- Free plan
- 200 requests a month, 2 templates
EmailJS states that its servers are in the USA and run on Amazon Web Services, and it relies on the EU Standard Contractual Clauses in its DPA. The email it sends goes to whatever mailbox your template targets.
Checked 2026-10-27Formward vs EmailJSEmailJS pricingEmailJS privacy policyEmailJS data protection agreementEmailJS SDK installationEmailJS sendForm
Formcarry
- Where it says it hosts data
- European Economic Area
- Free plan
- Not in our summary: see the full comparison
Formcarry says all its data is stored in the EEA. Its operator is a US company, and its listed sub-processors include providers headquartered in the US. Whether that matters depends on how your organisation weighs a US parent when the servers are in Europe.
Checked 2026-10-27Formward vs FormcarryFormcarry home pageFormcarry privacy policyFormcarry pricing
FormKeep
- Where it says it hosts data
- Not stated in its privacy policy, terms or DPA
- Free plan
- 50 submissions a month, kept one month
FormKeep's privacy policy says it relies on third-party vendors and hosting partners for hardware, storage and networking, without naming them or saying where they are. Its DPA refers to sub-processors but does not list them, and none of the three documents mentions Standard Contractual Clauses or another transfer mechanism. With a US operator and no stated location, an EU controller would need those answers from FormKeep before documenting the transfer.
Checked 2026-10-27Formward vs FormKeepFormKeep home pageFormKeep pricingFormKeep privacy policyFormKeep terms of serviceFormKeep data processing addendumFormKeep help: changing the redirect URLFormKeep help: exporting form data
Formspark
- Where it says it hosts data
- AWS, Ireland
- Free plan
- 250 submissions, 10 forms
Formspark keeps everything it holds in the EEA, in Ireland and Germany, and its sub-processor list names AWS Ireland for hosting. Two vendors used for every customer are US companies (Sentry for error reporting, Mapbox for maps), and some optional add-ons are too. If AWS is acceptable to you, Formspark answers the residency question well.
Checked 2026-10-27Formward vs FormsparkFormspark pricingFormspark GDPRFormspark sub-processorsFormspark docs: setupFormspark docs: redirectionFormspark docs: notification emailFormspark docs: spam protectionFormspark docs: file uploads
Formspree
- Where it says it hosts data
- AWS, United States
- Free plan
- 50 submissions a month
Formspree says its services are hosted with Amazon Web Services in the United States and that it relies on Standard Contractual Clauses as a data processor. That is a lawful route, but it leaves you, as the controller, with a third-country transfer to document for every submission, and with the US surveillance-law questions raised by the Schrems II ruling.
Checked 2026-10-27Formward vs FormspreeFormspree plansFormspree securityFormspree terms of serviceFormspree help: email subject lineFormspree help: honeypot spam filteringFormspree help: Cloudflare TurnstileFormspree help: hCaptchaFormspree help: custom reCAPTCHA keyFormspree help: thank-you redirect
FormSubmit
- Where it says it hosts data
- Not in our summary: see the full comparison
- Free plan
- Not in our summary: see the full comparison
We could not find a hosting location, a DPA or a GDPR statement on FormSubmit's site. Its default reCAPTCHA also loads Google's script on your page before anyone submits.
Checked 2026-10-27Formward vs FormSubmitFormSubmit documentationFormSubmit home page
Formward
- Where it says it hosts data
- Hostup AB, Sweden
- Free plan
- 50 submissions a month, kept 30 days
Formward stores and processes form submissions in the EU: the application and database run at Hostup AB in Sweden, notification email goes out through Mailjet in the EU, and AI features on Professional and Business use Mistral AI in France. One optional sub-processor is outside the EU: Cloudflare Turnstile (US), which only sees the anti-bot challenge and only on forms where you enable it. Data leaves the EU when you send it there yourself, for example to a notification mailbox hosted by a US provider, a Google Sheets sync or a webhook URL.
Getform
- Where it says it hosts data
- AWS EU regions
- Free plan
- 100 submissions a month, 1 form, 100 MB
Forminit says its application and data servers are in the EU regions of AWS, and the operator is a UK company. The UK has an EU adequacy decision; AWS is a US-owned provider, which some DPOs weigh separately from server location.
Checked 2026-10-27Formward vs GetformForminit: Getform is now ForminitForminit pricingForminit privacy policyForminit submit form APIForminit honeypot
Netlify Forms
- Where it says it hosts data
- Not in our summary: see the full comparison
- Free plan
- Not in our summary: see the full comparison
Netlify, Inc. is based in San Francisco, and its privacy policy says data may be stored outside the country where it was collected. We did not find an EU-only storage option for form submissions on Netlify's site. It does publish a DPA with Standard Contractual Clauses. Netlify also states certification under the EU-U.S. Data Privacy Framework.
Checked 2026-10-27Formward vs Netlify FormsNetlify Forms setupNetlify Forms usage and billingNetlify Forms spam filtersNetlify Forms notificationsNetlify privacy policyNetlify DPA (PDF)
Web3Forms
- Where it says it hosts data
- Not in our summary: see the full comparison
- Free plan
- Not in our summary: see the full comparison
Web3Forms states that its servers are in the US-East region and that it is not based in Europe. Every submission you send through it is therefore a transfer to document.
Checked 2026-10-27Formward vs Web3FormsWeb3Forms FAQWeb3Forms documentationWeb3Forms pricing
How to check a provider yourself
- Read its sub-processor list. Hosting, email delivery, file storage, anti-bot checks and AI are often different companies in different countries.
- Read its data processing agreement, and see which transfer mechanism it names for anything outside the EU/EEA (an adequacy decision, the EU-US Data Privacy Framework or Standard Contractual Clauses).
- Ask where submissions, uploaded files and backups are stored, and whether notification emails leave the EU.
- Check the free plan's retention: some plans delete submissions after a fixed period, which matters for your own records.
How this list is made
Each entry comes from the provider's own public pages (privacy policy, DPA, sub-processor list, pricing), linked under the entry. We check them by hand and write the date next to each provider. When a fact could not be found, the entry says so instead of guessing. If you spot something out of date, write to support@formward.eu and we will check it again.
Related
- Choosing a form service
Seven questions to ask before a provider receives your submissions.
- Using a US form provider
What Schrems II and the Data Privacy Framework mean for form data.
- GDPR form checker
See which services your own form sends data to.
- All comparisons
Feature, pricing and migration detail per provider.