Does Typeform offer EU data residency?
Typeform SL · Forms & Surveys · official site ↗
No EU data residencyRelies on SCCsDPA on request
Where does Typeform store EU data — and who can touch it?
Typeform does not offer EU data residency — data is hosted outside the EEA, and relies on Standard Contractual Clauses for transfers.
Despite being Spain-headquartered, Typeform's own DPA places hosting on Amazon Web Services in the United States under Standard Contractual Clauses, with no documented EU-only residency option and no Data Privacy Framework certification.
EU data residency
Can you keep data in the EU?
Typeform SL is based in Spain, but its DPA names Amazon Web Services (US) as the hosting sub-processor and describes US processing governed by SCCs. The DPA does not document an EU-only data-at-rest residency option, so EU headquarters does not equal EU hosting here.
Transfer mechanism
Typeform's DPA relies on the Standard Contractual Clauses for the EU-to-US transfer to AWS; no EU-US Data Privacy Framework self-certification was found on a Typeform-owned page, so SCCs are the documented transfer basis.
Sub-processors
Who else processes your data?
Typeform's current sub-processor list is delivered via a subscription form (referenced in the DPA) rather than an openly browsable table — you subscribe to receive the list and change notices. The DPA gives a non-extendable 15-calendar-day window to object to a new sub-processor. current sub-processor list ↗
Data Processing Agreement (DPA)
Does Typeform sign a DPA?
Typeform publishes its DPA as a schedule to its Master Agreement; it is incorporated into the customer agreement rather than offered as a standalone self-serve click-to-sign for every tier. Confirm execution for your plan with Typeform. DPA ↗
What the trust-badge pages don't tell you
The headline trap: an EU-headquartered vendor is not automatically EU-hosted. Typeform's own DPA points hosting at US AWS under SCCs, and the sub-processor list is gated behind a signup form rather than published openly.
$249/moto monitor up to 25 vendors' DPA & residency
≈ $3,000/yr, incl. cited bulk export
≈ $3,000/yr, incl. cited bulk export
Monitor your whole vendor list for DPA & residency changes
The free lookup answers one vendor at a time. Teams running EU vendor intake track dozens and need to know the moment a sub-processor, residency region or DPA term changes. Leave your work email and we'll set up monitoring + a cited export for your list.
Get notified when this changes
Compliance isn't one-and-done. Leave your email and we'll alert you when any vendor's BAA or HIPAA status we cover changes.
Frequently asked questions
Does Typeform offer EU data residency?
No. Typeform SL is based in Spain, but its DPA names Amazon Web Services (US) as the hosting sub-processor and describes US processing governed by SCCs. The DPA does not document an EU-only data-at-rest residency option, so EU headquarters does not equal EU hosting here.
Where does Typeform send my data, and does it rely on SCCs?
Typeform's DPA relies on the Standard Contractual Clauses for the EU-to-US transfer to AWS; no EU-US Data Privacy Framework self-certification was found on a Typeform-owned page, so SCCs are the documented transfer basis.
Who are Typeform's sub-processors?
Typeform's current sub-processor list is delivered via a subscription form (referenced in the DPA) rather than an openly browsable table — you subscribe to receive the list and change notices. The DPA gives a non-extendable 15-calendar-day window to object to a new sub-processor. See the current list at https://www.typeform.com/dpa.
Does Typeform sign a GDPR Data Processing Agreement (DPA)?
On request — Typeform publishes its DPA as a schedule to its Master Agreement; it is incorporated into the customer agreement rather than offered as a standalone self-serve click-to-sign for every tier. Confirm execution for your plan with Typeform.
Is Typeform GDPR compliant?
Typeform can be used in a GDPR-compliant way, but compliance depends on your configuration, not just the vendor: Despite being Spain-headquartered, Typeform's own DPA places hosting on Amazon Web Services in the United States under Standard Contractual Clauses, with no documented EU-only residency option and no Data Privacy Framework certification. You are the controller — confirm the current DPA, residency and sub-processor terms with Typeform SL and run a transfer impact assessment before processing EU personal data. This is not legal advice.
Sources
https://www.typeform.com/dpa
https://www.typeform.com/help/a/security-at-typeform-360029259552/
This page is cited public information, not legal or compliance advice. Whether Typeform can lawfully process your EU personal data depends on your plan, configured region, contract and a transfer impact assessment you control. Always confirm current terms with Typeform SL before sending EU personal data.