Jotform
Forms surveys · jotform.com · last read 2026-10-12
Identity
| Legal entity | Jotform Ltd |
|---|---|
| HQ | GB |
| Parent company | — |
| Ultimate ownership | GB |
| EU contracting entity | — |
| LEI | 98450089A60DEAB3C109 |
| US CLOUD Act reach | No US company in the ownership chain on record |
| Source | jotform.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | jotform.com | 2026-10-08 |
EU: Customers can store data in the EU by turning on an option in the Data tab of their account settings, which moves form data to European servers in Frankfurt. The document gives no plan or cost for this option. Separately, it ties geolocalization (hosting almost anywhere in the world) to Jotform Enterprise.
Subprocessor chain
7 third parties · 0 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services | — | Data storage |
| Deepgram | — | AI voice technology |
| ElevenLabs | — | AI voice technology |
| Google LLC / Google Cloud EMEA Limited / Google Australia Pty Ltd / Google Cloud Canada Corporation | — | Data storage, AI (artificial intelligence), Google Workspace, Google Analytics |
| Hubspot | — | CRM |
| OpenAI | — | AI (artificial intelligence) |
| Twilio | — | AI-based customer engagement |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
No data processing agreement read yet.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| California Consumer Privacy Act (CCPA) · CCPA | Claimed | — | jotform.com | 2026-10-08 |
| General Data Protection Regulation · GDPR | Claimed | — | jotform.com | 2026-10-08 |
| General Data Protection Regulation (GDPR) · GDPR | Claimed | — | jotform.com | 2026-10-08 |
| StateRAMP · GovRAMP | Claimed | Jotform is currently in the security snapshot Program of StateRAMP | jotform.com | 2026-10-08 |
| HECVAT | Claimed | our Enterprise product | jotform.com | 2026-10-08 |
| HIPAA | Claimed | HIPAA features / forms that enable HIPAA compliance; Business Associate Agreement (BAA) available upon request | jotform.com | 2026-10-08 |
| FERPA | Claimed | forms, apps, and other products | jotform.com | 2026-10-08 |
| NIST Special Publication 800-53 Revision 5 | Claimed | Jotform Government | jotform.com | 2026-10-08 |
| Payment Credit Industry Data Security Standard (PCI DSS) · PCIDSS | Claimed | Service Provider Level I | jotform.com | 2026-10-08 |
| PCI · PCIDSS | Claimed | Quarterly internal and external Approved Scanning Vendor (ASV) tests for PCI; PCI scans of publicly available interfaces | jotform.com | 2026-10-08 |
| PCI · PCIDSS | Claimed | intrusion detection policies, as defined by PCI requirements; internal and external PCI scans | jotform.com | 2026-10-08 |
| PCI DSS Service Provider Level 1 · PCIDSS | Claimed | — | jotform.com | 2026-10-08 |
| SOC 2 · SOC2 | Claimed | Jotform’s dedicated environment; Enterprise customers can upgrade to Jotform’s dedicated SOC 2 certified environment | jotform.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Jotform Inc. | Active | HR data, non-HR data | 2027-06-03 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Jotform Inc. | Active | non-HR data | 2027-06-03 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Jotform Inc. | Active | HR data, non-HR data | 2027-06-03 | 2026-10-09 |
| Global LEI Index (GLEIF) | JOTFORM LTD · JOTFORM LTD | ISSUED | GB | 2027-08-03 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Jotform; Jotform Ltd
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Jotform; Jotform Ltd
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Jotform; Jotform Ltd
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Jotform; Jotform Ltd
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Jotform; Jotform Ltd
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Jotform; Jotform Ltd
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: jotform.com (security.txt, expires 2027-01-01; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.