Typeform
forms-surveys · typeform.com · last read 2026-10-07
Identity
No identity observation recorded yet.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Enterprise only | Growth Custom or Enterprise | help.typeform.com | 2026-10-05 |
EU: Main servers are in Virginia, USA; EU servers apply only to Enterprise and Growth Custom customers with the EU data hosting feature. The document gives no price and does not rank the two plans.
Subprocessor chain
27 third parties · 3 of the vendor's own group companies · 22 with a country outside the EEA · all read 2026-10-05
| Subprocessor | Country | If hosted in the EU | Purpose |
|---|---|---|---|
| Alloy | US | — | In the case that you use Integrations, to support system interoperability. |
| Amazon Web Services Inc. ( dba AWS) | US, EU | EU | In the case that you use Optional Features, AI services for form building and analysis |
| Amazon Web Services Inc. ( dba AWS) | US, EU | EU | Storage and data management; in the case that you use Optional Features, AI services aimed at form building and results analysis. |
| Amazon Web Services Inc. (dba AWS) | US, EU | EU | Storage, data management |
| APIHub Inc. (dba Clearbit) | US | — | Target marketing campaigns at relevant audience and profiling |
| Arize AI, Inc. | EU | — | In the case that you use Optional Features, to provide AI observability, monitoring and security services. |
| Forge Technology, Inc. (Paragon) | EU | — | In the case that you use Integrations, to support system interoperability and enable integrations between Typeform and customer-selected third-party applications. |
| FullContact Inc. | US | — | In the case that you use response enrichment to obtain additional demographic and professional data. |
| Gainsight, Inc. (formerly known as InSided) | EU | — | To support account creation and user interaction in our community |
| Google (Gmail) | EU | — | In the case that you contact Customer Support, to resolve queries or security concerns of the platform or about the responses received. |
| Google Cloud Platform | US | — | To support AI-enabled functionality across our products and services, such as screen observation, note-taking and post-session insights in Research Flow. |
| Liveblocks, Inc. | US | — | To support the commenting experience and real time interaction in our platform |
| LiveKit Incorporated | US | — | In the case that you use Research Flow, to support real-time voice and video processing. |
| Mailgun Technologies, Inc. | EU | — | In the case you use our feature to send emails through the platform containing respondent data. |
| Mux, Inc. | US | — | In the case you use our feature to process video questions and video answers. |
| Okta, Inc. | US, EU | — | Create a single sign-on system for login and authentication on the Typeform platform (also supports MFA) |
| OpenAI Ireland Ltd | US | — | In the case that you use Optional Features, AI services aimed at form building and results analysis. |
| Pinecone Systems, Inc. | US | — | In the case that you use Optional Features, AI services aimed at form building and results analysis. |
| PowerPlay GmbH (dba as Cello.so) | EU | — | In the case that you use our referral services, to identify and process the referral |
| Salesforce Systems Spain, S.L (Slack) | EU | — | Customer Services: support service for communication of all Typeform customer enquiries and requests |
| ScaleStack | US | — | In the case that you use data enrichment to obtain additional demographic and professional data. |
| Snowflake Computing Netherlands B.V. (dba. Snowflake) | US | — | Used as our data warehouse and for data processing. |
| Twilio Ireland Limited | US | — | In the case that you use the Send Text (SMS) (an Optional Feature), supporting SMS communications. |
| Zapier, Inc. | US | — | In the case that you use workflows, to support setting up workflows and facilitate user authentication to Zapier. |
| Zendesk Inc. | US | — | Customer Services: Provide a support service for the reception, assessment, or dispatch of all Typeform customer enquiries and requests |
| Zendesk, Inc. | US | — | In the case that you contact Customer Support, to resolve queries or security concerns of the platform or about the responses received. |
| ZOOMINFO TECHNOLOGIES LLC | US | — | In the case that you use response enrichment to obtain additional demographic and professional data. |
Typeform's own group companies listed as subprocessors (3)
| Company | Country | Purpose |
|---|---|---|
| TYPEFORM DE GmbH | EU | Customer Services: support service for the reception, assessment, or dispatch of all Typeform customer enquiries and requests |
| TYPEFORM UK Ltd | GB | Customer Services: support service for the reception, assessment, or dispatch of all Typeform customer enquiries and requests |
| TYPEFORM US LLC | US | Customer Services: support service for the reception, assessment, or dispatch of all Typeform customer enquiries and requests |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | — | trust.typeform.com | 2026-10-05 |
| CSA STAR Level 1 · CSA | Claimed | — | trust.typeform.com | 2026-10-05 |
| GDPR | Claimed | — | trust.typeform.com | 2026-10-05 |
| HECVAT | Available on request | — | trust.typeform.com | 2026-10-05 |
| HIPAA | Claimed | — | trust.typeform.com | 2026-10-05 |
| HIPAA | Claimed | compliance report | trust.typeform.com | 2026-10-05 |
| ISO 27001:2022 · ISO27001 | Available on request | — | trust.typeform.com | 2026-10-05 |
| ISO/IEC 27001 · ISO27001 | Claimed | scheduled surveillance audit | trust.typeform.com | 2026-10-05 |
| 27017 · ISO27017 | Claimed | ISO/IEC 27017; scheduled surveillance audit | trust.typeform.com | 2026-10-05 |
| ISO 27017:2015 · ISO27017 | Claimed | — | trust.typeform.com | 2026-10-05 |
| 27018 · ISO27018 | Claimed | ISO/IEC 27018; scheduled surveillance audit | trust.typeform.com | 2026-10-05 |
| ISO 27018:2019 · ISO27018 | Claimed | — | trust.typeform.com | 2026-10-05 |
| ISO/IEC 42001:2023 · ISO42001 | Available on request | — | trust.typeform.com | 2026-10-05 |
| PCI DSS 4.0.1 Merchant · PCIDSS | Claimed | — | trust.typeform.com | 2026-10-05 |
| PCI DSS 4.0.1 Service Provider · PCIDSS | Claimed | — | trust.typeform.com | 2026-10-05 |
| SOC 2 Type II · SOC2T2 | Available on request | — | trust.typeform.com | 2026-10-05 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
- ACN qualified cloud (Italy): checked 2026-10-07, no entry under Typeform
- Data Privacy Framework List (US): checked 2026-10-07, no entry under Typeform
- FedRAMP Marketplace (US): checked 2026-10-07, no entry under Typeform
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-05 |
| residency | Public | full | 200 | 2026-10-05 |
| subprocessors | Public | full | 200 | 2026-10-05 |
History
Nothing has moved since we started watching this vendor on 2026-10-05. Changes appear here only after a human has reviewed them.