Sub-processors
Last updated October 22, 2026
These companies process your respondents' data when FormzoAI runs your forms. Each is bound by a data processing contract. Under our Data Processing Agreement, we email workspace owners at least 30 days before adding or replacing one.
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| VercelVercel Inc., USA | Hosting the app (Frankfurt), storing uploaded files in the workspace's region, and cookieless page-view statistics on our website | Everything passing through the app, uploaded files | Germany (EU); files of US workspaces in the United States | EU–US Data Privacy Framework, standard contractual clauses |
| NeonNeon Inc. (Databricks), USA | Databases: accounts and EU workspaces in Frankfurt, US workspaces in Ohio | Accounts, forms, responses, conversations | Germany (EU); US workspaces in the United States | Standard contractual clauses (Neon DPA) |
| NebiusNebius B.V., Netherlands | AI models that run the chat, summaries, scores and reading uploaded CVs. Prompts and replies aren't kept after each request and are never used for training | Answers and conversation text, CV text | United States, with a backup model in Finland (EU) | EU company; standard contractual clauses for the US data centre |
| ResendResend Inc., USA | Sending emails: sign-in links, continue-later links, codes, response alerts | Email addresses, email content (e.g. an AI summary in a response alert) | United States | EU–US Data Privacy Framework, standard contractual clauses |
| CloudflareCloudflare Inc., USA | Turnstile bot protection on forms, sign-up and the homepage | IP address, browser signals | Global network | EU–US Data Privacy Framework, standard contractual clauses |
| UpstashUpstash Inc., USA | Rate-limit counters | Keyed one-way hashes of IP addresses, no plain personal data | United States | EU–US Data Privacy Framework, standard contractual clauses |
Providers for our own data only
These see organizer accounts and billing, or data an organizer chooses to send them, not respondent data on our behalf.
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| StripeStripe Payments Europe Ltd., Ireland | Payments and billing for organizers | Organizer billing details (we never see full card numbers) | EU and United States | EU–US Data Privacy Framework, standard contractual clauses |
| GoogleGoogle LLC, USA / Google Ireland Ltd. | Sign-in with Google, and Google Sheets when an organizer connects it | Name, email, profile picture; responses the organizer sends to their own sheet | United States | EU–US Data Privacy Framework |
Questions: [email protected]