Self-hosted Typeform alternative for EU data residency

Why a self-hosted Typeform alternative for EU data residency needs an EU-only instance

Typeform lists a choice of US or EU data center only on its Enterprise plan, so a team that must keep responses and uploaded files in the EU cannot get that option from the lower tiers on the pricing page. A self-hosted Formbricks or LimeSurvey instance deployed in an EU data center can meet the residency goal without that tier. Whether it is enough depends on whether the team also needs Enterprise features such as SSO, which the Formbricks license documentation places behind an Enterprise license key. Confirm that requirement before choosing a platform. The residency question is also a transfer question. Under GDPR Article 44, every transfer of personal data to a third country, including onward transfers, must meet the conditions in Chapter V. The EDPB's Guidelines 05/2021 treat storage in a cloud outside the EEA as a transfer, and they also treat remote access from a third country as one, even when the data is only displayed on a screen for support. A team hosting on an EU server still needs to check who administers it, from where, and whether a vendor's support staff or backup copies sit outside the EEA.

The EDPB guidelines also address a subtler exposure: using an EU processor that is subject to third-country law with extraterritorial effect is not itself a transfer, but complying with a third-country authority request would be. The US CLOUD Act provision at 18 U.S.C. 2713 applies to providers regardless of where data is located, so a provider with US ownership or control may be affected even when the servers are in Frankfurt or Helsinki. Ask any hosting provider or SaaS vendor for their government access policy and where their support and backup systems operate. The EU-US Data Privacy Framework adequacy decision is also under appeal (Case C-703/25 P), so treat it as a planning risk rather than settled ground. For a self-hosted instance, the team controls the server, the administrators and the backups, which narrows this exposure, but it does not remove the need for a documented assessment.

Write the residency decision down before migration starts. Record where the Formbricks or LimeSurvey database, file storage and backups will sit, who holds administrator access and from which countries, which mail relay and monitoring tools receive respondent data, and which Enterprise features are required. This record is the evidence a data protection officer will ask for. It also gives the team a fixed list of cloud and vendor dependencies to check, since a single non-EU log or email service can turn an EU-hosted form into a transfer.

What EU data residency requires from a form tool

EU data residency is less about where a server sits and more about who can reach the data and from where. The cards below cover the transfer rules, remote access, storage location, foreign legal exposure and a non-personal data duty that together decide whether a form tool keeps responses in one jurisdiction. This is a technical overview, not legal advice, so confirm each point with counsel.

Every third-country transfer needs Chapter V

Article 44 of the GDPR applies to every transfer of personal data to a third country, including onward transfers. For a form tool, that means a respondent's answers, email address or uploaded file that leaves the EEA at any step needs a valid transfer mechanism. Map each hop the data takes, including backups and email notifications, before you choose a vendor. Infringements of Articles 44 to 49 can carry fines of up to EUR 20 million or 4% of worldwide annual turnover.

Remote access from outside the EEA

EDPB Guidelines 05/2021 treat remote access from a third country as a transfer, even when staff only view data on a screen for support or administration. Ask your vendor where its support engineers sit, whether they can open production databases and which access logs you receive. An on-premises or EU-hosted instance you operate yourself removes most of this question, but only if your own administrators and any contractors are also located inside the EEA or covered by an approved mechanism.

Storage outside the EEA

Storing data in a cloud outside the EEA is also a transfer under the EDPB guidance. This matters for form tools because backups, file attachments and replicas often sit in a different region from the primary database. Hosted offerings let you choose a region, so confirm in writing where responses, uploaded files, logs and backups live and which sub-processors can read them. For a self-hosted instance, record the data center, storage class and backup target as part of your processing register.

US-linked providers and CLOUD Act exposure

The US CLOUD Act provision at 18 U.S.C. 2713 requires providers of electronic communication and remote computing services to preserve or disclose data in their possession, custody or control, wherever that data is stored. A US-parented form vendor can therefore be compelled to produce EU-hosted responses. EDPB Recommendations 01/2020 also state that where a provider must access data in the clear and foreign powers exceed what is necessary and proportionate, no effective technical supplementary measure is expected. Ask counsel whether a US parent or US-based support staff changes your risk assessment.

Data Privacy Framework dependence

The EU-US Data Privacy Framework adequacy decision, Commission Implementing Decision (EU) 2023/1795, covers only US organizations on the Data Privacy Framework List. Its validity is contested: an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. If a vendor relies on this framework, check that it is certified, document a fallback based on standard contractual clauses, and set a review point for the appeal outcome. Keeping data on infrastructure you control reduces this dependence.

Article 48 limits foreign disclosure orders

Under GDPR Article 48, a third-country court judgment or administrative decision requiring disclosure of personal data can be recognized or enforced only when it rests on an international agreement in force with the Union or a Member State, such as a mutual legal assistance treaty. Requests that lack such a basis do not automatically bind an EU controller or processor. Ask your vendor how it handles foreign requests, whether it notifies you and whether it publishes a transparency record. Confirm the interpretation with counsel before relying on it.

Where Typeform meets the requirement and where the plan gate applies

Typeform lists the choice of a US or EU data center only on its Enterprise plan, alongside SSO and HIPAA. The lower tiers, Basic, Plus and Business, are priced by monthly responses and seats, with 100, 1,000 and 10,000 responses per month respectively and 1, 3 and 5 seats. If your requirement is that responses and uploaded files stay in the EU, the practical question is whether your team needs Enterprise pricing to meet it, or whether a self-hosted tool in an EU data center meets it at lower cost. SurveyMonkey follows the same pattern: its Enterprise tier offers a choice of US, Canada or EU data center, while its Team Advantage and Team Premier plans do not. Check both vendors' pricing pages before you assume an EU option exists at your tier.

The facts available here do not establish what Typeform's Enterprise contract commits to regarding storage location, backups, support access or sub-processor locations. Ask Typeform in writing for its current terms, its data processing addendum, the list of sub-processors with their processing locations, and whether remote support access from outside the EU occurs. Ask which data center holds uploaded files specifically, since the pricing page does not address file storage. Also ask whether the EU data center choice applies to a new account only, or whether an existing account can be moved, and what the export process looks like if you later leave.

Use the answers as a decision input. If Typeform's Enterprise terms match your residency and transfer requirements and the price fits your budget, staying on Typeform may be the simpler path. If they do not, or if your team needs only a fraction of Enterprise features, a self-hosted instance in an EU data center gives you direct control over where the data sits. Record the vendor's answers in your processing register so your data protection officer can compare them with your own assessment. Whichever option you choose, confirm the data location in the written terms rather than relying on marketing material.

Which open-source option fits an EU-only deployment

Formbricks suits teams whose main work is link, website, in-app and email surveys, and who want a modern editor and a container-based install. Its core application is licensed under AGPLv3, and the Community Edition can be self-hosted with Docker without a subscription, so the instance can sit in an EU data center you choose.

Community Edition scope: unlimited surveys, responses and users, full API access, file upload, multi-language surveys and webhooks, all within one workspace.
Enterprise key gate: OIDC and SAML SSO, teams and access roles, audit logs, quota management and removing the Powered by Formbricks badge need an Enterprise License Key.
Shipped code: enterprise code is in the Docker images, so confirm which features are active before you rely on them.
Forks: privately kept forks of the core must be released under AGPLv3 unless covered by an Enterprise license.
Version: Formbricks 6.0.2 was published on October 1, 2026, so pin the image tag you test.

Before you commit, confirm with Formbricks whether the Community Edition's single workspace and missing SSO and audit logs fit your access model, and confirm the Enterprise license terms in writing.

Formbricks, LimeSurvey and the Typeform Enterprise plan compared on residency

This table compares where responses and uploaded files sit under each option, which license or plan unlocks the residency and feature set, and what each one asks of your team. Read it by first checking whether your data must stay in the EU, then checking which feature gates matter for your forms. The main takeaway is that EU residency is a plan decision with Typeform, while with the open-source options it becomes a question of where you host and who operates the server.

Option	How it keeps data in the EU	Licence and feature gates	Trade-offs
Typeform Enterprise	Customer chooses an EU data center on the Enterprise plan	Enterprise only, with SSO and HIPAA also on that plan	Residency depends on a paid plan with custom limits; confirm the EU data center terms in writing
Self-hosted Formbricks in an EU data center	Your own EU cloud account or data center holds the database and uploaded files	AGPLv3 core; Community Edition covers unlimited surveys and responses, file upload and webhooks; SSO, roles and badge removal need an Enterprise key	You run hosting, upgrades and backups; Community Edition allows one workspace
Self-hosted LimeSurvey in an EU data center	Your own EU server holds the survey database and response data	GPL v2.0 or later; Community Edition is free to download and self-host	You provide PHP and a supported database server, and manage upgrades such as the move off the 6.17.19 line
Formbricks Cloud (Frankfurt hosting for Hobby)	Hobby plan is hosted in Frankfurt, per the pricing page; confirm hosting location for paid plans	Hobby free with 250 responses per month; Pro and Scale are paid tiers	Provider operates the service; confirm the provider's processing terms and any transfers before use
LimeSurvey Cloud in Germany or Finland	Germany or Finland region recommended for EU customers	Basic, Expert, Business and Corporate tiers, with checkout in euros	Response limits apply per tier; on expiry the account falls back to Free but keeps access to responses

How to deploy Formbricks or LimeSurvey in an EU data center

This sequence takes a team from an empty EU cloud account to a Formbricks or LimeSurvey instance where forms, responses, uploaded files and backups stay in one jurisdiction, with administrative access controlled from approved locations.

Choose an EU cloud account and region
The organization opens or uses its own account with an EU cloud provider or data center operator and selects a region inside the EU or EEA. Your team or your DeployOpen engagement lead records the account owner, the region names and the contract entity in the project file. Confirm with the provider where the control plane, support staff and subprocessors sit, because a region name alone does not settle jurisdiction. The step is done when the account, region and contract are documented and the account owner has approved them.
Confirm operator and backup jurisdiction
Ask the provider in writing where data is stored and processed, where backups are replicated, and which legal entity can receive government requests. Compare the answers with the transfer analysis in your data protection impact assessment, including the US CLOUD Act exposure that applies to US-headquartered providers regardless of server location. Confirm whether the provider offers EU-only backup replication and whether its support access can come from outside the EU. The step is done when the written answers are filed and your data protection lead has signed off on the operator and backup location.
Provision the EU database and file storage
Your infrastructure team creates a managed or self-managed database in the chosen region. For Formbricks, this is PostgreSQL. For LimeSurvey, choose MySQL 8.0, PostgreSQL 14, MariaDB 10.3.38 or MSSQL 2019 or later, as supported by the LimeSurvey release you plan to run. Create an object or file storage bucket in the same region for uploaded files, and restrict access with private credentials. The step is done when a connection test succeeds from the application network and a test file written to storage stays in the EU region.
Deploy Formbricks with Docker or LimeSurvey on PHP
Deploy Formbricks from its Docker images, or install LimeSurvey on a web server with PHP 8.1.29 or later, the mbstring and PDO drivers, and the database from the previous step. Set the public URL to an EU-hosted domain and keep secrets in environment files or a secrets manager, not in the repository. For LimeSurvey, use the Community Edition release currently listed as latest stable, and confirm its requirements in the release notes before installation. The step is done when the admin login works over HTTPS and a test survey can be created and submitted.
Restrict remote administrative access
Limit administrative consoles, SSH, database clients and cloud consoles to named staff connecting from EU locations or from approved, documented locations. Add a rule that vendor or DeployOpen support sessions must be opened only from approved EU locations and recorded, because a support engineer viewing data on a screen from a third country can itself be a transfer under the EDPB guidance. Require multi-factor authentication for every administrative account. The step is done when the access list is written, the rules are tested from an outside network, and the test results are stored with the change record.
Configure EU file uploads and backups
Point the Formbricks file upload settings or the LimeSurvey upload directory at the EU storage bucket, and check that thumbnails, exports and temporary files also land in that location. Schedule database and file backups to a second EU region or a location in the same jurisdiction, encrypt them, and keep the keys within the EU. Run one test restore into a separate EU environment and confirm that responses and uploaded files come back intact. The step is done when a restore test passes and the backup locations are recorded in the processing register.
Decide on the Formbricks Enterprise key
Review the features your teams need. The Formbricks Community Edition covers unlimited surveys, responses and users, but it is limited to one workspace. OIDC and SAML SSO, teams and access roles, audit logs, quota management and removal of the Powered by Formbricks badge need an Enterprise license key from Formbricks. Ask Formbricks for the current Enterprise pricing and terms in writing, and record the decision with its reason. LimeSurvey Community Edition is free to self-host, so this decision does not apply to it. The step is done when the decision is recorded and, if you buy a key, the key is installed and checked in the admin settings.
Plan upgrades and retire unsupported LimeSurvey lines
Set a written upgrade routine for the application, operating system, PHP and database. For LimeSurvey, note that the 6.17.19 line reached end of support on August 31, 2026, so move any instance on that line to a supported release before going live. Subscribe to the release notes for the product you run, test each upgrade in a staging copy in the EU, and keep a rollback point. The step is done when the upgrade calendar, owner and staging process are documented and the production version is confirmed as supported.

Moving responses and files out of Typeform without leaving the EU

The export itself is a data transfer, so plan it as one. Typeform's Responses API returns a form's responses as JSON on each GET request and can filter by submission date, but it may not include submissions from roughly the last 30 minutes. That lag means a cut-over needs a freeze window: stop or redirect the live form, wait longer than the lag, then run a final incremental pull with a date filter that starts just before the freeze. Record the timestamp of the last exported submission and reconcile counts in both systems before you switch the embed or link. The Typeform developer documentation for the Responses API is the reference for the exact parameters, and the sibling guide on exporting data from Typeform walks through the file download endpoints for uploaded files, which the Responses API does not return inline.

Remember that the export moves personal data out of Typeform's systems, so the machine that runs the export is part of your transfer assessment. Run the scripts and hold the JSON and downloaded files on hardware inside your EU environment, such as a VM in an EU region or an on-premises host in an EU data center, and never on a laptop that syncs to a non-EU cloud. Limit the access token to the forms you are moving, store it in a secrets manager, and confirm with your data protection officer where any intermediate staging bucket or CI runner sits. Once the import into Formbricks or LimeSurvey is verified, delete temporary copies, rotate the token and record the deletion in your processing records. The sibling migration guides cover rebuilding forms in Formbricks and in LimeSurvey, which should start only after this copy is confirmed.

Evidence that the data stays in one jurisdiction

A residency claim is only as strong as the records behind it. The cards below list the evidence a regulated team should assemble to show where forms, responses and uploaded files live, who can reach them and what happens when a provider sits outside the EU. Auditors and regulators decide whether that evidence shows adequate protection; DeployOpen prepares the evidence but does not issue attestations.

Data location map

Record every store that holds form definitions, responses, uploaded files, logs and exports, and the city or data center that hosts each one. For a self-hosted Formbricks or LimeSurvey instance, that usually means the application server, the PostgreSQL or MySQL database, the file upload volume, backups and any mail relay. Confirm that each store sits in the EU data center you chose and that no component quietly reaches out to a third-country service, such as an external analytics script or a hosted email provider. Keep the map current each time a component changes.

Provider and sub-processor list

List every company that can access the data, including the cloud or hosting provider, any managed database or backup service, and the support partner. For each one, record the legal entity, the country of the controlling company and the country where it stores or accesses data. Typeform's own EU data center choice sits on its Enterprise plan, so compare that position with your own provider list instead of assuming the same jurisdiction applies. Ask each provider for its current sub-processor list and the date you received it.

Admin session origin logs

Keep logs that show where administrator sessions originate, including the IP address, country and time of each login to the survey application, the database host and the hosting console. Remote access from a third country counts as a transfer even when someone only views data on screen for support, so these logs show whether that happened. Review them on a fixed schedule and document who approved any out-of-region access. Confirm that your identity provider and VPN logs can be exported in a form an auditor can read.

Transfer assessment record

For any provider established outside the EU, or any provider subject to third-country law, keep a written transfer assessment. It should state the transfer tool relied on, the data involved and the legal exposure to government access requests. The EU-US Data Privacy Framework applies only to US organizations on the Data Privacy List, and its General Court challenge is still under appeal, so do not rely on it without rechecking. Ask your legal counsel to confirm the position before you sign.

Backup location records

Backups copy personal data, so they count as a storage location in their own right. Record where each backup is written, which provider holds the encryption keys, how long copies are retained and where any off-site replica is stored. Test a restore in the same jurisdiction to confirm the copy does not depend on a service outside the EU. Keep the backup schedule and restore test results as evidence, because a backup that leaves the EU without a record is the gap regulators most often ask about.

Enterprise license and subscription records

If you run Formbricks Enterprise features such as SSO, access roles or audit logs, keep the license key invoice, the license scope and the renewal date with the rest of the evidence. Formbricks Community Edition needs no subscription to run, but the Enterprise code ships in the Docker images and is unlocked by a key, so the record shows which features were active during any audit period. For LimeSurvey Cloud, record the hosting region chosen and the plan, because the account falls back to the Free package when a subscription expires.

Questions buyers ask before choosing an EU-only form tool

Can we keep Typeform and just pay for the Enterprise plan?

Yes, Typeform lists a choice of US or EU data center on its Enterprise plan, alongside SSO and HIPAA, with custom limits set by quote. That option keeps the data in a vendor-operated service, so you still depend on the vendor's contracts, sub-processors and any foreign-law exposure of the provider. Ask Typeform in writing which data center hosts your workspace, where backups and support access originate, which sub-processors touch responses and uploaded files, and how the Responses API is covered. Compare that answer with a self-hosted instance where you control the infrastructure directly.

What does self-hosting cost compared with per-response and per-seat plans?

Typeform's plans are priced by monthly responses and seats, with Basic at 100 responses per month and 1 seat, Plus at 1,000 and 3 seats, and Business at 10,000 and 5 seats, according to its pricing page. Self-hosted Formbricks Community Edition and LimeSurvey Community Edition have no license fee for responses or users. Your recurring costs are then hosting, storage, backups, patching, and staff or retainer time. One-time costs include setup and form rebuilding. The main cost drivers are the number of instances, whether you need a Formbricks Enterprise license, and how many forms you must rebuild. Ask any quote to split one-time and recurring fees.

What drives cost up when we self-host a form tool?

Four components move the total most. Hosting in an EU data center is a recurring infrastructure line that scales with traffic and redundancy. A Formbricks Enterprise license is needed for OIDC and SAML SSO, teams and access roles, audit logs and removing the Powered by Formbricks badge, so it adds a recurring fee only if those features matter to you. Administration covers upgrades, database maintenance and monitoring, which is ongoing effort. Rebuilding forms, logic and hidden fields is usually a one-time project whose size depends on how many forms you run. Ask for each component as a separate line item.

How long does a migration take, and what does it need from our team?

Duration depends on the number of forms, the logic in each one, the volume of historical responses and uploaded files, and how many integrations must be rewired. Your team needs to name a form owner for each survey, provide access to the Typeform account for export, agree a cut-over date, and approve the rebuilt forms before publishing. The Typeform Responses API returns responses as JSON, filters by submission date and may not include submissions from roughly the last 30 minutes, so the cut-over plan must account for that lag. Ask any proposal for a written timeline based on your inventory of forms.

Can our own staff run a self-hosted form platform?

Often yes, if you have someone comfortable with Docker or a PHP and database stack and a process for backups and updates. Formbricks can be self-hosted with Docker without a subscription, and LimeSurvey requires PHP 8.1.29 or later with mbstring and PDO drivers plus a supported database such as PostgreSQL 14 or MariaDB 10.3.38. Staff must also handle security patches, certificates, access reviews and restore tests. Before deciding, check whether your team can commit that recurring time, and ask a provider to scope what they would take over and what remains with you.

Does the EU Data Act switching right apply to us?

The Data Act, applicable since 12 September 2025, gives customers of data processing services the right to switch to another provider or to on-premises ICT infrastructure, with a maximum two-month notice period and a 30-day transition. It also bans switching charges from 12 January 2027, as set out in Articles 25, 29 and 50 of Regulation (EU) 2023/2854. Whether a specific form subscription falls under those articles depends on how the contract is structured, so ask your legal team to review the Typeform contract against the regulation. Keep an export of your responses and files regardless, since that makes any future switch much simpler.

Does self-hosting remove all our GDPR obligations?

No. Self-hosting keeps the data in your infrastructure, but you remain the controller for responses that contain personal data and still need a lawful basis, retention rules, data subject request handling, records of processing and security measures. Storage in a cloud outside the EEA, or remote access from a third country even only to display data, can still count as a transfer under the EDPB Guidelines 05/2021. If you use a hosting provider or an EU data center operated by a company subject to third-country law, assess that exposure before signing. Involve your data protection officer early.

How DeployOpen deploys an EU-only form platform

DeployOpen plans, implements and hardens self-hosted Formbricks or LimeSurvey inside your own EU cloud account or data center, so forms, responses and uploaded files stay in one jurisdiction. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.

How we scope

Inventory every Typeform form, logic branch, hidden field, webhook and embed that must be rebuilt.
Confirm which EU data center or region your infrastructure and providers must use.
Decide Formbricks or LimeSurvey per form type, and whether any Enterprise license is needed.

How we build

Deploy the chosen platform in your EU environment, with database, backups and file storage kept in the same region.
Configure SSO, access roles, file upload storage and webhooks according to the agreed scope.
Test submissions, file uploads, integrations and export paths before any form goes live.

How we hand over

Document the architecture, data flows, data locations, configuration and administrator procedures.
Provide a cut-over plan and a verified export of historical Typeform responses and files.
Deliver evidence of data residency settings to support your own compliance assessments.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Patch and upgrade the platform on a schedule agreed in your written scope.
Confirm with your legal counsel and auditors how the residency setup fits your obligations.