Why self-hosted in-app surveys matter for SaaS teams
A SaaS product or growth lead who wants NPS, onboarding and churn feedback shown inside the app needs more than a survey form. The responses only become useful when they are linked to tenant, user and billing context, so a score can be read against plan tier, seat count, lifecycle stage and the feature the user just touched. That linkage is what separates an in-app survey from a marketing survey sent by email. The survey also runs inside your product's own origin through an SDK, which means the script, the user identifiers and the answers all pass through your infrastructure and your content security policy. Self-hosting keeps that data path under your control, and it lets the platform team decide where the survey code is served from and who can see the results.
Formbricks is the open-source option in this group for this job. The self-hosted Community Edition covers the core functions most teams start with: website, app, link and email-embedded surveys, advanced logic, multi-language surveys, webhooks and full API access, with unlimited surveys, responses and users. The limit that matters for planning is that Community Edition is restricted to one workspace. The Enterprise license is needed for OIDC and SAML single sign-on, teams and access roles, contact management and segments, audit logs and removing the Powered by Formbricks badge. Confirm with the vendor which of these your targeting rules depend on, because a churn survey limited to a segment of paying accounts will usually need segments and roles from day one.
Before you commit to an edition, map each feedback flow to the identity and targeting features it needs, then check whether your team can run the Docker or Helm deployment, back up the database and keep the SDK version in step with the app. Ask your implementation partner to write the scope for SSO, segment definitions, the webhook path into your product analytics or CRM, and the retention rules for account-linked answers. Those decisions drive the license choice and the support model far more than the number of surveys you plan to run.
Which requirements shape a self-hosted product survey build
This table maps each requirement that touches in-app survey data to its source and to the build decision it changes. Read each row as a question to answer before placing the SDK, mapping identities or setting retention. The main takeaway is that user-linked feedback brings SaaS trust, processor and licensing obligations into the survey design from the start.
| Requirement | What it changes in the build | Evidence an assessor or customer will expect |
|---|---|---|
| SOC 2 security and confidentiality criteria | Customer-linked feedback is treated as in scope for access control, encryption and logging. Survey SDK placement should not expose responses or user attributes beyond what the workspace needs. | Documented access reviews for the Formbricks instance, encryption settings, and a system description that names the survey data flow |
| GDPR Article 28(3) processor terms | When responses are tied to accounts, the hosting party or any managed operator acts as a processor. Processing must follow documented instructions, including for transfers, so the contract should define what the operator may do with response data. | Signed processor agreement covering instructions, sub-processors and transfer terms, plus a record of who can export responses |
| GDPR Article 32 security of processing | Drives encryption in transit and at rest, pseudonymous user IDs in hidden fields or attributes, least-privilege roles for NPS and churn data, and tested backups of the survey database. | Risk assessment for the survey pipeline, configuration baseline, and restore test results for the database holding responses |
| EU Data Act switching rights | If a self-hosted instance is later run by a provider, customers need a path to move responses and configuration to another provider or on-premises infrastructure. Export formats and the data schema should be documented from day one. | Written export procedure, tested data export, and contract terms that describe switching notice and transitional support |
| Formbricks AGPLv3 core license | Modifying the core and running it as a network service can trigger source disclosure of those changes. Custom SDK wrappers or internal forks must be planned under AGPLv3 terms. | Inventory of code changes, a license review of any fork, and confirmation of which components are core versus enterprise |
| Formbricks Enterprise license (OIDC, SAML, segments, audit logs) | Single sign-on for internal users, targeting by contact segments, and audit logs for who viewed or exported responses all require the Enterprise License Key. Without it, identity mapping and segment-based triggers must be handled outside the tool or not at all. | Current license key record, SSO configuration tested with the identity provider, and audit log retention settings |
| Retention of user-linked responses | NPS and churn answers stored against user IDs need a deletion schedule that matches account deletion. Confirm whether the tool can delete or anonymize individual responses on request. | Written retention schedule, deletion test showing removal of linked responses, and a process for data subject requests |
What data flows through in-app surveys and where it must stay
The survey server only needs what it uses to decide who sees a survey and to read the answer. In a self-hosted in-app setup on Formbricks, the product sends identifiers and attributes to the survey instance so it can show a survey to the right user. That typically includes a user ID, account and plan attributes passed as contact attributes, the current page URL, and event names that fire triggers. The survey response itself adds free-text answers, ratings and any hidden fields the team defines. Each of these is a separate data category, and each should be listed in your data map before the first survey goes live. Targeting depends on those attributes. A rule such as showing a survey after a fixed number of sessions, or after a specific feature has been used, only works if the product sends a session count or a feature event for that user. A plan tier rule works only if the plan attribute is present. This is why minimizing attributes is a design decision, not a tidy-up task: every attribute sent to the survey server is one more field that must be documented, secured, retained and deleted on request. Ask the product team to justify each attribute against a specific targeting rule, and drop any attribute that no rule uses.
Treat these attributes as customer data. SOC 2 reports test controls over the system, and the security common criteria CC1 to CC9 apply to every SOC 2 examination, so the controls around where account and plan data is stored and who can read it fall within scope when a provider is audited. Customer contracts and data processing terms often classify account and usage attributes as customer data, which can restrict where they may be processed and who may act as a sub-processor. Confirm these terms with your legal team before sending any attribute to a third-party survey service. Self-hosting keeps these attributes inside your own infrastructure, but it does not remove the obligation to protect them. Decide which Formbricks environment receives attributes, which roles can export contacts, and whether the database and backups sit in the same boundary as the product. Check whether any outbound integration, such as a webhook to your product stack, forwards attributes to another vendor. Confirm each item against your own environment and your contracts, because the answer determines the scope of your evidence.
Which platform fits in-app surveys: Formbricks editions compared
For in-app and product surveys, the decision is less about features and more about which edition your team can run, govern and license. The cards below compare the self-hosted Community Edition, the self-hosted Enterprise license and Formbricks Cloud as a reference point, so you can match identity, targeting and hosting requirements to the right option before scoping work.
Formbricks Community Edition
The self-hosted Community Edition covers the core of in-app feedback: app and website surveys, link and email-embedded surveys, advanced logic, multi-language surveys, file upload, webhooks and full API access with all SDKs. It also includes a Helm chart for cluster hosting. The constraint to check is scope: the Community Edition is limited to one workspace, so separate product lines or business units that need isolated survey spaces should confirm whether one workspace is enough. Confirm your webhook and API volume against your own hosting plan.
Formbricks with Enterprise license
The Enterprise license adds the features SaaS teams usually need once surveys reach production: OIDC and SAML single sign-on, teams and access roles, contact management and segments, quota management and audit logs. It also covers whitelabel email follow-ups and removing the Powered by Formbricks badge. Enterprise code ships in the Docker images and is unlocked with an Enterprise License Key, so confirm with the vendor which features your key enables before you design targeting around segments.
Formbricks Cloud as a reference point
Formbricks Cloud is useful for comparing response volume and cost against a self-hosted deployment. As read in October 2026, the Hobby plan is free with a monthly response cap and is hosted in Frankfurt, while the Pro and Scale plans raise the response limit at a published monthly fee. Check the current caps and hosting region on the pricing page before comparison, and note that a cloud plan does not keep response data in your own infrastructure.
Self-hosting without a subscription
Formbricks can be self-hosted with Docker without a subscription, so the Community Edition has no license fee. Your costs move to infrastructure, upgrades, backups and the staff time to run them. Enterprise features are a separate license, so budget for that line item separately from hosting. Ask any implementation partner to separate hosting, licensing and operations in the quote.
Enterprise license and AGPLv3 obligations
The core application is licensed under AGPLv3, while the enterprise module code sits under a separate Enterprise license. If you modify the code and keep a private fork, that fork must be released under AGPLv3 unless an Enterprise license covers it. Have legal counsel review how your custom in-app integrations and any changes to the product's code are distributed before the build starts.
Release and upgrade path
Formbricks 6.0.2 was published on October 1, 2026, and in-app survey code depends on SDK and API behavior that can change between releases. Plan a staging environment, test your SDK version against your app build, and agree on who owns upgrades after go-live. Track the releases page for breaking changes before each planned upgrade window.
How a self-hosted in-app survey rollout runs, phase by phase
The sequence takes a Formbricks deployment from edition and workspace decisions to live in-app surveys whose responses flow into the product stack, with a runbook the team can operate after go-live.
Confirm scope and edition decision
Define which feedback moments matter (NPS, onboarding, churn), how many products or workspaces are involved, and whether you need OIDC or SAML SSO, segments, teams or audit logs. Compare the Community Edition, which is limited to one workspace, against the Enterprise license, which is required for SSO, segments and access roles. Your legal team reviews the AGPLv3 obligations for any private forks. Output: a signed scope document that names the edition, workspace count and the survey list.
Deploy Formbricks in your environment
Your platform or DevOps team deploys Formbricks in your own cloud account, data center or cluster using Docker or the Helm chart that the Community Edition includes. The partner sets up the database, storage, TLS, backups and the environment configuration, and confirms that no response data leaves your network. Output: a running instance in your environment, documented configuration and a tested backup and restore.
Configure identity and SSO
If the Enterprise license covers your scope, connect Formbricks to your identity provider over OIDC or SAML, then map groups to teams and access roles so that only the right staff can edit surveys or export responses. Test sign-in, deprovisioning and role boundaries with named test accounts. Output: a role matrix approved by the product owner and a sign-in test record showing each role can and cannot perform the expected actions.
Integrate the SDK and map attributes
Engineers install the Formbricks SDK in the web or mobile app and define which user attributes, such as plan tier, account age or workspace role, are sent to Formbricks. Attribute names are agreed with analytics and privacy owners so that only the fields needed for targeting leave the product. Output: a data mapping sheet listing each attribute, its source, its purpose and its retention, plus a build that passes a staging check.
Design targeting and triggers
Product and research leads define when each survey appears: for example, after a set number of sessions, at a milestone in onboarding, or on a cancellation page. They set segments and frequency caps so users are not surveyed repeatedly, and they test branching logic and multilingual text. Output: a trigger specification per survey and a staging walkthrough signed off by the product owner.
Wire webhooks and integrations to the product stack
Engineers connect Formbricks webhooks and supported integrations, such as Slack, Notion, Zapier or n8n, to the tools where feedback is acted on, for example the CRM, ticketing system or data warehouse. Payloads are checked for the fields needed and for personal data that should be dropped. Output: a tested flow for each destination, with failure handling and a list of which fields reach which system.
Test response quality and in-app performance
QA checks that surveys render correctly across browsers, devices and languages, that the SDK does not slow page load noticeably, and that responses are stored, deduplicated and delivered to each webhook. Pilot surveys run with a small internal group to confirm completion rates and wording clarity. Output: a test report with defects resolved, performance observations recorded and a go or no-go decision.
Go live with a runbook
The team releases the surveys to production in agreed waves, monitors response volume and webhook errors, and hands over a runbook covering upgrades, backup restoration, license key handling, access reviews and incident contacts. The partner's support terms, if any, are documented in the written scope. Output: a production launch record and a runbook that your operations team has rehearsed at least once.
Evidence that auditors and customers ask for from a feedback system
This table maps each piece of evidence that SaaS auditors and enterprise customers request from an in-app survey setup to the Formbricks component or record that produces it. Read each row as a question to answer before a SOC 2 examination or a customer security review. DeployOpen prepares the configuration, exports and documentation, but SOC 2 reports are issued by an independent CPA firm, not by DeployOpen.
| Evidence item | What it shows | Component that produces it |
|---|---|---|
| Access control from SSO and roles | Who can sign in, how sign-in is enforced, and which teams can edit or view surveys and responses | OIDC or SAML SSO and teams and access roles, which require the Enterprise license |
| Audit log exports | A record of administrative changes to surveys, users, roles and settings over a period | Audit logs, an Enterprise feature; confirm export format and retention with your edition |
| Change records for survey and SDK versions | Which Formbricks release runs in production, when it changed, and which app or website SDK version is installed | Deployment manifests and image tags in your pipeline, plus the Formbricks release notes and SDK version history |
| Data processing terms with the hosting provider | The contractual basis for your cloud or data center host to process data on your documented instructions | Your signed agreement with the hosting provider; for self-hosting, the processor relationship is with that host, not Formbricks |
| Data flow documentation for webhooks and integrations | Which response fields leave the platform, to which endpoint, and under what authentication | Webhook configuration and integration settings (Slack, Notion, Zapier, n8n or custom endpoints), reviewed against a written data map |
| Retention settings and deletion evidence | How long responses, contact attributes and logs are kept, and how deletion requests are carried out | Retention and deletion procedures in your database and backups, with the platform's data export and deletion steps documented |
What do SaaS teams ask before self-hosting in-app surveys?
What does self-hosting Formbricks cost compared with Formbricks Cloud tiers?
Self-hosting carries no Formbricks subscription, because the core application can be run with Docker, but it moves cost into infrastructure, engineering time and upkeep. Formbricks Cloud, as read in October 2026 on its pricing page, lists Hobby free with 250 responses per month hosted in Frankfurt, Pro at $74 per month with 2,000 responses and Scale at $325 per month with 5,000 responses. Those tiers recur monthly and scale with response volume. Your self-hosted costs recur too: hosting, backups, upgrades, monitoring and any Enterprise license, which is priced separately and should be quoted by Formbricks. Ask for the Enterprise license terms in writing before you compare totals.
Is the Formbricks Community Edition enough for a SaaS product team?
It depends on whether you need workspace structure, segments and SSO. The Community Edition includes unlimited surveys, responses and users, full API access, all SDKs, website, app, link and email-embedded surveys, advanced logic, multi-language support, file upload, webhooks and a Helm chart. It is limited to one workspace. OIDC and SAML SSO, teams and access roles, contact management and segments, quota management, audit logs, whitelabel email follow-ups and removing the Powered by Formbricks badge all need the Enterprise license. If your NPS and churn programs only need one team and no segment targeting, Community may be enough. Confirm the segment and access needs with your product and security leads first.
How long does a self-hosted in-app survey rollout take?
No duration is fixed by the platform, so the timeline depends on scope. Plan for work in four areas: hosting and deployment, the SDK installed in your app, survey design and trigger rules, and the webhook or integration path into your product stack. The product team needs to define events that trigger surveys, such as post-onboarding or after a set number of sessions, and to agree which user attributes can be sent to the survey tool. Ask any implementation partner for a fixed-scope written plan with milestones, since most engagements are agreed that way before work starts.
Can our own engineering team run a self-hosted Formbricks deployment alone?
A capable team can deploy the core application with Docker or the Helm chart, but the ongoing work is what decides whether it works in practice. Operations include upgrades (Formbricks 6.0.2 was published on October 1, 2026, so release tracking is a recurring task), database backups, uptime monitoring, SDK updates in your apps and integration maintenance. Ask yourself who will own on-call responses for the survey service and who will review privacy settings for each survey. A partner can take on planning, hardening, backup design, documentation and retainer-based upgrades, while your team keeps ownership of survey content and product triggers.
What do Enterprise license terms mean if we fork Formbricks?
The core application is licensed under AGPLv3, and code in its enterprise module sits under a separate Enterprise license that ships in the Docker images and is unlocked with an Enterprise License Key. The Community Edition documentation states that privately kept forks must be released under AGPLv3 unless they are covered by an Enterprise license. If you plan to modify the code for internal product logic, have counsel review what counts as a fork, what must be published and whether internal-only changes trigger source release obligations. Confirm the exact terms in the Formbricks license documentation before you start any customization.
How can we move off a self-hosted survey platform later under Data Act switching rights?
The EU Data Act, Regulation (EU) 2023/2854, has applied since 12 September 2025 and requires data processing service providers to let customers switch to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transitional period. From 12 January 2027, providers may not impose switching charges. These rights apply to cloud data processing services, so a Formbricks Cloud contract is the case most affected, while a self-hosted deployment you run yourself is shaped by your own export design. Keep response data in a documented, exportable schema and test an export from your own instance so you know the switch path before you need it. Confirm with counsel how the Act applies to your specific contracts.
Does self-hosting Formbricks help with SOC 2 evidence for a SaaS product?
Self-hosting does not give you a SOC 2 report, because only an independent CPA firm issues one. It can, however, give you control evidence over the survey data path. SOC 2 examinations use the AICPA 2017 Trust Services Criteria, and the security common criteria CC1 to CC9 apply to every report. Hosting the survey service in your own cloud account lets you bring its access logs, change records, backup tests and vendor reviews into your existing control set. Ask your auditor which system description and controls they expect to see for a survey tool that handles customer feedback, and whether Type 1 or Type 2 scope fits your timeline.
What to ask an implementation partner before signing
Start with edition fit. Ask the partner to map each requirement in your scope to either the Community Edition or the Enterprise license before quoting. The Community Edition covers website, app, link and email-embedded surveys, the API, SDKs and webhooks, but OIDC and SAML SSO, teams and access roles, segments, audit logs and removing the Powered by Formbricks badge sit behind the Enterprise license. Ask who confirms that the segmentation and SSO you need are in the Enterprise scope, and whether the quote assumes one workspace or several, since the Community Edition is limited to one. Ask how the Enterprise License Key is installed, rotated and stored, who holds it after go-live, and what happens to the Enterprise features if the key lapses.
Next, pin down fork and SDK obligations. If your team plans to modify Formbricks, ask how the partner will handle the AGPLv3 terms for any private fork and whether that code is covered by an Enterprise license. Ask for a written statement of which code you will be required to publish. Then request a security review of the JavaScript and app SDKs as they run inside your product: what data they read, where they store identifiers in the browser or device, how the userId and custom attributes are passed, and whether the survey script can be loaded from your own domain. Ask for the review findings and the reviewer's method, not only a sign-off. Finally, ask for a data map of attributes and webhook payloads, showing which fields leave your environment, the receiving endpoints, and the retention on each.
