Survey and feedback software built for compliance
Formbricks is SOC 2 Type II and ISO 27001 compliant, GDPR and CCPA compliant, and hosted in Germany. Or self-host it and keep every response inside your own perimeter.
Talk to us
Pick a time right in the form.
Trusted by teams at
Certifications
Information security in every response
Formbricks is private by design. Independent audits verify our controls, so your security review goes faster.
GDPR Compliant
- Description
- Formbricks is fully compliant with the European General Data Protection Regulation, ensuring data protection by design and default.
CCPA Compliant
- Description
- Formbricks adheres to the California Consumer Privacy Act, providing robust data protection for California residents.
SOC 2 Type II
- Description
- We are SOC 2 Type II compliant, demonstrating our commitment to rigorous security controls and processes.
ISO 27001
- Description
- We are ISO 27001 compliant, further strengthening our information security management practices.
Security
Security controls that run every day
Compliance is the result of what we do every day: encryption, testing, monitoring, and secure development.
Encryption Everywhere
- Description
- All data is encrypted in transit with TLS 1.3 and at rest with AES-256, including backups.
Annual Penetration Tests
- Description
- Independent penetration tests run every year. Critical findings are fixed immediately, and the latest report is available on request.
Backups & Monitoring
- Description
- Daily encrypted backups, a tested disaster recovery plan, continuous monitoring, and DDoS protection.
Secure Development
- Description
- Every change is peer-reviewed and scanned by SonarQube and Dependabot. Code with critical issues can't be merged.
Access Control
Enterprise Auth, Built In
Keep control of who can see what. Formbricks connects to your identity provider and enforces the access controls enterprise and regulated teams expect.
Single Sign-On (SSO)
- Description
- Authenticate through your existing identity provider with SSO via OIDC (Okta) and SAML, no separate credentials to manage or offboard.
Workspace-Level Isolation
- Description
- Every team, department, or business unit gets its own workspace, so surveys and responses stay siloed to exactly the people who should see them.
MFA, RBAC & Audit Logging
- Description
- Enforce multi-factor authentication, role-based access controls, and full audit logging to meet your security and governance requirements.
Cloud in Germany or fully self-hosted
Formbricks Surveys stores all data in Germany (EU). If your requirements go further, for example HIPAA, air-gapped networks, or strict data residency, self-host Formbricks on your own infrastructure with Docker or Kubernetes. The same codebase, fully under your control.
Industries
Trusted in regulated industries
Teams that handle sensitive data use Formbricks to collect feedback without adding compliance risk.
- 1
Healthcare
- Description
- Collect patient and staff feedback while keeping sensitive health data on infrastructure you control.
- 2
Government & Public Sector
- Description
- Run citizen surveys with full data control, on premise or in an air-gapped environment.
- 3
Banking & Finance
- Description
- Meet strict audit and data residency requirements with SSO, RBAC, and audit logging.
Trust resources
Everything your security review needs
Reports, policies, and legal documents in one place.
Trust Center
Request the SOC 2 Type II report, ISO 27001 certificate, penetration test results, and security policies.
Security Practices
How we encrypt, host, test, and monitor Formbricks, explained for technical and non-technical readers.
Data Processing Agreement
Our standard DPA under Art. 28 GDPR, including the full list of subprocessors.
SOC 2 Type II
What our SOC 2 Type II audit covers and how to request the report.
GDPR FAQ
Data residency, controller and processor roles, and how to run GDPR-compliant surveys.
Service Level Agreement
Uptime commitments and support response times for Enterprise customers.
Request our compliance documents
Get our SOC 2 Type II report, ISO 27001 certificate, penetration test results, and security policies from the Trust Center. Questions? Email [email protected].
FAQ
Frequently Asked Questions
Which compliance standards does Formbricks meet?
Formbricks is SOC 2 Type II compliant, ISO 27001 compliant, and compliant with GDPR and CCPA. Formbricks Surveys is hosted in Germany. You can check our current status in the Trust Center at trust.formbricks.com.
Is Formbricks HIPAA compliant?
Formbricks Surveys is not HIPAA compliant yet. If you need a HIPAA-compliant setup, you can self-host Formbricks on your own infrastructure so protected health information never leaves your environment. Reach out and we'll help you set it up.
Can I get a copy of your SOC 2 report or penetration test?
Yes. Request the SOC 2 Type II report and the latest penetration test report through our Trust Center at trust.formbricks.com, or email [email protected].
Where is my data stored?
Formbricks Surveys stores all data in Germany (EU). If you need full control over data residency, you can self-host Formbricks in any region, in your own cloud, or on premise.
Do you sign a Data Processing Agreement?
Yes. Our standard DPA is available at formbricks.com/dpa and lists all subprocessors. For questions, email [email protected].
Does the compliance coverage apply to self-hosted Formbricks?
Our SOC 2 Type II audit covers Formbricks Surveys, including our managed infrastructure and operations. Self-hosted instances benefit from the same secure codebase and development practices, but you're responsible for your own infrastructure controls.
How do I report a security vulnerability?
Email [email protected]. We acknowledge reports on critical issues within 48 hours and never take legal action against good-faith researchers.
Questions from your security review?
Bring them to a call, or request our documents.