Your submissions stay in the EU.
Formspring runs in EU data centers. Every submission and uploaded file is stored and processed there, encrypted in transit and at rest, with sensitive fields encrypted on top. This is the default for every customer on every plan, not a paid add-on. Where something does leave the EU, it is named with its region on the sub-processors page rather than glossed over here.
One routine path leaves the EU, and we’d rather say so here: the email that notifies you of a submission is sent through a provider outside the EU/EEA, under Standard Contractual Clauses.
- Data residency
- Storage and processing in Germany
- Encryption
- TLS 1.2+ in transit, AES-256 at rest
- Sensitive fields
- Encrypted again with a per-workspace key
- Signed downloads
- File links expire after 15 minutes
What happens to one submission
Four steps, from the visitor’s browser to encrypted storage. Pick a step to see what is checked there.
Visitor submits
A respondent sends a form, survey, or funnel response from their browser or via the API.
Browser submissions are checked against the form’s allowed origins. Up to 5 files of 10 MB each per submission.
Controls you set per form
Spam never triggers notifications or webhooks. A screening step that can’t reach its provider releases the submission rather than swallowing it.
- Allowed origins
- Per-form allow list rejects browser submissions from unexpected domains at the edge.
- BYO captcha & spam keys
- hCaptcha and Akismet keys are stored encrypted and never proxied through a shared key.
- Retention windows
- Configure how long submissions are retained per form; expired submissions are purged with their attachments.
- AI moderation toggle
- Optional content classification with full opt-out and audit logging.
- Webhook signing secrets
- Rotate per-webhook secrets without dropping deliveries. Receivers verify in constant time.
- Scoped API tokens
- Personal-access tokens with explicit abilities; team-plan role-based access on top.
Who else touches the data
Described by role. The sub-processors page names each vendor for your Article 28 review.
Sub-processors by name| Role | What it does | Region |
|---|---|---|
| Application hosting & object storage | Runs the application and stores submissions and uploaded files | EU (Germany) |
| Transactional email delivery | Sends submission notifications, autoresponders, and account email | Outside the EU/EEA (Standard Contractual Clauses) |
| Payment processing | Subscription billing, invoicing, and EU VAT collection | EU (Ireland) |
| Spam content scoring optional | Optional submission spam classification; bring-your-own key supported | US (Standard Contractual Clauses) |
| Bot challenge optional | Optional captcha challenge on public forms, with the keys you supply for the form | US (Standard Contractual Clauses) |
| SMS delivery optional | Sends the SMS automation step and link-in-bio signup confirmations | US (Standard Contractual Clauses) |
| Custom-domain edge TLS optional | Terminates TLS and proxies traffic for a custom domain you configure yourself | Global anycast; the serving location follows the visitor |
| AI moderation & summaries optional | Optional AI moderation, summaries, and autoresponder drafts on paid plans; off unless the feature is switched on | US (Standard Contractual Clauses) |
How long we keep submissions
| Plan | Retention |
|---|---|
| Free | 30 days, automatic purge |
| Pro | Until manually deleted; per-form override available |
| Team | Until manually deleted; per-form override |
| Scale | Custom retention policy with per-team controls |
Found a vulnerability?
Coordinated disclosure, please. We credit reporters who ask to be credited.
Email security@pixelandprocess.de- In scope
- Production endpoints under formspring.io and ingestion under f.formspring.io
- Out of scope
- Third-party integrations and webhook receivers you control
- Acknowledged
- Within 2 business days
- Triage and timeline
- Within 5 business days