FormVault — the GDPR-first form builder for European teams
Every feature in FormVault is designed with GDPR compliance and European data sovereignty in mind.
Unlike US-based form builders that treat EU compliance as an add-on, FormVault is built from the ground up for European organisations — with encryption at rest, EU-only data storage, and a signed DPA on every plan (including free).
Security & Privacy
AES-256-GCM encryption
Every form response is encrypted at rest using AES-256-GCM before it is written to the database, so stored data and backups are not readable without the application's key.
EU-only data residency
Data is stored exclusively on Hetzner servers in Nuremberg, Germany. No transfers outside the EEA, ever.
Privacy by design
We implement GDPR Article 25 by default — collecting only what is necessary. We use self-hosted, cookieless analytics (Umami) — no cookies, no personal data, no third-party processors.
FjordID single sign-on
Authentication is handled by FjordID, an EU-based identity provider. No passwords stored in FormVault.
Form Building
Visual drag-and-drop builder
Add and reorder fields intuitively. Supports text, long text, number, dropdown, checkbox, date, email, and URL fields.
Custom labels and placeholders
Full control over field labels, placeholder text, and required/optional status.
Shareable public links
Every form gets a permanent public URL. Share it via email, embed it on your site — no login required for respondents.
Response Management
Submission dashboard
View all responses in a clean table, decrypted on-the-fly in your browser. Filter, sort, and search through submissions.
CSV export
Export all submissions as CSV for further analysis in Excel, Google Sheets, or your preferred tool.
Response notifications
Get notified by email whenever a new response comes in. Coming soon.
Frequently asked questions
What is FormVault?
FormVault is a GDPR-first form builder hosted in the European Union. It is a privacy-focused alternative to Typeform, Jotform, and Google Forms — designed for accountants, consultants, healthcare providers, and any European organisation that needs encrypted, EU-only form data. Every form is encrypted at rest with AES-256-GCM and stored exclusively on Hetzner servers in Nuremberg, Germany.
What field types does FormVault support?
FormVault supports text, long text, number, dropdown, checkbox, date, email, and URL fields. Every field type supports custom labels, placeholder text, and required/optional settings.
Does the free plan include all GDPR compliance features?
Yes. Every plan — including free — includes AES-256-GCM encryption at rest, EU data residency on Hetzner Germany, and a signed Data Processing Agreement (DPA). You don't need to upgrade to get compliant.
Where is FormVault data hosted?
All data is stored exclusively on Hetzner servers in Nuremberg, Germany. No data is transferred outside the EEA or replicated to US data centres.
Is FormVault suitable for accountants and consultants?
Yes. FormVault is designed for regulated professionals handling client data. Encrypted intake forms, a DPA on every plan, and an audit trail of data subject requests make it suitable for accountants, consultants, and legal professionals.
Can I embed a FormVault form on my website?
Every form has a permanent public URL that you can link to from any page. Respondents don't need an account to submit a response.
What makes FormVault a secure online form builder for EU organisations?
FormVault encrypts every submission with AES-256-GCM before it is written to the database. The decryption key is derived from a secret never stored in the database, so even a full database breach exposes only ciphertext. Data is hosted exclusively on Hetzner in Nuremberg, Germany — no US sub-processors, no third-party trackers on the form page, and a signed DPA on every plan.
GDPR compliance guides
Comparing GDPR compliance across the most common form builders used by European organisations.