How many subprocessors does Typeform use?

Typeform lists 27 subprocessors on its published list, including Amazon Web Services Inc. (dba AWS), Alloy, Arize AI, Inc., Forge Technology, Inc. (Paragon), and FullContact Inc. and 22 more.

Where does Typeform process customer data?

The subprocessors named by Typeform are located in US, EU, EU (for EU data hosting customers), and UK, as stated on its list.

How quickly does Typeform report a personal data breach to customers?

According to its DPA, Typeform reports a personal data breach to customers without undue delay, with no set deadline: “we will notify you without undue delay upon we becoming aware of a personal data breach affecting personal data and, in any event, within the deadlines set forth under the GDPR”

How much notice does Typeform give before adding a subprocessor?

Typeform's DPA gives 15 days' notice of a new subprocessor, the time customers have to object: “you will be entitled to reasonably oppose (i.e. any challenge based on the potential or actual failure to meet the legal requirements set forth by the GDPR by the subprocessor to be appointed) to such change in the non-extendable term of fifteen (15) calendar days”

How does Typeform transfer personal data outside the EU?

Typeform's DPA relies on standard contractual clauses and adequacy decisions: “you and us enter into the SCCs, module 4, as a mechanism to ensure the adequate protection of personal data being transferred outside the EEA”

When was Typeform's subprocessor list last checked?

ClauseTrail last checked Typeform's subprocessor list on October 2, 2026. Lists are re-checked daily.

How do I find out when Typeform adds or removes a subprocessor?

ClauseTrail monitors Typeform's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Typeform Subprocessors List (October 2026): Changes and History

Typeform names 27 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked October 2, 2026 Official source ↗

Typeform subprocessors (October 2026)

#	Subprocessor	Purpose	Location	Data
1	Amazon Web Services Inc. (dba AWS)	Storage, data management	US, EU (for EU data hosting customers)	Response data collected while answering a typeform built by a customer (the type of personal data depends on each customer and form).
2	Alloy	In the case that you use Integrations (such as the ones that let our product interact with Klaviyo, Zendesk, Freshdesk, Asana, Aircall, or Shopify), to support system interoperability.	US	Response data collected while answering a typeform built by a customer (the type of personal data depends on each customer and form).
3	Arize AI, Inc.	In the case that you use Optional Features, to provide AI observability, monitoring and security services.	EU	Response data collected while completing a Typeform or Research Flow study.
4	Forge Technology, Inc. (Paragon)	In the case that you use Integrations, to support system interoperability and enable integrations between Typeform and customer-selected third-party applications.	EU	Response data collected while completing a Typeform.
5	FullContact Inc.	In the case that you use response enrichment to obtain additional demographic and professional data.	US	Email address (response data) collected via a typeform.
6	Google (Gmail)	In the case that you contact Customer Support, to resolve queries or security concerns of the platform or about the responses received.	EU	Email address, any data provided by customer to solve the query, including response data as per customer’s request.
7	Google Cloud Platform	To support AI-enabled functionality across our products and services, such as screen observation, note-taking and post-session insights in Research Flow.note-taking and post-session insights.	US	To the extent personal data is processed through AI-enabled functionality, this may include, for example, respondent audio, video and transcription data when using Research Flow.
8	LiveKit Incorporated	In the case that you use Research Flow, to support real-time voice and video processing.	US	Respondent audio, video and transcription data.
9	Mailgun Technologies, Inc.	In the case you use our feature to send emails through the platform containing respondent data.	EU	Response data as long as the customer includes it in the subject or body of the message.
10	Mux, Inc.	In the case you use our feature to process video questions and video answers.	US	Recordings and response data provided in video format.
11	OpenAI Ireland Ltd	In the case that you use Optional Features, AI services aimed at form building and results analysis.	US	Response data collected while answering a typeform built by a customer (the type of personal data depends on each customer and form).
12	ScaleStack	In the case that you use data enrichment to obtain additional demographic and professional data.	US	Respondent email address as input to a typeform
13	Twilio Ireland Limited	In the case that you use the Send Text (SMS) (an Optional Feature) (here), supporting SMS communications.	US	Response data collected while answering a typeform built by a customer and subsequently submitted to Twilio for SMS communications (the type of personal data depends on each customer and form).
14	Zendesk, Inc.	In the case that you contact Customer Support, to resolve queries or security concerns of the platform or about the responses received.	US	Any data provided by customer to solve the query, including response data as per customer’s request.
15	ZOOMINFO TECHNOLOGIES LLC	In the case that you use response enrichment to obtain additional demographic and professional data.	US	Email address (response data) collected via a typeform
16	APIHub Inc. (dba Clearbit)	Target marketing campaigns at relevant audience and profiling	US	Email address
17	Gainsight, Inc. (formerly known as InSided)	In the case that you participate in our community, to support account creation and user interaction in our community, as available at https://community.typeform.com/	EU	Name, surname, email address
18	Liveblocks, Inc.	In the case that you activate our commenting services, to support the commenting experience and real time interaction in our platform	US	Input provided by a user when interacting with another user
19	Okta, Inc.	Create a single sign-on system for login and authentication on the Typeform platform (also supports MFA)	US, EU	Email address, IP address
20	Pinecone Systems, Inc.	In the case that you use Optional Features, AI services aimed at form building and results analysis.	US	Any personal data only as long as the customer includes it in the knowledge base or the questions of the form.
21	PowerPlay GmbH (dba as	In the case that you use our referral services, to identify and process the referral	EU	Name, surname, email address, phone number, country
22	Snowflake Computing Netherlands B.V. (dba. Snowflake)	Used as our data warehouse and for data processing.	US	Name, surname, email address and IP address
23	Salesforce Systems Spain, S.L (Slack)	Customer Services: Provide a support service for communication of all Typeform customer enquiries and requests, in accordance with the procedures specified by Typeform.	EU	Name, surname, email address, billing details, other information related to queries raised by customers
24	TYPEFORM DE GmbH	Customer Services: Provide a support service for the reception, assessment, or dispatch of all Typeform customer enquiries and requests, in accordance with the procedures specified by Typeform.	EU	Name, surname, email address, billing details, other information related to queries raised by customers
25	TYPEFORM UK Ltd	Customer Services: Provide a support service for the reception, assessment, or dispatch of all Typeform customer enquiries and requests, in accordance with the procedures specified by Typeform.	UK	Name, surname, email address, billing details, other information related to queries raised by customers
26	TYPEFORM US LLC	Customer Services: Provide a support service for the reception, assessment, or dispatch of all Typeform customer enquiries and requests, in accordance with the procedures specified by Typeform.	US	Name, surname, email address, billing details, other information related to queries raised by customers
27	Zapier, Inc.	In the case that you use workflows, to support setting up workflows and facilitate user authentication to Zapier.	US	Prompt data and email addresses.

Get an email when Typeform changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Typeform free

Key DPA terms at Typeform

What Typeform's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“we will notify you without undue delay upon we becoming aware of a personal data breach affecting personal data and, in any event, within the deadlines set forth under the GDPR”
DPA, www.typeform.com ↗
Notice of a new subprocessor: 15 days ahead

“you will be entitled to reasonably oppose (i.e. any challenge based on the potential or actual failure to meet the legal requirements set forth by the GDPR by the subprocessor to be appointed) to such change in the non-extendable term of fifteen (15) calendar days”
DPA, www.typeform.com ↗
Transfers outside the EU: Standard contractual clauses and adequacy decisions

“you and us enter into the SCCs, module 4, as a mechanism to ensure the adequate protection of personal data being transferred outside the EEA”

“the Parties declare that the transfer of data from the United Kingdom to Spain or from Spain to the United Kingdom will not be construed as an international transfer of personal data, considering the adequacy decisions passed on this subject”
DPA, www.typeform.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“You will decide whether you want us to delete or return personal data, unless Union or Member State law requires storage of the personal data.”
DPA, www.typeform.com ↗
Audit rights: Once a year

“you agree that you may only conduct up to one (1) audit per year, unless there are reasonable grounds to believe that we are not performing the obligations laid down in this DPA”
DPA, www.typeform.com ↗

Documents we track for Typeform

DPA: checked October 2, 2026 www.typeform.com ↗
Privacy policy: checked October 2, 2026 www.typeform.com ↗
Subprocessor list: checked October 2, 2026 help.typeform.com ↗
Trust page: trust.typeform.com ↗

Change history

Tracking since October 2, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Typeform subprocessors FAQ

How many subprocessors does Typeform use?: Typeform lists 27 subprocessors on its published list, including Amazon Web Services Inc. (dba AWS), Alloy, Arize AI, Inc., Forge Technology, Inc. (Paragon), and FullContact Inc. and 22 more.
Where does Typeform process customer data?: The subprocessors named by Typeform are located in US, EU, EU (for EU data hosting customers), and UK, as stated on its list.
How quickly does Typeform report a personal data breach to customers?: According to its DPA, Typeform reports a personal data breach to customers without undue delay, with no set deadline: “we will notify you without undue delay upon we becoming aware of a personal data breach affecting personal data and, in any event, within the deadlines set forth under the GDPR”
How much notice does Typeform give before adding a subprocessor?: Typeform's DPA gives 15 days' notice of a new subprocessor, the time customers have to object: “you will be entitled to reasonably oppose (i.e. any challenge based on the potential or actual failure to meet the legal requirements set forth by the GDPR by the subprocessor to be appointed) to such change in the non-extendable term of fifteen (15) calendar days”
How does Typeform transfer personal data outside the EU?: Typeform's DPA relies on standard contractual clauses and adequacy decisions: “you and us enter into the SCCs, module 4, as a mechanism to ensure the adequate protection of personal data being transferred outside the EEA”
When was Typeform's subprocessor list last checked?: ClauseTrail last checked Typeform's subprocessor list on October 2, 2026. Lists are re-checked daily.
How do I find out when Typeform adds or removes a subprocessor?: ClauseTrail monitors Typeform's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.