Formstack
Formstack is a no-code platform for building online forms, collecting data and automating workflows such as approvals, documents and e-signatures. Its forms are embedded on websites with a script or iframe, or shared as hosted pages. Embedded forms load from Formstack's servers, may set cookies and send visitors' submissions to Formstack, which should be reflected in the site's privacy notice.
What does Formstack do?
Formstack, founded in 2006 in Indianapolis, has grown from a SaaS form builder into a workplace productivity platform combining online forms, document generation, electronic signature and workflow automation. Used by tens of thousands of businesses including hospitals, banks and universities, it positions itself as a no code alternative to building back office processes.
What Formstack does
Formstack offers four main modules: Forms (drag and drop builder with conditional logic, payments, file uploads), Documents (template based document generation), Sign (electronic signature with full audit trail) and Workflows (multi step approvals). Forms can be embedded as iframe, JavaScript or full page link. Integrations include Salesforce, HubSpot, Stripe, PayPal, Microsoft 365, Workday and Slack.
Data and cookies set
The Formstack embed loads JavaScript from formstack.com and sets third party cookies including ga_session, fs_session, an _ga identifier (when analytics is enabled) and __cf_bm (Cloudflare). Submissions, IP, user agent, referrer and time on form are stored on Formstack servers. The platform offers field level encryption for sensitive data and granular access controls.
GDPR and ePrivacy implications
Formstack acts as a processor under Art. 28 GDPR. Website operators must sign the Formstack DPA, document Formstack as a sub processor and choose the EU data residency option when relevant. The embedded widget sets third party cookies that require prior consent under Art. 5(3) ePrivacy. Formstack is self certified under the EU US Data Privacy Framework.
Data transfers and residency
Standard plans store data in AWS us east 2 (Ohio). Enterprise customers can request the EU Data Region (AWS eu west 1, Dublin). Healthcare customers can request a HIPAA isolated environment with Business Associate Agreement. Transfers to the US rely on the EU US DPF or on Standard Contractual Clauses with supplementary measures.
Practical compliance steps
Block the Formstack widget until consent. Sign the DPA and request EU data residency when handling EU resident data. Enable field level encryption for sensitive fields. Configure retention policies. Add a privacy notice and consent checkbox to every form. Document Formstack as a sub processor in your records of processing and your privacy notice with the US transfer mechanism.
Formstack and the GDPR
Formstack is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive) for the third party cookies set by the embedded widget. Performance of a contract (Art. 6(1)(b)) for the submitted data, processed by Formstack as a processor on behalf of the website operator.
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive, TDDDG, LSSI CE, CCPA/CPRA, HIPAA, EU US Data Privacy Framework, PCI DSS (payment forms)
What Formstack sets and contacts
- Tracking method
- SaaS form, document and signature platform. Forms are hosted on formstack.com and embedded via iframe or JavaScript snippet. Submissions are stored on Formstack servers; the embedding website only loads the form widget.
- Server location
- Operated by Formstack LLC, headquartered in Fishers, Indiana, United States. EU customers can opt for the Formstack EU data centre hosted in Dublin (AWS eu west 1). HIPAA workloads run on isolated US healthcare infrastructure.
- Data transferred outside the EU
- By default, all form data is stored on US servers operated by Formstack LLC. EU residency in Dublin can be enabled on enterprise plans. Transfers from EU to US rely on the EU US Data Privacy Framework (Formstack is certified) or on Standard Contractual Clauses with supplementary measures.
Cookies set (4)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| fs_session | third_party | Session | Session identifier set by formstack.com to track the current form submission state. |
| ga_session | third_party | Session | Internal session cookie used by Formstack for form analytics and submission attribution. |
| _ga | third_party | 2 years | Google Analytics identifier set on formstack.com when Formstack analytics is enabled. |
| __cf_bm | third_party | 30 minutes | Cloudflare bot management cookie used to distinguish humans from bots on formstack.com. |
Third-party domains contacted (4)
formstack.comwww.formstack.comcdn.formstack.comsubmit.formstack.io
Frequently asked questions about Formstack
Can't find your question? Write to us, we answer fast.
Which cookies does Formstack set?
The embedded Formstack widget sets third party cookies on formstack.com: ga_session, fs_session, _ga (when analytics is enabled) and __cf_bm (Cloudflare). All require prior consent in the EEA except __cf_bm which is often claimed as strictly necessary for bot protection.
Is consent required to use Formstack?
Yes for the embedded widget. The third party cookies require consent under Art. 5(3) ePrivacy. The submission data itself can be processed under Art. 6(1)(b) GDPR (pre contractual) with marketing fields under consent.
What is the legal basis for processing Formstack data?
Contract or pre contractual measures (Art. 6(1)(b)) for contact and quote forms. Consent (Art. 6(1)(a)) for cookies and marketing fields. Healthcare data is processed under HIPAA with a BAA in the US. Sensitive data (Art. 9 GDPR) needs explicit consent.
Is data transferred to the United States?
By default yes. Enterprise customers can activate the EU Data Region (Dublin). Otherwise transfers rely on the EU US Data Privacy Framework (Formstack is certified) or on Standard Contractual Clauses with supplementary measures and a TIA.
Do I need a DPIA for Formstack?
A DPIA is recommended when Formstack collects special categories of data, employee data, financial data or is connected to payments and signatures. The DPIA documents the residency choice, the transfer mechanism, the encryption, and the rights workflow.
How do I implement Formstack correctly?
Block the widget until consent. Sign the DPA. Activate EU Data Region for EU resident data. Enable field level encryption for sensitive fields. Add a privacy notice and consent checkbox. Set retention policies. Document Formstack as a sub processor.
Which alternatives to Formstack should I consider?
EU based SaaS: Tally (Belgium), Typeform (Spain), Formbricks (open source). US SaaS: Jotform (with EU residency), SurveyMonkey, Wufoo. WordPress self hosted: Gravity Forms, WPForms, Ninja Forms, Fluent Forms.
How do I update the cookie policy when Formstack changes?
Track the Formstack sub processor list and trust centre. When sub processors, certifications or residency options change, update your cookie table, privacy notice and records of processing, and bump the consent banner version.
Talkable
Talkable is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Talkable provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Talkable helps deliver the right message to the right audience at the right time.
Deal.ai
Deal.ai is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Deal.ai integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Deal.ai makes advanced AI accessible to all teams.
Quoli
Quoli is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Quoli supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Quoli ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Knock Knock App
Knock Knock App is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Knock Knock App integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Knock Knock App makes advanced AI accessible to all teams.
Sleeknote
Sleeknote is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Sleeknote provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Sleeknote helps deliver the right message to the right audience at the right time.
RafflePress
RafflePress is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. RafflePress offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, RafflePress empowers organizations to optimize strategy and maximize return on investment.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.