EU Data Residency and GDPR
What is stored in the EU, what isn't, and the documents behind it
When you sign up for Static Forms (staticforms.dev) you choose where your form data is stored: the United States (AWS us-east-1) or the European Union (AWS eu-central-1, Frankfurt). Form data means form submissions, file attachments, webhook delivery logs and AI reply logs. Account data, email delivery and operational logs stay in the US for every account. This page sets out exactly what that covers. The binding terms are in the Data Processing Agreement.
What an EU-region account stores in the EU
| Data | Where it is stored |
|---|---|
| Form submissions | EU (AWS eu-central-1, Frankfurt) |
| File attachments | EU (AWS eu-central-1, Frankfurt) |
| Webhook delivery logs | EU (AWS eu-central-1, Frankfurt) |
| AI reply logs | EU (AWS eu-central-1, Frankfurt) |
This form data is not stored in the United States. Accounts that keep the default US region store all of the above in AWS us-east-1.
What stays in the US for every account
| Data | Where it is processed |
|---|---|
| Account data: your user record (name, email, anonymized consent IP) and billing data | US (AWS us-east-1; Stripe) |
| Email delivery: form notifications, auto-responders and AI replies | Sent through AWS SES in the US, with Singapore as the failover region |
| Operational request logs: request metadata and form field names, never field values | US (Axiom) |
Email delivery is a transmission, not storage, but it means notifications for an EU-region account leave from the US. So don't describe an EU-region account as "all data stays in the EU": the promise covers storage of form data only.
Processing that can happen outside your storage region
- Default spam check. Selected, redacted form fields are evaluated by TypeSafe AI (Jev) through Vercel AI Gateway on every account, whichever region it selected. Inference may happen outside your storage region. Each form can switch to the classic filter (CleanTalk, EU data region) on every plan. See Spam Filter.
- AI Reply, only if you turn it on for a form, sends the submission to an AI model provider through Vercel AI Gateway in the US.
- Application hosting runs on Vercel, listed as a US sub-processor.
Transfers outside the EU/EEA rely on the EU Standard Contractual Clauses and, for certified providers, the EU-U.S. Data Privacy Framework, as described in DPA Section 8 and the Transfer Impact Assessment.
Choosing or changing the region
Pick the region on the signup page, above both the email and Google sign-up options. Until your account holds any form data, you can change it from the Account page in the app. Once the first submission or upload is stored, the region is fixed. All accounts submit to the same endpoint, https://api.staticforms.dev/submit; Static Forms routes storage by the account's region.
Documents
- Data Processing Agreement, including the sub-processor list (Section 5) and international transfers (Section 8)
- SCC Annexes I–III
- Transfer Impact Assessment
- Sub-processor change notifications (with an RSS feed)
- Privacy Policy
Your responsibilities
Static Forms processes submissions on your behalf. You remain responsible for your own privacy notice, your lawful basis for collecting the data, and any consent your forms need.
FAQ
Does Static Forms store form submissions in the EU?
Yes, if you choose the European Union region at signup. Submissions, file attachments, webhook delivery logs and AI reply logs are then stored in AWS eu-central-1 (Frankfurt) and not in the United States. Account data, email delivery and operational request logs are in the US for every account.
Is there a DPA?
Yes. The Data Processing Agreement is published at staticforms.dev/dpa and incorporates the EU Standard Contractual Clauses by reference. The SCC annexes, Transfer Impact Assessment and sub-processor list are linked from it.
Can I move an existing account to the EU?
Only while the account holds no form data. You can change the region from the Account page until the first submission or upload is stored. After that the region is fixed.
