A form backend with EU data storage

What an EU-region account stores in the EU

Static Forms stores data in the United States (AWS us-east-1) by default. Accounts that select European Union data residency at signup have their form data — form submissions, file attachments, webhook delivery logs and AI reply logs — stored in AWS eu-central-1 (Frankfurt) instead, and that data is not stored in the United States.

Quoted from Section 8 of the Data Processing Agreement.

What is outside the EU for every account

EU data residency covers storage of form data only. For every account, whichever region it selects:

• Account data — your own user record (name, email, anonymized consent IP) and billing data — is stored in the United States (AWS us-east-1; Stripe).
• Transactional email — form notifications, auto-responders and AI replies — is delivered from AWS SES in the United States, with Singapore (AWS SES ap-southeast-1) configured as the regional failover. Email delivery is a transmission, not storage: AWS SES does not retain message content, though it does maintain a per-region suppression list of recipient addresses.
• Operational request logs — request metadata (IP address, user agent, referer, form field names, delivery status) but never form field values, as described in Section 3.5 — are stored with Axiom in the United States.

So an EU-region account is not "all data in the EU": the region covers where form data is stored.

Processing that can happen outside your storage region

• Default spam check. Selected, redacted form fields are evaluated by TypeSafe AI (Jev) through Vercel AI Gateway on every account, whichever region it selected. Inference may happen outside your storage region. Each form can switch to the classic filter (CleanTalk, EU data region) on every plan.
• AI Reply, only if you turn it on for a form, sends the submission to an AI model provider through Vercel AI Gateway in the US.
• Application hosting runs on Vercel, listed as a US sub-processor.

Transfers outside the EU/EEA rely on the EU Standard Contractual Clauses and, for certified providers, the EU-U.S. Data Privacy Framework, as described in DPA Section 8 and the Transfer Impact Assessment.

The spam check and the classic filter are described in Spam Filter.

Choosing the EU region

Pick the region on the signup page, above both the email and Google sign-up options. Until your account holds any form data, you can change it from the Account page in the app. Once the first submission or upload is stored, the region is fixed.

Forms submit to https://api.staticforms.dev/submit whichever region you choose, so the same HTML works in both. The quick start covers the form itself.

DPA, sub-processors and documents

• Data Processing Agreement: The binding terms, including the sub-processor list (Section 5) and international transfers (Section 8).
• Sub-processor change notifications: Advance notice of changes to the sub-processors, with an RSS feed.
• SCC Annexes I–III: The annexes to the Standard Contractual Clauses.
• Transfer Impact Assessment: The supplementary measures for transfers outside the EU/EEA.
• EU data residency and GDPR docs: The same facts in the documentation, with the region tables.
• Privacy Policy: How Static Forms handles your own account data.

Your responsibilities

Static Forms processes submissions on your behalf. You remain responsible for your own privacy notice, your lawful basis for collecting the data, and any consent your forms need.

This page describes where Static Forms stores and processes data. It is not legal advice; the binding terms are in the DPA.

FAQ