Is Typeform Compliant for Swiss Businesses?

Typeform is the form tool people actually enjoy filling in, which is why it ends up carrying far more than the marketing survey it was bought for. The compliance question usually arrives late — after the lead-generation form has quietly become a client onboarding form, or after somebody points out that the HR team is collecting exit-interview answers in it. The answer is more nuanced than either side of the usual argument, and the nuances are not the ones most often cited.

For the head-to-head feature and pricing view, see Schweizerform vs Typeform. This article is the compliance question on its own.

What Swiss Law Actually Asks of You

The structure first, because it makes the rest easy to check. You are the controller; Typeform is a processor within the meaning of Art. 9 nFADP; you remain responsible for the processing regardless of how good the vendor is. Five obligations follow, and none of them requires Swiss hosting.

1. A processing agreement. Typeform publishes a data processing agreement as part of its terms. Locate it, save a dated copy, and record it — see do you need a data processing agreement for your form tool for what it must contain.
2. A documented basis for the disclosure abroad. EU/EEA states are covered by the Federal Council's adequacy list in Annex 1 to the Data Protection Ordinance, so an EU-hosted form is a lawful cross-border disclosure without further instruments. Where the chain reaches the United States, check whether the sub-processor is certified under the Swiss–U.S. Data Privacy Framework, recognised as adequate since 15 September 2024, or whether you need standard clauses. Detail in which form data can legally leave Switzerland.
3. Transparency under Art. 19 — the controller, the purpose, the recipients and the countries. «We use Typeform, which processes responses in the EU/United States» is the sentence most Swiss privacy notices are missing.
4. Proportionality under Art. 6 — the fields, again. This is the requirement that is failed most often and has nothing to do with the vendor.
5. Security appropriate to the risk under Art. 8, which for a marketing form is satisfied comfortably and for a whistleblowing form is not, for reasons set out below.

The Four Things Worth Checking Before You Scale Up

1. An EU company on US infrastructure

Typeform SL sits in Barcelona, which is a genuine advantage over a US-headquartered vendor: the company itself is not a US electronic-communication provider, so 18 U.S.C. § 2713 does not reach it by corporate structure. In practice, however, Typeform's infrastructure relies on US-based cloud providers and sub-processors, with its main servers historically in Virginia and an EU data centre offered alongside. That puts the CLOUD Act question at the sub-processor layer rather than removing it — a different, narrower exposure than a US vendor, and not zero. Read the sub-processor list rather than the imprint.

2. Regional hosting is a paid feature, not a default

EU data hosting is described in Typeform's documentation as part of its higher, custom tiers, and it comes with separate EU API endpoints. Two consequences follow. First, if you assumed EU residency because you are a European customer, verify it — the assumption is common and often wrong. Second, there is no Swiss option at all; the best available answer is the EU, which is lawful but is not what a procurement checklist asking for Swiss data residency is asking for. The full market picture is in our roundup of form and survey tools hosted in Switzerland.

3. The respondent side of the page

This is the part that is almost never in the compliance review, and it applies to any embedded or hosted form. When the form loads, what else loads with it — analytics, tracking, fonts, session tooling — and what does that place on the respondent's device before they submit anything? Cookie and tracking obligations attach to that layer, and in Switzerland the transparency duty covers it too. Run the browser's network inspector on your live form and list the hosts it contacts; it takes two minutes and it is the fastest way to find a disclosure you did not document. The wider version of this check is in which form tools are hosted in Switzerland.

4. Typeform can read every submission

Like nearly every mainstream form platform, Typeform encrypts data in transit and at rest with keys it manages. That is a real and sensible control against stolen hardware and misconfigured storage. It is not a barrier to the provider itself, its support tooling or its sub-processors. So the honest answer to «who can read this response» includes your team, Typeform's staff with production access, and its sub-processors. For a lead form, irrelevant. For a legal intake form, it is the whole question — and it is the one distinction that no contract changes, which we explain in encryption at rest vs end-to-end.

Where Typeform Is the Right Call — and Where It Is Not

The pattern in that table is worth stating directly: the constraint is almost never the law, it is the reader list. Typeform's compliance posture is solid enough that a Swiss company can use it lawfully for the top half of the table without doing anything clever. The bottom half fails for a reason that is architectural rather than contractual, and no amount of paperwork moves it.

If You Are Staying on Typeform, Do These Five Things

What Changes If You Move the Sensitive Forms

If the reader list is the problem, the only fix that works is architectural: end-to-end encryption, where the response is encrypted in the respondent's browser and only the key holder can decrypt it. The provider then holds ciphertext, its staff see ciphertext, a legal order to it produces ciphertext. Add Swiss hosting and the cross-border paragraph in your record gets shorter too.

The honest trade-offs: you lose provider-side features that require reading content, the conversational one-question-at-a-time experience Typeform is famous for is not the same, and a lost key means unreadable submissions with no recovery path. Most organisations end up splitting — keep the polished tool for the public-facing marketing forms where presentation drives conversion, and move the small number of forms that carry confidential content. That is scoping, not a migration project.

Bottom Line

Is Typeform compliant for Swiss businesses? For marketing and non-sensitive collection, yes — an EU company, an available processing agreement, and EU storage that is adequate under Swiss law without extra instruments. Do the paperwork once: DPA on file, sub-processors listed, Typeform named in the privacy notice, retention set, notifications stripped of answers.

The two things that are actually easy to get wrong are assuming EU residency you have not verified, and letting the tool drift from marketing into confidential intake. The second is where the answer changes — not because Typeform is careless, but because a provider that can read your submissions is inside your trust perimeter, and for some forms that is a property you need to remove rather than manage.