{
  "slug": "fillout",
  "category": "forms",
  "name": "Fillout",
  "description": "Online form, survey and quiz builder from Zite, with scheduling, payments and PDF generation. Form responses can be stored in the EU on request.",
  "website": "https://www.fillout.com",
  "license": null,
  "platforms": [
    "web"
  ],
  "jurisdiction": {
    "code": "US",
    "name": "United States",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "provider"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "F",
  "score": 34,
  "coverage": 100,
  "summary": "Fillout scores 34 out of 100 (grade F) on the forms and surveys criteria. It meets 2 of 8 criteria: no ads or data sales and TLS configuration. It partly meets independent audit and security headers. It does not meet open source, no trackers or telemetry, transparency report and tells users about requests. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade B+.",
  "url": "https://privacyratings.com/forms/fillout/",
  "markdown": "https://privacyratings.com/forms/fillout/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "no",
      "evidence": null,
      "note": "Closed source."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "no",
      "evidence": "https://www.fillout.com/help/subprocessors",
      "note": "The subprocessor list includes Amplitude for analytics, Segment as an event pipeline, and Sentry and Datadog for monitoring."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.fillout.com/privacy",
      "note": "Funded by paid plans. The privacy policy states that data is not sold and users are not tracked across other websites for targeted advertising."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://www.fillout.com/help/security",
      "note": "States SOC 2 Type 2 compliance, but no report is published."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "no",
      "evidence": "https://www.fillout.com/privacy",
      "note": "No transparency report is published. The privacy policy only says information may be shared with law enforcement to comply with legal process."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "No published policy on notifying users about data requests."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.ssllabs.com/ssltest/analyze.html?d=build.fillout.com&hideResults=on",
      "note": "Grade A"
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "partial",
      "evidence": "https://developer.mozilla.org/en-US/observatory/analyze?host=build.fillout.com",
      "note": "Grade B+ (80/100+)"
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "pending",
      "evidence": null,
      "note": "Not tested yet."
    }
  },
  "tests": {
    "ssllabs": "A",
    "observatory": "B+",
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": [],
    "tested_at": "2026-10-01T07:31:57.292Z"
  },
  "last_modified": "2026-10-01T07:44:20Z"
}