# Formbricks privacy rating

Open-source survey and form platform for link, website and in-app surveys, from Formbricks GmbH in Germany. Available as a hosted cloud service or self-hosted with Docker.

**Our pick.** Open-source surveys and forms for links, websites and apps, as a replacement for Typeform, SurveyMonkey and Google Forms. Made by a company in Germany, with a hosted service or self-hosting with Docker.

## Summary

Formbricks scores 53 out of 100 (grade D) on the forms and surveys criteria. It meets 3 of 8 criteria: open source, no ads or data sales and TLS configuration. It partly meets independent audit and security headers. It does not meet no trackers or telemetry, transparency report and tells users about requests. It is based in Germany: Fourteen Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.

- Website: https://formbricks.com
- Source code: https://github.com/formbricks/formbricks
- Jurisdiction: Germany. Fourteen Eyes member. EU member (GDPR).
- Platforms: Web
- Home page trackers: Cloudflare Web Analytics (cookieless analytics), PostHog
- Category: [Forms and surveys](https://privacyratings.com/forms/)
- Grade: D (53/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | All code is public. The core is AGPL-3.0, and enterprise features in the ee directory of the same repository use a source-available commercial license. | https://raw.githubusercontent.com/formbricks/formbricks/main/LICENSE |
| No trackers or telemetry | No | The cloud service uses PostHog for product analytics and Sentry for error tracking. Self-hosted instances send telemetry unless it is disabled. | https://formbricks.com/privacy-policy |
| No ads or data sales | Yes | Funded by paid plans and enterprise licenses. The privacy policy states personal data is not sold. | https://formbricks.com/privacy-policy |
| Independent audit | Partial | Reports SOC 2 Type II compliance and annual penetration tests. The reports are only shared through its Trust Center. | https://formbricks.com/soc2 |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=app.formbricks.com&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=app.formbricks.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/forms/formbricks/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/forms/formbricks.md