Subprocessors
Every third party that can touch data, what it does, and where it runs.
Last updated
To run CrispForms we rely on the services below. Each is bound by a data processing agreement, and each receives only what it needs to do its job.
| Service | What it does | Data | Location |
|---|---|---|---|
| Vercel | Application hosting, CDN and edge routing | All request data in transit | United States, global edge |
| Neon | Managed PostgreSQL — the primary database | Account data, forms, responses | United States |
| Vercel Blob | Storage for files uploaded through forms | Respondent file uploads | United States |
| Resend | Transactional and notification email delivery | Email addresses, email content | United States |
| Dodo Payments | Payment processing and merchant of record | Billing name, email, country, card data (handled entirely by them) | United States |
| Google sign-in, and Google Sheets when you connect it | Name, email, profile image; response data you map to a sheet | United States | |
| Cloudflare | Turnstile spam protection, when a form owner enables it | A challenge token; no personal data | Global |
| Anthropic | AI summaries of open-text answers, when a Pro user enables it | Only the text answers being summarised | United States |
Vendors we deliberately do not use
We do not load advertising networks, session-replay tools, or third-party analytics on published forms. That is why your respondents never see a cookie banner from us.
Changes
We’ll update this page before a new subprocessor starts handling customer data. Email hello@crispforms.com to be notified of changes.