Formspree

United States · formspree.io · 26 vendors

Formspree is a service that provides a backend for website forms, enabling developers to create custom, functional forms without writing server-side code. It handles form processing, spam filtering, data validation, and email notifications. The service also offers integrations with various third-party applications.

Resilience scores

Disruption prediction

Formspree has an estimated 11% probability of disruption in the next 6 months.

18 of Formspree's 26 vendors monitored for disruptions.

Technology vendors

Services catalogue

3 services in catalogue across 1 category; runs on 26 sub-vendors.

Insights

Last updated 2026-08-03 · revision 1

26 direct vendors, 302 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Formspree exhibits a high degree of migration readiness due to its modern and cloud-native internal tech stack, built on Amazon Web Services (AWS) and utilizing contemporary languages like Python, TypeScript, and JavaScript, along with React for front-end development. The use of GitHub Actions for CI/CD further indicates agile and automated deployment capabilities, which are beneficial for migration. The company's existing compliance with GDPR/CCPA frameworks and SOC 2 Type II audited infrastructure means that many regulatory hurdles for data handling are already addressed. The architecture, with products like a 'Form Backend' and 'API,' suggests a modular design that would facilitate easier migration. However, there are critical gaps in the available data that prevent a fully confident assessment. Specifically, data residency requirements are not specified, which could introduce significant complexity and cost if strict localization is needed. Furthermore, the absence of financial stability data (revenue concentration, growth history) makes it impossible to assess the company's capacity to fund a potentially large-scale migration. While Formspree uses 13 vendor services from three geographically diverse countries, the 'Vendor Lock-in Risk' is unknown, which could pose challenges depending on the nature and criticality of these services and their contractual terms.

Compliance

5 in-scope frameworks identified; showing 3.

SOC 2 (source) — Compliant

Formspree has achieved SOC 2 Type II certification, audited by an independent third-party auditor certified by the AICPA. SOC 2 Type II is the most rigorous level of SOC 2 compliance, covering the design and operating effectiveness of controls over a defined period (typically 6–12 months). This significantly reduces risk for cloud service provider compliance. Risk is Low because: (1) the company has completed a formal third-party audit; (2) SOC 2 Type II covers the Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy); (3) the AICPA logo is displayed on the security page confirming the audit relationship. The audit report is available upon request, which is standard practice.

Evidence: https://formspree.io/security/, https://formspree.io/

ISO 27001 (source) — Assessment Required

ISO 27001 is an internationally recognized information security management standard highly relevant to cloud service providers like Formspree. The company has not publicly disclosed ISO 27001 certification on its security page or website. However, Formspree has achieved SOC 2 Type II, which covers overlapping security controls. The absence of ISO 27001 certification is a gap for enterprise customers, particularly those in the EU or regulated industries that require ISO 27001 as a vendor prerequisite. Risk is Medium because: (1) the company processes personal data at scale (1M+ users, 5M+ submissions/month); (2) ISO 27001 is increasingly required by enterprise procurement; (3) the lack of certification may limit Formspree's ability to serve regulated enterprise customers; (4) however, SOC 2 Type II partially mitigates this risk by demonstrating independent security control validation.

Evidence: https://formspree.io/security/

GDPR (source) — Compliant

Formspree is a US-based company that explicitly processes personal data on behalf of its global customer base, including EU/EEA residents who submit data through forms hosted by Formspree's customers. As a data processor, Formspree is subject to GDPR obligations. The company publicly claims full GDPR compliance and relies on Standard Contractual Clauses (SCCs) for cross-border data transfers. Risk is rated Medium rather than Low because: (1) Formspree processes form submission data that may contain sensitive personal information from EU residents; (2) all data is hosted on AWS in the United States, meaning cross-border transfers are inherent to the service; (3) while SCCs are in place, enforcement of GDPR against US-based processors has intensified since Schrems II; (4) the company does not publicly disclose a formal DPO appointment or a detailed GDPR audit report, limiting independent verification. Risk is not High because the company has made explicit public compliance commitments and has implemented SCCs.

Evidence: https://formspree.io/security/, https://formspree.io/legal/privacy-policy/

Financials

Three-year financials

Financial Resilience Score: 7/10

Formspree, Inc. is a bootstrapped, privately held US SaaS company that has operated since 2015 without disclosed institutional venture funding. Its longevity of approximately 10 years past the typical SaaS failure window, combined with continued product investment and expansion, strongly suggests the business is at minimum cash-flow-neutral and likely profitable. The subscription-based recurring revenue model, meaningful scale (1M+ users, ~5M submissions/month), and enterprise-grade compliance posture (SOC 2 Type II, GDPR, CCPA) support a stable financial profile with predictable MRR/ARR and reduced enterprise sales friction. However, financial resilience cannot be fully verified due to complete opacity — no audited financials, revenue figures, EBIT, or equity data are publicly available since the company is a private US corporation not subject to public register requirements. The competitive landscape is intense with numerous rivals (Typeform, Netlify Forms, Tally, Fillout, Web3Forms) and commoditization risk from AI-generated backend code and built-in form features in platforms like Webflow and Vercel. Being bootstrapped also means Formspree lacks a large defensive war chest for aggressive competitive responses or downturns, and small-team concentration creates key-person risk. On balance, qualitative signals point to a stable, profitable small SaaS, but the lack of transparency and structural competitive risks warrant a moderate-to-good resilience score rather than a top-tier rating.

Key strengths: Bootstrapped and self-funded since 2015 with no known outside VC dilution or debt disclosures, 10-year operating history, well past typical SaaS failure window, Meaningful scale: 1M+ users and ~5M form submissions per month, Recurring subscription SaaS revenue model yielding predictable MRR/ARR, Fortune 500 customers among user base, supporting enterprise-tier ARPU, SOC 2 Type II, GDPR, and CCPA compliance reduces enterprise sales friction, Low fixed overhead from remote-first distributed small team, Active product development with recent integrations (Cloudflare Turnstile, ActiveCampaign, @formspree/ajax)

Risk factors: Complete financial opacity — no audited financials or revenue disclosure, Intense competition from Typeform, Netlify Forms, Tally, Fillout, Web3Forms, and platform-native form features, Commoditization risk from AI-generated backend code and free tiers of larger platforms, Dependency on email deliverability and third-party cloud infrastructure vendors, Small team creates key-person concentration risk, Bootstrapped model limits war chest for defensive competitive responses or downturns, Limited pricing power in a crowded form-backend niche

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report