Legal
Sub-processors, listed openly.
To run SureForm we rely on a small number of vendors. Where any of them could touch personal data we process on your behalf, they are a sub-processor and they belong on this page. We keep the list short on purpose — every name here is one more company that has to earn your trust as well as ours.
What a sub-processor is
When you build a form with SureForm, you are the controller of the responses and we are your processor. A sub-processor is a company we engage that may in turn process that data — a hosting provider running the database your responses live in, for example.
Every sub-processor on this page is bound by a written contract with data protection terms no less protective than our DPA, and we stay fully liable to you for what they do. We publish this list so you can complete your own vendor review without having to ask us for it.
Current sub-processors
| Provider | Purpose | Data it may process | Location |
|---|---|---|---|
| DigitalOcean, LLC | Application and database hosting for the SureForm app and hosted forms | Response data, account data, uploaded files | United States |
| Hostinger International Ltd | Hosting for our public marketing website | Server request logs only — no response data | European Union |
| Stripe, Inc. | Billing and payment processing for SureForm subscriptions and credits | Your billing contact and payment metadata — no response data | United States |
Card numbers are never stored on our servers: payment fields go directly to the payment provider.
Who is not a sub-processor
Two things people expect to find here, and why they are absent:
- Stripe and PayPal on your forms. When you collect payments through a form, you are the merchant of record and the funds go straight to your own connected account. Those providers are your processors, under your agreement with them — not our sub-processors. Stripe appears in the table above only because we also use it to bill you.
- Integrations you switch on. If you connect SureForm to a third-party tool, you are instructing us to send data there. That vendor is your processor, chosen by you, and is governed by your agreement with them. Turning an integration off stops the transfer.
We do not use advertising networks, data brokers, or cross-site trackers anywhere in the Service.
How we notify you of changes
Before we add or replace a sub-processor, we update this page and give at least 30 days' notice to the admin contact on every affected workspace. The “Last updated” date above always reflects the current version.
To receive these notices at a dedicated address — a compliance inbox rather than a person — email [email protected] and we will add it to the notification list.
How to object
If you have a reasonable data protection objection to a new sub-processor, tell us at [email protected] within the 30-day notice period and explain the concern.
We will work with you to find a reasonable alternative. If we cannot, you may terminate the affected part of the Service and we will refund prepaid, unused fees for the remainder of the term. You will never be moved onto a new sub-processor mid-notice-period while an objection is open.
Contact
Questions about this list, or a vendor review that needs more detail than this page gives: [email protected]. Privacy questions: [email protected].
Legal notices: Purple SaaS, LLC (DBA SureForm), Attn: Legal, 30 N Gould St Ste R, Sheridan, WY 82801, USA.