Jotform and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No for Jotform itself: the AI Terms of Use say Jotform will not use your data to train its AI or language models. Its outside AI providers (such as OpenAI) can train on data; Jotform makes no promise about them.

Vendor's wording: “We will not use your data to train our AI or language models.”

Source: jotform.comAI Terms of Use, data and privacy paragraphChecked on 20 October 2026

United States by default: form data is stored on servers in the United States, on Google Cloud (Iowa) and AWS (Virginia) data centres.

Vendor's wording: “Form data is stored on servers located in the United States.”

Source: jotform.comInformation we collect, From Our CustomersChecked on 19 October 2026

EU hosting available.

Yes. Customers can switch storage to EU servers in Frankfurt, Germany (run by Google) in the Data tab of account settings; the account then moves to eu.jotform.com. Not stated whether every plan has it.

Vendor's wording: “You can store your data in the EU by enabling the appropriate option in the Data tab of your account settings.”

Source: jotform.comStore data in the EUChecked on 19 October 2026

DPA on request.

Yes. A Jotform-pre-signed Data Processing Addendum is available self-serve; the customer adds an electronic signature and it is sent to Jotform automatically.

Vendor's wording: “a Data Processing Addendum (DPA), which is a self-serve and easy-to-execute document pre-signed by Jotform. It only requires an electronic signature from the user.”

Source: jotform.comSign a DPAChecked on 19 October 2026

Published.

Yes, public at https://www.jotform.com/subprocessors/ with 7 entries (Amazon Web Services, Deepgram, ElevenLabs, Google, HubSpot, OpenAI, Twilio). AI providers: OpenAI, Google, Deepgram, ElevenLabs.

Vendor's wording: “Processing regions vary by sub-processor and service”

Source: jotform.comJotform Subprocessors tableChecked on 19 October 2026

On the list.

Active (Jotform Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Jotform'Checked on 19 October 2026

Account personal info is kept while the account exists; after closing and unpublishing forms it is deleted after one month, and inactive accounts are held encrypted for one more year then deleted. Backup snapshots are kept 30 days.

Vendor's wording: “If you close your account and make your forms publicly unavailable through your account dashboard, your personal info will be deleted after one month.”

Source: jotform.comHow long we retain your informationChecked on 19 October 2026

PCI DSS Service Provider Level 1 is named. SOC 2 certification applies only to the dedicated Enterprise environment; other plans are 'aligned' with SOC 2. No ISO 27001 is named. StateRAMP is in a snapshot programme.

Vendor's wording: “Jotform’s dedicated environment aligns with the five SOC 2 Trust Service Principles: security, confidentiality, availability, privacy, and processing integrity.”

Source: jotform.comSOC 2 Compliance / PCI CertificationChecked on 19 October 2026