Formaloo
Formaloo is a no-code platform for building AI-assisted forms, surveys, client portals, PDFs, e-signatures, approval workflows and dashboards. Used by more than 35,000 organizations, it is EU-hosted by default and aimed at regulated teams.
What is Formaloo?
Formaloo is an operations platform published by the Canadian company Formaloo Solutions Inc., with offices in Toronto, Tallinn and London. It began as a form builder and grew outwards into surveys, client portals, databases, dashboards, documents, applications and automated workflows. In 2026 the company repositioned the product as Formaloo OI, for Operations Intelligence, organized around three verbs: Collect, Understand, Act. Its own framing draws the line against traditional analytics: business intelligence reports what happened, while operations intelligence is meant to make the right thing happen next.
Four products sit at the core. The form builder offers more than fifty field and block types, conditional logic, branching, variables, calculations, formulas, scoring, answer piping and multiple endings. Client portals give customers, patients, students or partners a login and a place to manage their own records. The custom PDF builder turns submissions into quotes, agreements, reports and certificates. Approval workflows push requests through teams, statuses, signatures and admin review.
The AI layer, Formaloo AI, runs across all of it. Magic Formula builds a form or workflow from a single instruction. An AI Question Bank drafts survey questions, AI-powered logic sets conditions and calculations, autofill works from voice or a stored profile, and Magic Rewrite edits labels and questions in place. On the analysis side the AI summarizes open-text feedback, surfaces trends and drafts follow-up emails from responses.
What separates Formaloo from a pure self-serve tool is the human layer beside it. The company pairs the platform with forward-deployed engineers who work alongside a customer's business, IT and security teams, and offers a Concierge service that builds the use case directly inside the customer's workspace.
Compliance is a stated priority: EU hosting by default, HIPAA and PCI DSS requirements referenced, SSO/SAML, audit controls and a self-hosted option. Formaloo claims more than 35,000 organizations across 100+ countries, over a million live forms and apps, 99.99% uptime and a 4.7/5 rating from more than a thousand reviews.
What it does
- Generate a working form, portal or workflow from a plain-language prompt
- Route requests through multi-step approvals, statuses, assignments and escalations
- Produce quotes, contracts, reports and certificates as customized PDFs from submissions
- Collect and store legally binding electronic signatures without a volume cap
- Open a branded client or employee portal with granular, per-folder permissions
- Summarize open-text answers and visualize responses in real-time dashboards
- Take payments and recurring subscriptions through Stripe, Square or PayPal
When to use Formaloo / When not to
A quick filter to help you decide if Formaloo is the right fit.
When to use Formaloo
- Operations and administration teams that want intake, approvals, documents and reporting to live in one connected process rather than in five disconnected tools.
- Healthcare and clinical administration staff handling patient intake, consent forms and referrals, who need HIPAA-ready handling and EU data residency.
- HR and people teams building job application forms, applicant tracking, employee evaluations and internal portals without waiting on IT.
- Agencies, consultants and small studios that need white-labelled forms, branded client portals and auto-generated proposals under their own domain.
- Education administrators running enrolment, assessments, parent communication and student feedback across a whole academic lifecycle.
When not to use Formaloo
- Teams that need a native mobile app: no App Store or Google Play listing appears anywhere on the site, and the platform is web-first.
- Buyers who require a published subprocessor list before signing, since Formaloo keeps that list inside the DPA document rather than on a public page.
- Organizations whose AI governance policy demands a written commitment on model training, which Formaloo does not publish either way.
- Larger collaborative teams on a small budget, because the Free and Pro tiers include only one team seat and Business only three.
- Buyers who need SSO/SAML, advanced audit controls, HIPAA workspaces or self-hosting on a published price, as all of these sit in the quote-only Enterprise tier.
How to use Formaloo
A typical end-to-end flow, from setup to results.
- Create a free account at formaloo.com; no credit card is required and the free tier is permanent
- Choose a starting point: describe what you need to Formaloo AI, or pick one of the ready-made templates across eighteen categories
- Let the AI generate the fields, logic and styling, then refine them in the editor
- Add conditional logic, variables, calculations, scoring and multiple endings where the process needs them
- Connect a PDF or SmartDoc template if the submission must produce a quote, contract, report or certificate
- Set up the approval workflow: routing rules, statuses, assignees, escalations and notifications
- Publish on the dedicated formaloo.com subdomain, or connect your own domain from the Business tier
- Embed the form in an existing site, with documented routes for Webflow, Wix, Squarespace, WordPress and Coda
- Connect the rest of your stack through premium integrations such as HubSpot, Slack, Zapier, Make or n8n, or go direct with the API, SDK and webhooks
- Organize the workspace by team, department, client or project and set per-folder permissions before inviting collaborators
Pros & Cons
Pros
- Unlimited forms, apps and monthly submissions on the permanent free plan, with no credit card required
- Unusually wide scope for one product: forms, portals, documents, signatures, approvals, dashboards and a custom CRM in a single platform
- EU data residency by default, with local residency, private cloud and fully self-hosted options for stricter requirements
- Readable compliance posture: GDPR DPA, CCPA/CPRA addendum, HIPAA handling and independent third-party audits
- Solid published security practice: 256-bit TLS in transit, 256-bit AES at rest, semi-annual third-party penetration tests and daily encrypted backups
- Low paid entry point against the competitors the site itself benchmarks: $19/month versus $25 for Typeform, $20 for Jotform and $34 for Qualtrics
- Discounts of up to 50% for educators, non-profits and startups, plus up to $1,000 in credits for eligible startups, and a no-questions 14-day refund
Cons
- Only one team seat on both the Free and Pro plans, and three on Business, which makes real collaboration an upgrade decision early
- The features enterprises look for first — HIPAA workspaces, SSO/SAML, advanced audit controls, self-hosting, Enterprise API — are all quote-only
- No native mobile app is discoverable: neither an App Store nor a Google Play listing appears on the site
- No support email address is published; the only documented channels are the help center and live chat
- The subprocessor list is not public and lives inside the DPA document, which is itself reserved for enterprise customers
- Nothing is published about whether customer data is used to train AI models, and no opt-out is documented
- The legal documents collected are dated late 2023 while the product repositioned in 2026, and the Estonian office address differs between the contact and about pages
Pricing & Plans
Formaloo offers a permanent free plan, described on the pricing page as free forever and available without a credit card, which already includes unlimited forms, apps and monthly submissions. The lowest paid entry point is the Pro plan at $19 per month. The Business plan is shown at $29 per month against a $38 reference price, and the Enterprise plan is quoted individually. Amounts are displayed with a dollar sign only, without an ISO currency code, and the pricing FAQ notes that transactions are supported in a range of currencies. Annual billing is advertised as saving 25%, and a full refund is available within 14 days.
- unlimited forms
- apps and monthly submissions
- 50+ field and block types
- conditional logic and calculations
- dedicated subdomain
- 1 team seat
- 1 GB storage
- everything in Free plus workflows
- custom PDFs and SmartDocs
- unlimited e-signatures
- partial submissions and auto-save
- payments via Stripe
- Square or PayPal
- webhook/API/SDK access and premium integrations
- 1 team seat
- everything in Pro plus branding removal
- unlimited custom domains
- custom CSS and JS
- collaborative workspaces
- multi-step approvals
- white-label emails
- instant backup
- 3 team seats
- everything in Business plus the self-hosted option
- SAML/SSO and user provisioning
- advanced audit controls
- HIPAA compliance
- Enterprise API
- dedicated 24/7 customer success
- local data residency
- AI admin controls and revision history
Data, GDPR & hosting
A consolidated view of how Formaloo handles your data.
GDPR overview
GDPR compliance is claimed explicitly and documented on a dedicated page. Concrete commitments are named: EU data residency by default for forms, files, databases and backups; independent third-party audits; a GDPR-compliant Data Processing Addendum for enterprise customers plus a CCPA/CPRA Service Provider Addendum; and support for access, rectification, deletion, portability, objection, restriction and consent withdrawal. Transfers outside the EEA rely on Standard Contractual Clauses under Article 46 and on adequacy decisions under Article 45. Governance is handled through fifteen access levels, multi-tenancy and permissions by department, team and project. Two caveats: no Article 27 EU representative is named, and no certification or audit report is published to back the claims. The privacy policy carried is version 2.1, dated 1 November 2023.
Who owns the data?
The customer owns the data. Formaloo's privacy policy states plainly that form data belongs to the account holder and is treated as private information, and that Formaloo will access it only after written permission is given, in order to resolve a technical issue. Whoever creates a form is the responsible party for the data it collects; Formaloo positions itself only as a processor acting on that creator's behalf, and as a Service Provider under CCPA/CPRA that neither sells nor shares personal information. Under Formaloo Enterprise (Self-Hosted) the separation is stricter still: the data sits in the customer's own database and Formaloo states it holds no copy and no access.
Reuse rights
As the owner of the submissions, the customer may reuse, export, delete or deactivate their own data at any time without asking Formaloo, and several export and integration routes are offered. Formaloo's own use of the data is narrower and enumerated: answering enquiries, providing support, analysing site usage, tracking service use, notifying account and product changes, offering new products, and suspending or terminating an account. Aggregate 'collective learnings' about how the services are used feed troubleshooting and trend analysis. Data may be shared with vendors and service providers for hosting, backup, storage, payment processing, analysis and security, and in a business transfer or when legally compelled. Payment card numbers are handled by a third-party processor and never stored by Formaloo. Responsibility for the lawfulness of what is collected sits with the form's creator, not with Formaloo.
Data retention & training
Hosting summary
Formaloo hosts in the European Union by default. The GDPR page states that all data — forms, databases, files and backups — sits on EU-based infrastructure, and the site footer repeats that the platform is EU-hosted by default with flexible data residency options. No specific country and no cloud provider is named, so the jurisdiction is stated at regional level only. Three alternatives exist: local data residency, private cloud, and Formaloo Enterprise (Self-Hosted), where the platform runs on the customer's own servers and Formaloo states it stores nothing and has no access. Data is encrypted with 256-bit SSL/TLS in transit and 256-bit AES at rest, production data is backed up daily to a separate isolated encrypted location, and independent third parties run penetration tests twice a year. One technical caveat: the public domain resolves to a Cloudflare anycast node in the United States, which reflects the CDN edge and says nothing about where application data actually lives.
Things to keep in mind
Risks and trade-offs to weigh before adopting Formaloo.
- The legal documents collected are dated late 2023 (privacy policy 2.1 of 1 November 2023, security page 2.1 of 1 December 2023) while the product repositioned as Formaloo OI in 2026: check they are current before you rely on them.
- Nothing is published about whether customer data is used to train AI models, and no exclusion option is documented, so an organization with an AI governance policy has to ask directly.
- The subprocessor list is not public: it exists only inside the DPA document, which is itself presented as reserved for enterprise customers and signed through support.
- HIPAA compliance and PCI DSS are claimed without any published audit report or certification, and no SOC 2 or ISO 27001 certificate is mentioned anywhere on the site.
- Because the platform makes it trivially easy for any team member to collect sensitive data, the practical risk shifts to governance: whoever creates a form is the responsible party, not Formaloo, and permissions must be set deliberately.
- Letting AI draft the questions, the logic and the follow-up emails is fast, but it invites teams to stop scrutinizing what they are actually asking respondents and why — review AI-generated fields before publishing anything that touches personal or medical data.
- The Business price is displayed with a 45% discount against a $38 reference; promotional pricing can end, and no EU Article 27 representative is named should you need a European point of contact.
Setup & Integrations
Technical difficulty
Low for standard use. Sign-up is free and immediate with no credit card, a complete form can be generated from a single AI prompt, and publishing on the dedicated Formaloo subdomain needs no configuration. Connecting other tools is equally light through Zapier, Make or n8n, with an API, SDK and webhooks from the Pro plan for technical teams. Difficulty rises only at the Enterprise end, where self-hosting and SSO/SAML involve the customer's own IT and security teams, and even there forward-deployed engineers and a Concierge service can take the build on.
Deployment
Integrations
Behind Formaloo
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Formaloo.
Frequently asked questions
Does Formaloo have a genuinely free plan?
How much does the cheapest paid plan cost?
Where is my data hosted?
How long does Formaloo keep my data?
Is Formaloo GDPR and HIPAA compliant?
Does Formaloo offer an API?
Is there a minimum age to use Formaloo?
Does Formaloo train AI models on my form data?
Are there discounts or a refund policy?
Should you pick Formaloo?
Formaloo has quietly stopped being a form builder, and says so itself. What it now sells is a single place where a request is collected, understood and acted on: the form, the logic, the approval chain, the generated document, the signature, the portal and the dashboard all belong to the same product. For an operations, HR, clinical administration or education team currently stitching four subscriptions together, that consolidation is the real argument, and the free tier is generous enough — unlimited forms and unlimited monthly submissions — to test it seriously before paying anything.
The compliance posture is the second argument, and an unusually legible one for a tool at this price. EU hosting by default, a GDPR data processing addendum, a CCPA/CPRA addendum, HIPAA-oriented handling, 256-bit encryption in transit and at rest, semi-annual third-party penetration tests, and a self-hosted option for organizations that will not put data anywhere else. Few products at $19 a month put that much on the table.
The reservations are equally clear. Seats are scarce at the bottom of the range — one on Free and Pro, three on Business — so a growing team hits an upgrade quickly. Everything a regulated buyer actually needs to sign, from SSO to HIPAA workspaces to self-hosting, sits behind a quote. The subprocessor list is not public. Nothing at all is published about whether customer submissions feed AI model training, which is an awkward silence for a product that leads with AI. And the legal documents on file are dated late 2023, two years before the repositioning they are supposed to cover.
Worth a serious trial if you run structured processes in a regulated setting and want one system instead of five. Read the DPA and ask the training question directly before you commit.
- Choosing a selection results in a full page refresh.
- Opens in a new window.