Data Processing Agreement

Last updated: May 1, 2026

When you use Instaform to collect form submissions or manage CRM data, you (or your organization) are the data controller for the personal information your respondents and contacts provide. Instaform acts as a data processor on your behalf. Under GDPR Article 28, that relationship requires a written agreement — a Data Processing Agreement (DPA).

DPA available on request

We provide a standard DPA that mirrors the European Commission's Standard Contractual Clauses (SCCs) and aligns with the structure used by major SaaS providers (Stripe, Vercel, Notion). It covers scope of processing, security measures, sub-processor approval, breach notification, audit rights, data subject assistance, and deletion at end of service.

How to request a copy

Email us at [email protected] with the subject "DPA request" and include your account email and your organization's legal name. We'll send you a countersigned copy within 5 business days.

The DPA references our subprocessor list, which is published and updated at /subprocessors.

Questions about the DPA, including custom terms for regulated industries, can be sent to [email protected].