Framer
Partially CompliantDutch website and landing page builder with a design-tool interface, hosting all services on AWS in the United States.
Subject to the US CLOUD Act: a US provider in this tool's processing chain can be compelled to disclose data it holds, including data stored in the EU. The vendor itself is European-owned.
Freemium
GDPR Compliance Data
Not independently verified| GDPR Status | Partially Compliant |
| HQ Country | Netherlands |
| Ownership | European-owned |
| Foreign Disclosure Exposure | US CLOUD Act / FISA 702 |
| Data Hosting Location | United States"All of Framer's services are hosted in Amazon Web Services (AWS) facilities in the United States". Source: framer.com/legal/security (read 2026-08-24). Data at rest is stated to be in AWS Aurora, DynamoDB, ElastiCache and S3. |
| EU Servers Available | |
| Data Processing Agreement | Not verified |
| Sub-processor List | Not verified |
| Schrems II Risk | High Risk |
| SCCs in Place | |
| Last Verified | 24 August 2026 |
How we reached this
Framer B.V. is incorporated in the Netherlands, Dutch Chamber of Commerce number 59920637, per the privacy statement. EU-owned with no foreign parent. Hosting is the problem: the security page states all services run in AWS facilities in the United States, and no EU region is offered. Personal data collected through a Framer site, including form submissions, is therefore transferred to the US and held by a US provider, so exposure is US_CLOUD_ACT and Schrems II risk is HIGH. The privacy statement provides for transfer SCCs with a UK addendum, so the transfer has a documented basis, which is why sccInPlace is true. No DPA was located at a public URL. GDPR status is PARTIAL: the transfer is documented but there is no way to keep EU data in the EU.
About Framer
A Design Tool That Publishes
Framer's premise is that the design file is the website. Layout, components, interactions and breakpoints are edited directly and published to a live CDN, which removes the design-to-development handoff that slows most landing page work.
For marketing teams that means changing a hero, shipping a campaign page or running a variant without a developer in the loop. CMS collections cover blogs and case study libraries, and forms, analytics and A/B testing are built in.
Dutch Company, American Servers
Framer B.V. is "an entity incorporated under the laws of the Netherlands and registered in the Netherlands with the Dutch Chamber of Commerce under registration number 59920637", per its own privacy statement. European ownership, no foreign parent.
The hosting is the other half of the picture, and Framer states it plainly on its security page: "All of Framer's services are hosted in Amazon Web Services (AWS) facilities in the United States." Data at rest lives in AWS Aurora, DynamoDB, ElastiCache and S3.
There is no EU region on offer. For an EU controller, personal data collected through a Framer-built site, form submissions in particular, is transferred to the United States. Framer's privacy statement provides for transfer SCCs and a UK addendum, so the transfer has a documented legal basis, but the data is in a US data centre held by a US company and reachable under the CLOUD Act.
Where That Lands
If a Framer site is brochureware with no form, the exposure is limited to visitor analytics. If it is a lead capture page for an EU audience, the submissions are going to the United States and that needs to appear in the record of processing activities and the privacy notice.
Fully EU-hosted alternatives are listed under landing pages.
Key Features
Pros & Cons
Categories
Framer GDPR & data protection: common questions
Is Framer GDPR compliant?
Partly. Framer meets some of the requirements, with caveats worth reading before you commit. Framer is a European company headquartered in Netherlands, data is hosted in the United States.
Where does Framer store data?
Framer states: ""All of Framer's services are hosted in Amazon Web Services (AWS) facilities in the United States". Source: framer.com/legal/security (read 2026-08-24). Data at rest is stated to be in AWS Aurora, DynamoDB, ElastiCache and S3.". Data is hosted in the United States.
Does Framer offer a Data Processing Agreement (DPA)?
We could not locate a published DPA for Framer. That does not mean one is unavailable. Many vendors provide it on request or inside the account area rather than publishing it. Ask before you sign.
What a DPA has to cover →Is Framer a European company?
Yes. Framer is headquartered in Netherlands and, as far as we can establish, European-owned.
Is Framer subject to the US CLOUD Act?
Indirectly. Framer itself is European-owned and headquartered in Netherlands, so the company is not subject to US jurisdiction. The exposure runs through a US provider in its processing chain, a host, CDN or other sub-processor, which can be compelled to disclose data it holds even when that data sits on EU servers. That is a narrower exposure than a US-owned vendor, and the compliance notes above say which provider it is. Standard Contractual Clauses are in place for transfers, which is the required safeguard but does not override a lawful US order.
Schrems II compliance checklist →Related Tools
GetResponse
All-in-one email marketing and automation platform from Poland.
Landingi
Polish landing page builder with 400+ templates, A/B testing, and conversion analytics.
Heyflow
German no-code platform for interactive lead funnels and multi-step conversion pages.
Spotted something wrong?
Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.
If you work at Framer and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.