DISCLAIMER: This page is for information only. It is not legal, financial or procurement advice and does not replace your own due diligence. Licenses, ownership, features and certifications can change: confirm what your decision rests on with the official sources.
🩺 Vitals
- 🟢 Last active: 2026-10-26
- 📦 Latest release: v3.19.1 (2026-10-20)
- 🐞 Open issues: 13
- 🌟 Stars: 10.6k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent stable version the maintainers published as a release on the forge. Some healthy projects publish only tags, or publish their versions elsewhere.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: typebot.io
- Source: github.com/baptisteArno/typebot.io
- License: Functional Source (FSL-1.1-Apache-2.0)
- Deployment: Docker | SaaS
- Data Model: PostgreSQL
- Jurisdiction: France 🇫🇷 / EU 🇪🇺 (TYPEBOT SAS)
- Compliance (SaaS): ISO 27001 (Audited) | GDPR (Self-Assessed)
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Moderate (3/5) - Two Next.js apps (builder and viewer) + PostgreSQL, plus Redis in the shipped Compose file (optional per the docs); S3-compatible storage for media uploads such as images and videos
- Maintenance: Moderate (3/5) - Next.js/PostgreSQL updates and schema migrations
- User Management: Moderate (3/5) - Self-hosted has workspace member roles (RBAC); SSO through Keycloak or a custom OAuth / OpenID Connect provider, set by environment variable; no native audit log
1. The Executive Summary
What is it? Typebot is a conversational form and chatbot builder developed by TYPEBOT SAS, a company incorporated in France. It replaces static form UX with a step-by-step chat interface, collecting lead qualification data, scheduling, file uploads, and survey responses through a drag-and-drop flow builder. Responses go to a PostgreSQL database and respondents' file uploads to an S3-compatible bucket, both under the operator's control. The tool is source-available under the Functional Source License (FSL-1.1-Apache-2.0), not OSI-certified open source, with each release converting to Apache 2.0 two years after publication. The self-hosted build includes every feature, SSO and the WhatsApp Business integration among them, and serves bots on the operator's own domain; the paid plans belong to Typebot's hosted service.
The Strategic Verdict:
- 🔴 For Simple Data Collection: Overkill. Standard form requirements are better served by a lighter tool. The conversational interface adds deployment complexity that only pays off when completion rate or lead qualification quality is the primary metric.
- 🟢 For EU-Regulated High-Touch Funnels: Strong Buy, self-hosted. The self-hosted build keeps form data on infrastructure you control, so Typebot never holds it and your own hosting decides which law reaches it. Unlimited responses and self-hosted data ownership at zero licence cost make it the structurally superior choice for GDPR-sensitive lead generation and customer onboarding flows.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Typeform (SaaS) | Typebot (Self-Hosted) |
|---|---|---|
| Response Limits | Strict monthly caps | Unlimited (PostgreSQL storage) |
| Branding Removal | Paid tier required | Not gated (the operator sets the default workspace plan) |
| WhatsApp Integration | Expensive add-on | Not gated (the operator sets the default workspace plan) |
| Custom Domain | Paid tier required | Not gated (bots are served on the operator's own viewer domain) |
| Data Residency | Typeform-managed cloud | 100% owned (self-hosted) |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: The shipped Docker Compose file runs two Next.js apps, the builder and the viewer, with PostgreSQL as the primary data store and Redis alongside (the docs call Redis optional). File upload flows additionally require an S3-compatible storage bucket (AWS S3, MinIO, or equivalent). This dependency adds infrastructure overhead compared to simpler form tools and should be provisioned before production deployment.
- Builder: The visual flow editor runs entirely in the browser. Flows are composed from typed blocks (text, input, logic, integrations) and can be embedded as a web widget, full-page experience, or deployed directly to WhatsApp Business through the WhatsApp integration.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Geopolitics (France 🇫🇷 / EU 🇪🇺): TYPEBOT SAS is incorporated in France. Its managed service runs on third-party clouds: Typebot's published sub-processor list includes US-domiciled providers, and Typebot's privacy policy places processing primarily, not only, in the UK and the European Economic Area. The CLOUD Act reaches data in a US provider's possession, custody or control wherever it is stored, so French incorporation does not by itself remove that exposure for data in the managed service. Self-hosted, the question is moot: Typebot holds no data, and the operator's hosting decides the jurisdiction.
- The Compliance Shift: TYPEBOT SAS holds an ISO/IEC 27001:2022 certificate from an independent certification body, with a scope that covers the development and operation of its chatbot builder platform. HIPAA and SOC 2 are not claimed or verified. Do not use these as procurement arguments. For self-hosted instances, the full compliance posture transfers to the operator: infrastructure hardening, database encryption at rest, and network access controls are the deploying organisation's responsibility. GDPR data retention for self-hosted deployments is the operator's obligation: Typebot's API deletes a bot's results, chosen by ID or all at once, and the operator decides when to run it.
- License Risk (FSL-1.1-Apache-2.0: Source-Available, Not OSI Open Source): The Functional Source License prohibits using Typebot to provide a competing managed conversational form or chatbot service. Internal enterprise use (deploying Typebot for your own lead generation, customer onboarding, or team workflows) is explicitly permitted. Each release converts to Apache 2.0 two years after its release date, providing a clear and contractually defined path to fully permissive status for older versions. For standard enterprise deployment the risk is low; any organisation considering building a product or resale service on Typebot's infrastructure must complete legal review of the FSL competition clause before committing.
4. Market Landscape
🏢 Proprietary Incumbents
- Typeform: The design-first form and survey platform, the primary migration source for Typebot adopters. Response limits, per-seat pricing at scale, and submission data held on Amazon Web Services servers in the US by default (EU hosting only on selected plans) are the primary drivers for switching to a self-hosted, unlimited-response alternative.
- Intercom: The dominant customer messaging and support automation platform. Substantially higher price point with full chat, inbox, and AI automation bundled. Typebot is the lightweight alternative for organisations that need conversational data collection and basic bot flows without the overhead of a full customer messaging platform.
🤝 Open Source Ecosystem
- Formbricks: Focused on in-product surveys and feedback collection, preferred when the use case is measuring user sentiment at specific product touchpoints rather than building lead qualification or onboarding conversation flows.
- OpnForm: The choice for standard static forms when conversational UX is not needed. It can keep file uploads on local disk, where Typebot needs an S3-compatible bucket for them.