Framer
Framer B.V. ·www.framer.com· As of: 2026-08-12
Work through this tool with an AI
Our verdict
Getting a page live faster saves marketing the wait for a developer slot. It defends nothing: the same subscription costs a competitor thirty dollars a month. What convinces customers sits on the page itself; the tool behind it they never see. The gain is real and stays confined to one function. What it costs shows up in the exit question.
Evidence:Storage location, certification, encryption, Privacy ShieldOpen sourceData processing, subprocessors, third-country transfers, deletionOpen sourceTraining on customer inputs, position on the AI regulationOpen sourcePlans, credits, editor prices, add-onsOpen sourceNo HTML export for self-hostingOpen sourceSingle sign-on, SCIM and roles in the Enterprise planOpen sourceCode export at Webflow from the Lite plan upwardOpen source
Who it fits
Solo
suitable
The free tier carries one site under a Framer address. From ten dollars a month you get your own domain and two CMS collections.
Mid-market
suitable
Thirty dollars a month plus twenty per additional editor stays predictable as long as the editorial team is small and nobody needs the site in twenty languages.
Enterprise
suitable with caveats
Single sign-on, user provisioning via SCIM and the exclusion from model training all hang on the Enterprise plan, for which no list price is published. An auditable access log is publicly documented in no plan at all.
Buy, switch or build
Off-the-shelf
Webflow and the first-generation builders
Webflow is the established counterpart in the same class and carries the one difference that counts in procurement: from its Lite plan upward the vendor lets customers pull out the generated code and run it elsewhere. That turns the exit into a calculation you can do before signing. Older organisations stay with WordPress for the same reason: content and delivery sit on infrastructure they control, and there is a broad market of service providers to run it.
AI-native
Lovable and the generating tools
Anyone who wants to hand the whole build over to a model ends up with tools like Lovable. The price difference is small and the difference in the result is large: there you get application code you can push into a repository of your own, here a designed page on someone else's infrastructure. What you give up is the surface on which a marketer without coding skills rearranges a section, and that surface is the whole reason this class gets bought.
Build it yourself
A static build from our own catalogue
The serious build-it-yourself route combines Astro as the build tool, Sanity as the content source and Cloudflare Pages for delivery. Assuming five to fifteen person-days of setup at a day rate of 1,200 euros, that is 6,000 to 18,000 euros once, then under ten euros a month in infrastructure, with the pages sitting as files in a repository of your own. The failure point sits elsewhere than in the build: every new page shape stays a development ticket, because the content system delivers text and no layouts. On top of that comes maintenance once the person who built it has gone.
Our advice
- Solo: Buy. Ten dollars a month beats any self-build.
- Mid-market: Buy while the site is marketing. Once it becomes part of the product, price the exit first.
- Enterprise: Insist on the Enterprise plan before signing. Below it the contract grants the vendor training rights on your content, and single sign-on is missing.
Who owns what gets built
bound to the platform · not portable
What gets built stays with the vendor. The help article of 07.08.2026 states that there is no HTML export for self-hosting and that sites rely on platform-managed services. The vendor draws the line itself, writing that anyone requiring complete control over hosting infrastructure or a source-code export is ill served by this route.No HTML export for self-hostingOpen source
Who is behind it
Staying power: Established
Framer B.V. is entered in the Dutch commercial register, trades independently and has a documented market presence of at least eight years. The most recent round is named and dated, product development runs at a documented frequency, and the legal documents were reissued in June 2026. The statement that the company was break-even in the year before the round comes from the company itself and stands here as a vendor figure.
- Legal form and company register entry: Framer B.V., a Dutch Besloten Vennootschap (limited liability company), registered with the Kamer van Koophandel (Chamber of Commerce) under number 59920637, registered office at Rozengracht 207-B, 1016 LZ Amsterdam. The company states these details itself in its privacy statement, data processing addendum and AI notice, and they match the public register extract. No group affiliation is shown there.framer.com/legal/privacy-statementOpen source · As of 2026-08-12
- Documented market presence: On 12.11.2018 a Series B of 24 million US dollars led by Atomico was reported. Framer also states on its own security page that since 16.07.2020 it no longer relies on the Privacy Shield as a transfer mechanism and continues to honour obligations from its existing certification. Both date the market presence to at least eight years.techcrunch.com/2018/11/12/framer-series-bOpen source · As of 2018-11-12
- Most recent funding round (Series D): USD 100 million, announced on 28.08.2025 on the company's own blog, at a valuation of 2 billion US dollars, led by Meritech and Atomico with participation from WiL and HV. According to the company it had been break-even for the year before the round and was approached by its existing investors. Also a vendor figure: more than half a million people using the platform each month and several hundred thousand sites running on it.framer.com/blog/series-dOpen source · As of 2025-08-28
- Frequency of product development: The public developer changelog carries dated entries from October 2024 through 04.08.2026, most recently a few weeks apart. On 16.06.2026 the vendor moved plans and billing to a credit model for AI features and lowered the price per additional editor.framer.com/developers/changelogOpen source · As of 2026-08-12
- Currency of legal documents and handling of incidents: Data processing addendum at version 2.0 and AI notice at version 1.1, both effective 16.06.2026; security page effective 06.02.2026. A public status page lists incidents with timestamps and offers RSS, JSON and webhooks. The most recent incident affected the collection of usage and analytics data on 22.06.2026 and was closed on 24.06.2026 once the gap from 18:30 to 21:30 had been backfilled.framerstatus.comOpen source · As of 2026-08-12
Cost of leaving: High
The vendor answers the question in its own help article, dated 07.08.2026: there is no HTML export for self-hosting, and anyone who needs control over hosting infrastructure or source code is in the wrong place. Images and vectors can be pulled out of the editor; for the CMS collections the index of 277 help articles documents a CSV import, and nothing at all for the way back. Switching means building the site a second time.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, no condition attachedpublic data processing addendum, version 2.0, part of the agreementData processing, subprocessors, third-country transfers, deletionOpen sourceVersion 2.0, effective 16.06.2026, available as a separate document and incorporated through the terms of service; in the order of precedence it ranks above the terms of service. The competent authority is the Dutch data protection authority (Autoriteit Persoonsgegevens), with Amsterdam as the forum. Notification of a personal data breach within 72 hours is promised.As of 2026-08-12 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, but unfavourableUnited States, AWS, no EU region offeredStorage location, certification, encryption, Privacy ShieldOpen sourceThe security page states in one sentence that all services run in AWS facilities in the United States. None of the pages checked names an EU region, a choice of location or a separate environment for European customers, the Enterprise offering included. The vendor sits in Amsterdam; the data does not.As of 2026-08-12 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, tied to a conditionlist maintained, viewable only through a trust portalData processing, subprocessors, third-country transfers, deletionOpen sourceThe data processing addendum makes the list Annex III of the standard contractual clauses, promises 30 days' notice before changes and grants a right to object whose only remedy is terminating the affected service. The list itself sits on a third-party trust portal that returned no readable text on 12.08.2026 and carries a noindex tag. On framer.com the sitemap holds no subprocessor page of its own.As of 2026-08-12 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | documented, tied to a conditiontransfer to the United States, mechanisms named, allocation per recipient not publicData processing, subprocessors, third-country transfers, deletionOpen sourceAppendix 1 of the data processing addendum sets an order of precedence: first the EU-US Data Privacy Framework where the recipient is certified, then the standard contractual clauses under Implementing Decision (EU) 2021/914 with modules two to four, then the UK addendum in version B1.0 and the Swiss adaptation. Which recipient operates on which basis sits in the subprocessor list, and that is not publicly readable.As of 2026-08-12 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | documented, but unfavourableinputs and outputs are licensed for training the vendor's own models on every plan except EnterpriseTraining on customer inputs, position on the AI regulationOpen sourceSection 7.1 of the AI notice, effective 16.06.2026: customers without an Enterprise contract grant the vendor a worldwide, irrevocable right to use their inputs and outputs in deidentified form to train its own AI models. For Enterprise customers this is excluded. The integrated model providers are contractually barred from training; the vendor itself is not. The document provides no way to object below Enterprise. The same text forbids customers in section 4.2 from putting any personal data into the AI features at all.As of 2026-08-12 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, tied to a conditiondeletion on written request, backups carved outData processing, subprocessors, third-country transfers, deletionOpen sourceSection 10.1 of the data processing addendum promises deletion on written request and carves out statutory retention as well as backups in which the data is not separately accessible. No deadline after the end of the contract is quantified anywhere. For content inside the tool the vendor names a 30-day version history.As of 2026-08-12 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, tied to a conditionISO 27001:2022 and SOC 2 Type 2 at the vendor, evidence only for Enterprise customersStorage location, certification, encryption, Privacy ShieldOpen sourceThe data processing addendum names both attestations with standard and version; per the security page the SOC 2 report covers the security and availability criteria. The certificate, the statement of applicability and the audit report go only to Enterprise customers on request. The report's audit period is not stated publicly.As of 2026-08-12 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | documented, tied to a conditiondedicated AI notice referring to the AI regulation, Article 50 not namedTraining on customer inputs, position on the AI regulationOpen sourceThe AI notice at version 1.1 explicitly names Regulation (EU) 2024/1689 as its frame of reference, classifies its own features as not high-risk, commits to transparency about AI-generated content and requires human oversight of outputs. The transparency duties under Article 50 are never named as such. On the published website the labelling is the operator's job in any case.As of 2026-08-12 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, but unfavourable30-day version history, no documented auditable access logSingle sign-on, SCIM and roles in the Enterprise planOpen sourceOn the vendor side the security page describes central logging, audit trails and a SIEM. What the customer can evaluate from it stays open: the Enterprise offering names single sign-on, SCIM and roles, without an access or change log carrying a scope, a retention period and an export path. The only publicly documented item is a 30-day version history.As of 2026-08-12 |
What it really costs
Entry price
Free with 500 credits and a Framer address. Basic costs 10 US dollars a month with 1,000 credits, a custom domain and two CMS collections; Pro costs 30 US dollars with 3,000 credits and ten collections.Plans, credits, editor prices, add-onsOpen source
As of 2026-08-12
What gets expensive
The plan price is the smallest item. Twenty US dollars per additional editor per month, twenty per locale for localisation up to twenty locales, fifty per 500,000 events for A/B testing, two hundred once for advanced hosting, plus credit packs as soon as agents generate whole pages. Single sign-on, SCIM and the exclusion from model training sit in the Enterprise plan, for which no list price is published.
What it displaces
- A development ticket for a marketing page
- Builder with themes and plugins
Interfaces
- CSV import into the CMS collections
- Server API for writing and publishing
- Extensions through the plugin API
- Webhook for forms
Matching methods
- Demand Creation vs. Demand CaptureCreating demand means publishing regularly, and this tool removes marketing's dependence on a developer slot, so the cadence hangs on the editorial team.
- 70/20/10 Creative ReskinningThe method multiplies what demonstrably works, and a visual editor with an A/B add-on turns a variant into an hour of work.
- Regulatory Density TestThe test asks how dense the regulatory load sits around the use case; here it decides the purchase, because storage location and the training licence rule the tool out in regulated industries.
Sources
- 1.Storage location, certification, encryption, Privacy Shield (opens in a new tab)framer.com/legal/security · As of 2026-08-12
- 2.Data processing, subprocessors, third-country transfers, deletion (opens in a new tab)framer.com/legal/data-processing-addendum · As of 2026-08-12
- 3.Training on customer inputs, position on the AI regulation (opens in a new tab)framer.com/legal/ai-notice · As of 2026-08-12
- 4.Plans, credits, editor prices, add-ons (opens in a new tab)framer.com/pricing · As of 2026-08-12
- 5.No HTML export for self-hosting (opens in a new tab)framer.com/…/can-i-export-my-website-to-html-and-self-host-it · As of 2026-08-07
- 6.Single sign-on, SCIM and roles in the Enterprise plan (opens in a new tab)framer.com/enterprise · As of 2026-08-12
- 7.Code export at Webflow from the Lite plan upward (opens in a new tab)webflow.com/updates/export-clean-html5-and-css3 · As of 2026-08-12
- 8.framer.com/legal/privacy-statement (opens in a new tab)As of 2026-08-12
- 9.techcrunch.com/2018/11/12/framer-series-b (opens in a new tab)As of 2018-11-12
- 10.framer.com/blog/series-d (opens in a new tab)As of 2025-08-28
- 11.framer.com/developers/changelog (opens in a new tab)As of 2026-08-12
- 12.framerstatus.com (opens in a new tab)As of 2026-08-12
Last reviewed: 2026-08-12 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.