# Framer

> Builds websites in a visual editor and runs them on the vendor's infrastructure, so a new page goes live without a development step.

- Vendor: Framer B.V.
- Canonical URL: https://www.convios.com/en/toolbox/framer
- Language version: https://www.convios.com/de/werkzeugkasten/framer
- Area: Content & web · Cluster: website builder
- Role: Build tool · Origin: Established, AI retrofitted
- As of: 2026-08-12 · Reviewed: 2026-08-12 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Efficiency only: Getting a page live faster saves marketing the wait for a developer slot. It defends nothing: the same subscription costs a competitor thirty dollars a month. What convinces customers sits on the page itself; the tool behind it they never see. The gain is real and stays confined to one function. What it costs shows up in the exit question.

## Suitability by company size

- Solo: suitable — The free tier carries one site under a Framer address. From ten dollars a month you get your own domain and two CMS collections.
- Mid-market: suitable — Thirty dollars a month plus twenty per additional editor stays predictable as long as the editorial team is small and nobody needs the site in twenty languages.
- Enterprise: suitable with caveats — Single sign-on, user provisioning via SCIM and the exclusion from model training all hang on the Enterprise plan, for which no list price is published. An auditable access log is publicly documented in no plan at all.

## Vendor staying power

Established: Framer B.V. is entered in the Dutch commercial register, trades independently and has a documented market presence of at least eight years. The most recent round is named and dated, product development runs at a documented frequency, and the legal documents were reissued in June 2026. The statement that the company was break-even in the year before the round comes from the company itself and stands here as a vendor figure.

- Legal form and company register entry: Framer B.V., a Dutch Besloten Vennootschap (limited liability company), registered with the Kamer van Koophandel (Chamber of Commerce) under number 59920637, registered office at Rozengracht 207-B, 1016 LZ Amsterdam. The company states these details itself in its privacy statement, data processing addendum and AI notice, and they match the public register extract. No group affiliation is shown there. (source: https://www.framer.com/legal/privacy-statement, as of 2026-08-12)
- Documented market presence: On 12.11.2018 a Series B of 24 million US dollars led by Atomico was reported. Framer also states on its own security page that since 16.07.2020 it no longer relies on the Privacy Shield as a transfer mechanism and continues to honour obligations from its existing certification. Both date the market presence to at least eight years. (source: https://techcrunch.com/2018/11/12/framer-series-b/, as of 2018-11-12)
- Most recent funding round (Series D): USD 100 million, announced on 28.08.2025 on the company's own blog, at a valuation of 2 billion US dollars, led by Meritech and Atomico with participation from WiL and HV. According to the company it had been break-even for the year before the round and was approached by its existing investors. Also a vendor figure: more than half a million people using the platform each month and several hundred thousand sites running on it. (source: https://www.framer.com/blog/series-d/, as of 2025-08-28)
- Frequency of product development: The public developer changelog carries dated entries from October 2024 through 04.08.2026, most recently a few weeks apart. On 16.06.2026 the vendor moved plans and billing to a credit model for AI features and lowered the price per additional editor. (source: https://www.framer.com/developers/changelog, as of 2026-08-12)
- Currency of legal documents and handling of incidents: Data processing addendum at version 2.0 and AI notice at version 1.1, both effective 16.06.2026; security page effective 06.02.2026. A public status page lists incidents with timestamps and offers RSS, JSON and webhooks. The most recent incident affected the collection of usage and analytics data on 22.06.2026 and was closed on 24.06.2026 once the gap from 18:30 to 21:30 had been backfilled. (source: https://www.framerstatus.com/, as of 2026-08-12)

## Cost of leaving

High: The vendor answers the question in its own help article, dated 07.08.2026: there is no HTML export for self-hosting, and anyone who needs control over hosting infrastructure or source code is in the wrong place. Images and vectors can be pulled out of the editor; for the CMS collections the index of 277 help articles documents a CSV import, and nothing at all for the way back. Switching means building the site a second time.

## Who owns what you build

What gets built stays with the vendor. The help article of 07.08.2026 states that there is no HTML export for self-hosting and that sites rely on platform-managed services. The vendor draws the line itself, writing that anyone requiring complete control over hosting infrastructure or a source-code export is ill served by this route.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | public data processing addendum, version 2.0, part of the agreement — Version 2.0, effective 16.06.2026, available as a separate document and incorporated through the terms of service; in the order of precedence it ranks above the terms of service. The competent authority is the Dutch data protection authority (Autoriteit Persoonsgegevens), with Amsterdam as the forum. Notification of a personal data breach within 72 hours is promised. | evidenced | 2026-08-12 |
| Storage location | United States, AWS, no EU region offered — The security page states in one sentence that all services run in AWS facilities in the United States. None of the pages checked names an EU region, a choice of location or a separate environment for European customers, the Enterprise offering included. The vendor sits in Amsterdam; the data does not. | partially evidenced | 2026-08-12 |
| Subprocessors | list maintained, viewable only through a trust portal — The data processing addendum makes the list Annex III of the standard contractual clauses, promises 30 days' notice before changes and grants a right to object whose only remedy is terminating the affected service. The list itself sits on a third-party trust portal that returned no readable text on 12.08.2026 and carries a noindex tag. On framer.com the sitemap holds no subprocessor page of its own. | partially evidenced | 2026-08-12 |
| Third-country transfer | transfer to the United States, mechanisms named, allocation per recipient not public — Appendix 1 of the data processing addendum sets an order of precedence: first the EU-US Data Privacy Framework where the recipient is certified, then the standard contractual clauses under Implementing Decision (EU) 2021/914 with modules two to four, then the UK addendum in version B1.0 and the Swiss adaptation. Which recipient operates on which basis sits in the subprocessor list, and that is not publicly readable. | partially evidenced | 2026-08-12 |
| Training on customer data | inputs and outputs are licensed for training the vendor's own models on every plan except Enterprise — Section 7.1 of the AI notice, effective 16.06.2026: customers without an Enterprise contract grant the vendor a worldwide, irrevocable right to use their inputs and outputs in deidentified form to train its own AI models. For Enterprise customers this is excluded. The integrated model providers are contractually barred from training; the vendor itself is not. The document provides no way to object below Enterprise. The same text forbids customers in section 4.2 from putting any personal data into the AI features at all. | partially evidenced | 2026-08-12 |
| Retention and deletion | deletion on written request, backups carved out — Section 10.1 of the data processing addendum promises deletion on written request and carves out statutory retention as well as backups in which the data is not separately accessible. No deadline after the end of the contract is quantified anywhere. For content inside the tool the vendor names a 30-day version history. | partially evidenced | 2026-08-12 |
| Certifications | ISO 27001:2022 and SOC 2 Type 2 at the vendor, evidence only for Enterprise customers — The data processing addendum names both attestations with standard and version; per the security page the SOC 2 report covers the security and availability criteria. The certificate, the statement of applicability and the audit report go only to Enterprise customers on request. The report's audit period is not stated publicly. | partially evidenced | 2026-08-12 |
| EU AI Act, Article 50 | dedicated AI notice referring to the AI regulation, Article 50 not named — The AI notice at version 1.1 explicitly names Regulation (EU) 2024/1689 as its frame of reference, classifies its own features as not high-risk, commits to transparency about AI-generated content and requires human oversight of outputs. The transparency duties under Article 50 are never named as such. On the published website the labelling is the operator's job in any case. | partially evidenced | 2026-08-12 |
| Audit logging | 30-day version history, no documented auditable access log — On the vendor side the security page describes central logging, audit trails and a SIEM. What the customer can evaluate from it stays open: the Enterprise offering names single sign-on, SCIM and roles, without an access or change log carrying a scope, a retention period and an export path. The only publicly documented item is a 30-day version history. | partially evidenced | 2026-08-12 |

## Cost

- Entry: Free with 500 credits and a Framer address. Basic costs 10 US dollars a month with 1,000 credits, a custom domain and two CMS collections; Pro costs 30 US dollars with 3,000 credits and ten collections. (as of 2026-08-12)
- Where it gets expensive: The plan price is the smallest item. Twenty US dollars per additional editor per month, twenty per locale for localisation up to twenty locales, fifty per 500,000 events for A/B testing, two hundred once for advanced hosting, plus credit packs as soon as agents generate whole pages. Single sign-on, SCIM and the exclusion from model training sit in the Enterprise plan, for which no list price is published.

## Three routes compared

### Webflow and the first-generation builders

Webflow is the established counterpart in the same class and carries the one difference that counts in procurement: from its Lite plan upward the vendor lets customers pull out the generated code and run it elsewhere. That turns the exit into a calculation you can do before signing. Older organisations stay with WordPress for the same reason: content and delivery sit on infrastructure they control, and there is a broad market of service providers to run it.

### Lovable and the generating tools

Anyone who wants to hand the whole build over to a model ends up with tools like Lovable. The price difference is small and the difference in the result is large: there you get application code you can push into a repository of your own, here a designed page on someone else's infrastructure. What you give up is the surface on which a marketer without coding skills rearranges a section, and that surface is the whole reason this class gets bought.

### A static build from our own catalogue

The serious build-it-yourself route combines Astro as the build tool, Sanity as the content source and Cloudflare Pages for delivery. Assuming five to fifteen person-days of setup at a day rate of 1,200 euros, that is 6,000 to 18,000 euros once, then under ten euros a month in infrastructure, with the pages sitting as files in a repository of your own. The failure point sits elsewhere than in the build: every new page shape stays a development ticket, because the content system delivers text and no layouts. On top of that comes maintenance once the person who built it has gone.

Recommendation by size:

- Solo: Buy. Ten dollars a month beats any self-build.
- Mid-market: Buy while the site is marketing. Once it becomes part of the product, price the exit first.
- Enterprise: Insist on the Enterprise plan before signing. Below it the contract grants the vendor training rights on your content, and single sign-on is missing.

## Context

- Implements method: [Demand Creation vs. Demand Capture](https://www.convios.com/en/methods/demand-creation-vs-capture) — Creating demand means publishing regularly, and this tool removes marketing's dependence on a developer slot, so the cadence hangs on the editorial team.
- Implements method: [70/20/10 Creative Reskinning](https://www.convios.com/en/methods/creative-reskinning) — The method multiplies what demonstrably works, and a visual editor with an A/B add-on turns a variant into an hour of work.
- Implements method: [Regulatory Density Test](https://www.convios.com/en/methods/regulatory-density-test) — The test asks how dense the regulatory load sits around the use case; here it decides the purchase, because storage location and the training licence rule the tool out in regulated industries.
- Alternative: [Astro](https://www.convios.com/en/toolbox/astro)
- Alternative: [Lovable](https://www.convios.com/en/toolbox/lovable)
- Displaces: A development ticket for a marketing page, Builder with themes and plugins

## Evidence

- Storage location, certification, encryption, Privacy Shield — https://www.framer.com/legal/security (as of 2026-08-12)
- Data processing, subprocessors, third-country transfers, deletion — https://www.framer.com/legal/data-processing-addendum (as of 2026-08-12)
- Training on customer inputs, position on the AI regulation — https://www.framer.com/legal/ai-notice (as of 2026-08-12)
- Plans, credits, editor prices, add-ons — https://www.framer.com/pricing (as of 2026-08-12)
- No HTML export for self-hosting — https://www.framer.com/help/articles/can-i-export-my-website-to-html-and-self-host-it/ (as of 2026-08-07)
- Single sign-on, SCIM and roles in the Enterprise plan — https://www.framer.com/enterprise (as of 2026-08-12)
- Code export at Webflow from the Lite plan upward — https://webflow.com/updates/export-clean-html5-and-css3 (as of 2026-08-12)