Back to blog
Updates·

Polyform now stores your data in the EU

TL;DR: Polyform's customer database and file storage now run in Ireland (AWS eu-west-1). If you build forms in Europe, your respondents' data no longer leaves the EU during regular operations.

#What changed

Until today, Polyform's primary data store was located in the United States. As of today, we've migrated:

  • Your team and account data
  • All forms, themes, and project configurations
  • Every response and uploaded file
  • Webhook integration logs and analytics

to a new deployment hosted in the EU. The migration was zero-loss — every record, every file, and every reference was preserved.

#Why this matters

For teams operating under GDPR, having customer data physically reside in the EU removes a layer of legal complexity:

  • No cross-border transfer for core processing. Form responses, uploaded files, and team data stay within EU borders for the operations that matter most.
  • Jurisdictional alignment. Our infrastructure now runs in Ireland — the same jurisdiction as the Irish Data Protection Commission, which acts as our default competent supervisory authority for Standard Contractual Clauses.
  • Simplified DPIA outcomes. When you assess Polyform as a data processor in your privacy impact assessments, EU residency is a clear plus.
  • Faster latency for European respondents. Form load times and submissions are now noticeably quicker for users in Europe.

#What else lives in the EU

Beyond the core database, most of our stack now runs in Europe:

  • Vercel functions execute in EU regions
  • PostHog product analytics runs on the EU cloud
  • Sentry error tracking runs on the EU instance
  • Resend delivers all emails from Ireland (eu-west-1)

#What still relies on US providers

A small set of services still process data in the United States:

  • Clerk handles authentication, with no EU region available
  • OpenAI powers our AI features (Polly), with no EU region available

For these transfers we rely on Standard Contractual Clauses (SCCs Module Two), the UK International Data Transfer Addendum, and Swiss FADP-equivalent safeguards. Our full subprocessor list is on the GDPR page.

#What you need to do

Nothing. The migration is complete and transparent — your existing form URLs, custom domains, webhooks, and API tokens all continue to work without change. If anything looks off, contact us at hello@polyform.to.