Back to blog
Updates·

Polyform now stores your data in the EU

TL;DR: Polyform's customer database and file storage now run in Ireland (AWS eu-west-1). If you build forms in Europe, your respondents' data no longer leaves the EU during regular operations.

#What changed

Until today, Polyform's primary data store was located in the United States. As of today, we've migrated:

  • Your team and account data
  • All forms, themes, and project configurations
  • Every response and uploaded file
  • Webhook integration logs and analytics

to a new deployment hosted in the EU. The migration was zero-loss — every record, every file, and every reference was preserved.

#Why this matters

For teams operating under GDPR, having customer data physically reside in the EU removes a layer of legal complexity:

  • No cross-border transfer for core processing. Form responses, uploaded files, and team data stay within EU borders for the operations that matter most.
  • Jurisdictional alignment. Our infrastructure now runs in Ireland — the same jurisdiction as the Irish Data Protection Commission, which acts as our default competent supervisory authority for Standard Contractual Clauses.
  • Simplified DPIA outcomes. When you assess Polyform as a data processor in your privacy impact assessments, EU residency is a clear plus.
  • Faster latency for European respondents. Form load times and submissions are now noticeably quicker for users in Europe.

#What else lives in the EU

Beyond the core database, most of our stack now runs in Europe:

  • Vercel functions execute in EU regions
  • PostHog product analytics runs on the EU cloud
  • Sentry error tracking runs on the EU instance
  • Resend delivers all emails from Ireland (eu-west-1)

#What still relies on US providers

A small set of services still process data in the United States:

  • Clerk handles authentication and billing — no EU region available
  • OpenAI powers our AI features (Polly) — no EU region available

For these transfers we rely on Standard Contractual Clauses (SCCs Module Two), the UK International Data Transfer Addendum, and Swiss FADP-equivalent safeguards. Our full subprocessor list is on the GDPR page.

#What you need to do

Nothing. The migration is complete and transparent — your existing form URLs, custom domains, webhooks, and API tokens all continue to work without change. If anything looks off, contact us at hello@polyform.to.