Saleor

Commerce as an API

Saleor has no storefront. It is a GraphQL API for products, carts, checkout, payments, orders and fulfilment, and the shop front is whatever you build against it, typically Next.js. That makes it a fit for teams who already have a frontend practice and want commerce as a service in their own stack, and a poor fit for anyone expecting to install a shop.

Apps extend it out of process rather than as plugins in the core, which keeps upgrades from becoming archaeology.

Polish Company, EEA Storage

The terms of use name Saleor Commerce sp. z o.o. at Tęczowa 7, 53-601 Wrocław, Poland. On data, they state that Saleor Commerce "declares that data, including personal data, provided by the Customer will be stored in the European Economic Area (EEA) or outside EEA" with security measures compliant with GDPR for any such transfer.

That is a real commitment with a real caveat attached, and the caveat is worth reading rather than skipping. EEA storage is the stated norm; storage outside it is contemplated and covered rather than excluded.

A data processing agreement is published at a stable URL, which puts Saleor ahead of most of this category.

Self-Host to Remove the Question

The open source core is BSD-licensed and self-hostable. Running it on European infrastructure removes the vendor from the data path entirely, and unlike some open core products the self-hosted version is the same commerce engine rather than a cut-down one.

Compare with the other headless option here, commercetools, which is more enterprise and less transparent about ownership.

More in ecommerce platforms.