Sylius
Partially CompliantPolish open source ecommerce framework built on Symfony, self-hosted, aimed at custom B2B and B2C builds.
GDPR Compliance Data
Not independently verified| GDPR Status | Partially Compliant |
| HQ Country | Poland |
| Ownership | European-owned |
| Foreign Disclosure Exposure | None known |
| Data Hosting Location | European UnionโSelf-hosted. The vendor runs no managed cloud for this product, so the hosting location is whichever provider the buyer deploys to. EU hosting is therefore available by default, which is why dataHostingLocation is EU, but deploying to a US cloud would reintroduce CLOUD Act reach over the host.โ |
| EU Servers Available | |
| Data Processing Agreement | Not verified |
| Sub-processor List | Not verified |
| Schrems II Risk | Low Risk |
| SCCs in Place | |
| Last Verified | 24 August 2026 |
How we reached this
Sylius sp. z o.o., ลรณdลบ, Poland, named in the privacy policy. EU-owned. There is no vendor-operated cloud for the product: Sylius sells support, a commercial Plus edition and partner services, and the application is deployed by the buyer. Exposure is NONE and Schrems II risk LOW on the basis of a European self-hosted deployment, which is the normal case; deploying to a US cloud would change that and is the buyer's decision, not the vendor's. GDPR status is PARTIAL because the company publishes no DPA covering its own processing of customer and support data. The commerce data itself never reaches the vendor.
About Sylius
A Framework, Not a Shop
Sylius starts from the position that most serious commerce projects end up fighting their platform. Rather than a configurable product, it ships a well-structured Symfony application with the commerce domain modelled properly, and expects you to build on it.
That makes it slow to start and cheap to change, which is the opposite trade to PrestaShop. It is the platform of choice for agencies building complex B2B catalogues, unusual pricing rules and integrations that a plugin architecture would strangle.
No Vendor in the Data Path
There is no Sylius cloud. The company sells support, a commercial Plus edition and partner services, and the software runs wherever you deploy it.
For a European buyer this is the cleanest possible position on data. Deploy to a European host and no third party is processing your order data at all, so there is nothing to document under Chapter V, no sub-processor list to audit and no CLOUD Act question to answer. That answer is available because you own the deployment, not because a vendor promised something.
The company is Sylius sp. z o.o. of ลรณdลบ, Poland.
The Cost of That
Sylius needs a Symfony team. There is no version of this that a marketing department runs alone, and the total cost of ownership is a development budget rather than a subscription. If that is not available, Shopware or PrestaShop are the realistic European alternatives.
More in ecommerce platforms.
Key Features
Pros & Cons
Categories
Sylius GDPR & data protection: common questions
Is Sylius GDPR compliant?
Partly. Sylius meets some of the requirements, with caveats worth reading before you commit. Sylius is a European company headquartered in Poland, data is hosted within the European Union.
Where does Sylius store data?
Sylius states: "Self-hosted. The vendor runs no managed cloud for this product, so the hosting location is whichever provider the buyer deploys to. EU hosting is therefore available by default, which is why dataHostingLocation is EU, but deploying to a US cloud would reintroduce CLOUD Act reach over the host.". Data is hosted within the European Union.
Does Sylius offer a Data Processing Agreement (DPA)?
We could not locate a published DPA for Sylius. That does not mean one is unavailable. Many vendors provide it on request or inside the account area rather than publishing it. Ask before you sign.
What a DPA has to cover โIs Sylius a European company?
Yes. Sylius is headquartered in Poland and, as far as we can establish, European-owned.
Related Tools
Shopware
German commerce platform available self-hosted or as managed cloud, with an open source community edition.
PrestaShop
French open source ecommerce platform, self-hosted, whose own hosted services run on Google Cloud in the United States.
Saleor
Polish open source headless commerce API with a managed cloud, a published DPA and EEA data storage stated in its terms.
Spotted something wrong?
Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.
If you work at Sylius and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.