Self-hosted Vercel alternative for EU data residency: the short answer
If your Next.js workloads run on Vercel and your residency or transfer review cannot justify the default function region or global routing, self-hosting on EU servers with Coolify or Dokploy keeps compute and data in the EU, while the global CDN and Vercel-managed edge features leave your control. Residency is not a label you attach to a platform. It depends on where processing happens and who can compel access to the data, so the operator must confirm both before relying on the move. A server in a European data center still needs a clear answer on who administers it, which cloud account or provider hosts it, and whether any component, such as a managed database, backup target or DNS service, sends data outside the EEA.
Start by mapping every data flow the Vercel project uses today: function regions, edge middleware, image optimization, logs, analytics, Blob storage and any Marketplace database. Then decide which of these must stay in the EU and which can be replaced. Coolify and Dokploy both run on servers you choose, so the hosting region and the operator become your decisions. Check the Coolify or Dokploy control plane location as well, because a managed instance such as Coolify Cloud or Dokploy's hosted offering places the management layer with its vendor, and that is a different question from where your application runs. Ask the vendor or your provider to confirm each location in writing.
Do not record a compliance outcome from the move alone. Under GDPR, remote access from a third country, including support staff viewing data on a screen, counts as a transfer, and so does storage outside the EEA, so your access model and backup destinations matter as much as server location. Ask your counsel and your data protection officer to review the processor chain, including any provider subject to third-country law with extraterritorial reach. An independent auditor, not DeployOpen or the platform vendor, determines whether your controls satisfy the regulation.
What the constraint requires from the hosting platform
The EU data residency question is less about where a server sits and more about who can reach the data and under which law. Each card below names one legal or technical condition that shapes the hosting choice, and each one points to a check your team should complete before choosing a platform.
Every third-country transfer counts
Article 44 of the GDPR applies Chapter V to every transfer of personal data to a third country, including onward transfers. The EDPB Guidelines 05/2021 make the scope concrete: remote access from a third country, even only displaying data on a screen for support, and storage in a cloud outside the EEA are both transfers. Map every place your Next.js logs, functions, database backups and support sessions reach, not only the primary region.
Privacy Shield invalidated, framework pending
The Court of Justice invalidated the EU-US Privacy Shield in Schrems II (Case C-311/18) on 16 July 2020, while upholding standard contractual clauses. The Commission's Data Privacy Framework decision, 2023/1795, covers only US organizations on the Data Privacy Framework List, and an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. Ask any hosting provider whether it is on the list and track the appeal before relying on it.
Foreign orders reach provider-held data
The US CLOUD Act provision at 18 U.S.C. 2713 requires electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control, wherever that data is stored. Article 48 of the GDPR limits how a third-country court or authority order can be recognized, allowing it only where an international agreement such as a mutual legal assistance treaty applies. Treat a US-parented provider as an exposure to assess, not as a finding of transfer.
Technical measures have limits
EDPB Recommendations 01/2020 state that where a provider must access data in the clear and the destination's public authority powers go beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned. Encryption that the provider can open does not solve this on its own. Where hosting control matters most, the realistic question is whether the operator, not a foreign-parented vendor, holds the keys and the access path to the data.
Operator-controlled access paths
Self-hosting moves the access list into your own hands. With Coolify or Dokploy, each server is reached over SSH from accounts you define, and the platform's own admin, deploy and database credentials sit on infrastructure you operate. Document who can log in to each server, who can open the dashboard and API, and which vendor staff, if any, can reach the control plane for support, because each of those paths is a potential transfer to assess.
Where Vercel's default setup puts data and traffic
Vercel Functions default to Washington, D.C., and requests pass through a global network, so an EU Next.js app can run its server code and handle traffic outside the EU without anyone changing the application. Before any migration, pin the function region your plan allows and confirm the setting in the project configuration. Then test from an EU client and record which regions serve function invocations, so the residency claim rests on evidence rather than on the project's name or the team's intent.
Residency also depends on who can reach the data. Under GDPR Article 44, every transfer of personal data to a third country, including onward transfers by Vercel's own sub-processors, must meet Chapter V conditions. The EDPB's Guidelines 05/2021 treat remote access from a third country, even only displaying data for support, as a transfer. Ask Vercel for its list of sub-processors, where logs and build artifacts are stored, and which support staff can open customer data. Under 18 U.S.C. 2713, a U.S. provider must preserve or disclose data in its control wherever it is stored, so an EU region alone does not settle the exposure.
A self-hosted Coolify or Dokploy server in your EU data center can run functions and databases, but it cannot reproduce Vercel's global CDN, edge caching or edge middleware. Decide which of those features your users depend on. If they need edge caching for static assets across regions, you will either accept slower loads from distant locations, add a CDN you contract separately, or keep part of the traffic on Vercel, which creates a split that needs its own transfer assessment. Confirm with Vercel which region, log retention and support access options apply to your plan before you commit to a design.
Which open-source options keep Next.js workloads in the EU
This table compares Coolify, Dokploy, Coolify Cloud and Next.js containers you operate against the requirement that app code, functions and data stay in the EU. Read each row as a question of where the servers sit, who operates them and which edge features disappear. The main takeaway is that residency depends on your own server location and operating model, not on the tool name alone.
| Option | Where processing happens | What it keeps or gives up | When to choose it |
|---|---|---|---|
| Coolify (self-hosted) | Servers you choose in an EU region, installed over SSH and run by your team | Apache-2.0 edition with all features free; Traefik or Caddy handle HTTPS; PostgreSQL and MySQL backups can go to S3-compatible storage in the EU | Your team wants full control of servers and accepts operating patching, backups and on-call |
| Dokploy (self-hosted) | Servers you choose in an EU region, managed through Docker Swarm with Traefik on ports 80 and 443 | Apache 2.0 core, but SSO, SCIM and audit logs sit in source-available /proprietary code that needs a commercial agreement for production use | You need Swarm clusters or Dokploy's build types and can accept a commercial agreement for enterprise features |
| Coolify Cloud (managed Coolify) | Coolify's managed infrastructure hosts the Coolify instance; your apps run on servers you bring | Control plane location is not set by you here, so confirm where the instance and its data sit before choosing it for residency | Only after written confirmation of the hosting location and data handling for the control plane |
| Next.js in containers you operate | Node.js server or Docker container in EU infrastructure you control, behind your own proxy | Next.js documents full feature support for Node.js and Docker deployments; the global CDN and edge functions are not included | Your residency requirement covers the app itself and you want the framework without a managed host |
| Operator responsibilities | Your team in the EU or your contracted operators | Patching, backups, restores, capacity and incident response move from the vendor to you | Choose this when your team can run servers continuously and document the controls |
| Edge and CDN features | Not replaced by any option in this table | Global caching, edge middleware and regional routing from a managed CDN must be rebuilt or dropped | Confirm which requests must be served from a CDN and whether the EU origin is acceptable for them |
| Legal exposure of vendors | Depends on where your provider and their staff are located | Confirm with counsel whether remote administrative access from outside the EEA counts as a transfer under the EDPB guidelines | Ask every provider in the chain for their support access model in writing |
How to deploy Coolify or Dokploy in EU infrastructure
This sequence moves a Next.js app and its database onto servers in an EU region you control, with each component's location documented before the cutover. It produces a tested restore path and a record of where every piece of data sits.
Confirm EU region and contract terms
Your compliance lead and procurement team choose an EU cloud region or data center and confirm the provider's physical location, subprocessors and contract terms in writing. Ask the provider to state in the contract where backups, snapshots and support access happen. The step is done when you hold a signed record naming the facility country, not only the nearest region label on a pricing page.
Provision Linux servers to minimums
Your platform engineers create Linux servers in that region using a supported distribution. Coolify needs at least 2 CPU cores, 2 GB RAM and 10 GB of free disk, on amd64 or arm64. Dokploy needs at least 2 GB of RAM and 30 GB of disk, and its install docs list tested distributions. Size the servers for your builds and database, since the minimums are a floor. The step is done when each server passes the platform's preflight checks.
Install the control plane and connect servers
Your team installs Coolify or Dokploy on a control server, then connects each target server. Coolify connects to each server over SSH and prepares it to run Docker workloads. Dokploy's installer sets up Docker Swarm and uses ports 80 and 443 for Traefik and port 3000 for the web interface, so restrict port 3000 to administrators. The step is done when every server shows as reachable and healthy in the dashboard.
Set the proxy, TLS and wildcard DNS
Your platform team keeps the default reverse proxy (Traefik in Coolify, or Caddy as the alternative) so the proxy container handles HTTPS automatically. Create DNS records for production domains and a wildcard record for preview URLs, such as the default {{pr_id}}.{{domain}} pattern in Coolify. Confirm that your DNS provider and any CDN you add also hold data in the EU. The step is done when production and a test preview domain both return valid certificates.
Build the Next.js app from Git
Your developers connect the Git repository and select a build method: a Dockerfile, a Nixpacks build, or a prebuilt Docker image. For Next.js, pin the build to a Node.js server or a Docker container, because Next.js documents that these modes support all features, while static export supports a limited set. Confirm that image optimization, ISR caching and environment variables work in a staging deployment. The step is done when a staging build serves every critical route from the EU server.
Deploy PostgreSQL with tested EU backups
Your database owners deploy PostgreSQL from the platform's database catalog and configure scheduled backups to S3-compatible storage located in the EU. Coolify's PostgreSQL backups use the pg_dump custom format and support retention rules, while Dokploy offers S3 backup destinations. Confirm the backup bucket's region in writing. Then restore a backup into a separate database and verify row counts. The step is done when a restore test succeeds and the result is recorded.
Document the region of every component
Your compliance team records the location of each component: servers, proxy, DNS, object storage, database backups, logging, monitoring, error tracking and transactional email. Mark any service that sends personal data to a third country, since remote access from outside the EEA also counts as a transfer under EDPB Guidelines 05/2021. Assess whether any provider could be subject to third-country access requests. The step is done when the register lists every component with its country and legal basis.
Cut over and plan for limits
Your team lowers DNS TTLs, moves traffic to the EU deployment and keeps the Vercel project available until monitoring confirms stable operation. Rollbacks in Coolify can redeploy a retained application image but do not restore databases or persistent files, so rely on your tested backups for data recovery. Confirm which global CDN features you lose, such as edge caching, and accept or replace them. The step is done when traffic runs on the EU servers and the rollback runbook has been rehearsed.
Evidence a regulator or auditor will ask for
Moving Next.js workloads onto servers you control shifts several records from the vendor to your own team. The cards below list the documents a data protection authority or an independent auditor is likely to request, and what each one must show for the EU-hosted stack. DeployOpen prepares these records and evidence for an independent auditor or regulator; it does not issue audit reports, attestations or certifications.
Processing register entry
Record each EU server location, the cloud account or data center that hosts it, and the applications and personal data categories that run there. The entry should name every system that touches the data, including Coolify or Dokploy, the database servers and the object store. Check that the register matches what is actually deployed, because server lists drift after new servers are added to a multi-server setup.
Transfer assessment per processor
List every remaining processor that can reach the data from a third country, such as an email provider, an error tracker or a support tool used by your team. For each one, record whether a transfer occurs, including remote viewing of a screen from outside the EEA, and document the assessment. Ask each processor where its support staff and sub-processors sit, because remote access counts as a transfer even when no data is stored abroad.
Chapter V contracts where they apply
Where a third-country transfer remains, the contract must include the Chapter V transfer mechanism, usually the standard contractual clauses in Commission Implementing Decision (EU) 2021/914. Confirm that the Data Processing Agreement covers each processor's sub-processors and the notification process for government access requests. Hosting companies in the EU can still be subject to foreign law with extraterritorial reach, so ask counsel to review that exposure before signing.
Backup location and restore test results
Show where scheduled database backups and object storage copies are kept, and that they stay within the EU if residency is required. Coolify's PostgreSQL backups can go to S3-compatible storage, but Redis, Dragonfly and KeyDB are not covered by its scheduled backups, so document how those stores are protected. Keep dated restore test records, since an untested backup gives an auditor no evidence that recovery works.
Access logs and server reachability
Produce a list of every account and key that can log in to the servers, the Coolify or Dokploy admin accounts and the SSH keys used to connect each server. Pair it with access logs covering logins, deployments, secret changes and backup restores. Confirm who can reach the servers from outside the EU and whether any remote support session crosses the border, since both are transfer questions.
Vendor licence terms
Keep a copy of the licence that governs each self-hosted component, because the terms differ. Coolify is Apache-2.0 licensed. Dokploy's core is Apache 2.0, but its enterprise features under /proprietary fall under the Dokploy Source Available License, which allows production use only under a commercial agreement. Record which features your deployment uses and whether a commercial agreement is in place for them.
Questions teams ask before moving Vercel workloads to the EU
Does self-hosting Next.js on EU servers remove all data transfer risk?
No. Self-hosting changes where processing happens, but it does not remove every transfer or third-party exposure. EDPB Guidelines 05/2021 treat remote access from a third country, including support staff viewing data on screen, as a transfer, so your own administrators and vendors must be located and assessed. Your DNS provider, email service, error tracking, analytics, payment provider and any external CDN or object store can still receive personal data. List every processor that touches requests, logs, backups and support access, then confirm each one's hosting location and legal exposure with the vendor before you rely on the move for residency.
How much effort does moving a Next.js app to Coolify or Dokploy take?
The effort depends mainly on app count, data volume, preview needs, CDN dependence and team skills. Each app needs a Dockerfile or a build pack, environment variables, a reverse proxy route and a database plan, and each database needs a tested backup and restore path. Preview deployments need wildcard DNS and a Git integration. Heavy reliance on Vercel's global CDN, image optimization or ISR caching adds design work, because those features must be replaced or accepted as gone. Ask any provider for a written list of apps, data stores and integrations, and a plan that names which of these you will rebuild and which you will retire.
What does Coolify Cloud cost compared with self-hosted Coolify?
Coolify Cloud costs $5 per month for 2 connected servers plus $3 per month for each additional server, with a 20% discount for annual billing, according to Coolify's pricing page. You still bring and pay for the servers, while Coolify Cloud runs the Coolify management instance on its own infrastructure. Self-hosted Coolify is free forever under the Apache-2.0 license, with all features and no limitations. Your recurring costs are then the servers, storage, backups, DNS and the engineering time to patch and operate the platform. Ask for a quote that separates one-time setup from monthly infrastructure and support.
Do we need Dokploy's enterprise features for EU compliance?
Not for data residency alone. Dokploy's core is Apache 2.0, but code inside its /proprietary directories is covered by the Dokploy Source Available License, which allows production use only under a commercial agreement. That proprietary code includes SSO with OIDC and SAML, SCIM, audit logs and custom roles. If your compliance program depends on SSO, SCIM or audit trails, you need those features and a commercial agreement. Otherwise, you can build the controls with your existing identity provider and centralized logging. Confirm the license terms in LICENSE_PROPRIETARY.md with Dokploy before you commit.
Can our team move the workloads without outside help?
A team with Linux, Docker, reverse proxy and database operations skills can do it alone, and Coolify's documentation covers the core steps. The harder parts are backup and restore, TLS and DNS cutover, monitoring, patching and an on-call rota. Coolify's own guidance notes that a rollback can redeploy an application image but does not restore databases or persistent files, so backups are your responsibility. Assess your team against those tasks honestly. If one or two people carry the platform, plan for absence and documentation from the start.
What does our team need to provide before the move starts?
You need servers in the EU region you select, named owners for each app and database, access to DNS and TLS decisions, and a restore test that proves your backups work. Coolify requires at least 2 CPU cores, 2 GB RAM and 10 GB of free disk on a supported Linux distribution, and Dokploy requires at least 2 GB of RAM and 30 GB of disk, according to their installation docs. Plan for a staging environment, a written DNS cutover sequence and a rollback path. Before work starts, confirm these items against your environment, because sizing depends on your workloads.
When does a fixed-scope engagement make sense for an EU move?
A fixed-scope engagement helps when the move has defined boundaries, such as a set of apps, databases and environments with a clear residency target, and when internal capacity is limited. DeployOpen plans, implements, hardens, backs up, documents and supports self-hosted platforms inside your own infrastructure, and most engagements are scoped and priced in writing before work starts. DeployOpen also prepares systems and evidence for compliance assessments but does not issue audit reports or certifications. Ask for a written scope listing deliverables, restore testing, and what remains with your team.
What the global CDN and managed edge features give up
A self-hosted Coolify or Dokploy server has no global edge network by default. Static assets, Next.js build output and cached responses are served from the region where the server runs, so users far from that region will see higher latency than they did on Vercel's CDN. Before cutover, measure time to first byte and asset load from the locations your users actually sit in, and decide whether that gap is acceptable for each application. The decision is not only about speed: a CDN in front of the app changes where personal data flows, so it must be treated as a separate decision.
If you add a CDN, the provider sees every request, including IP addresses, URLs, headers and cookies that reach the edge, so it acts as a processor for that traffic. Check where its points of presence terminate TLS, whether it caches or logs request data, which sub-processors it uses, and whether it is subject to third-country access laws. Restrict the CDN to static assets where possible, and keep authenticated or personal-data routes pointed at your own origin. Confirm the CDN's data processing terms and EU processing options with the vendor, because these are not something this page can state for any specific provider.
Vercel-specific features need explicit work in containers. Functions that rely on Vercel's runtime, the image optimization pipeline and the Incremental Static Regeneration cache do not carry over automatically, so plan for a Node.js or Docker build with output: "standalone", a self-managed image optimizer, and a shared cache handler if you run several instances. The Next.js deployment docs list Vercel and Bun as verified adapters that pass the full compatibility test suite, while Cloudflare and Netlify say they are working on verified adapters. Ask your framework version and target platform for their adapter status before you assume a feature will behave the same way.
How DeployOpen plans and delivers an EU-resident deployment
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, so the Next.js apps, functions and databases you keep in the EU run on servers you control. We start with a written scope that names the data flows, the hosting locations and the parts of Vercel that will not carry over, then build and hand over the system with evidence for your assessors.
How we scope
- Map every Vercel function, environment variable, database and third-party service that touches personal data before choosing hosts.
- Record which regions, data centers and cloud accounts will hold app data, backups and build artifacts.
- Agree in writing which features move, which are replaced and which, such as the global CDN, will not be available.
How we build
- Install Coolify or Dokploy on EU-located servers you own or contract, with the reverse proxy, TLS and DNS configured for your domains.
- Configure build types for your Next.js app, database backups to EU-located S3-compatible storage, and access controls for the admin interface.
- Test restores, rollbacks and preview isolation, and document the transfer path, including any remote access from outside the EEA.
How we hand over
- Deliver runbooks for deployments, backups, restores, patching and certificate renewal, written for your platform team.
- Provide a data flow record and configuration evidence that your compliance and legal teams can review with their own advisers.
- Walk your engineers through the system and confirm cutover steps, with DeployOpen preparing controls and evidence, not issuing audit reports.
How we support
- Support upgrades to Coolify or Dokploy releases, operating system patches and changes to the Next.js app as a retainer.
- Run security testing of the deployed applications and APIs on a schedule agreed in the written scope.
- Ask your independent auditor or assessor to confirm the scope of any compliance evidence before work starts.
