Self-hosted Figma alternative for EU data residency

Why a self-hosted Figma alternative for EU data residency is worth evaluating

A design organization bound by EU residency or transfer rules that has found Figma's regional hosting only partly covers its data should evaluate a self-hosted Penpot instance in an EU data center. That setup keeps design files, comments and accounts in one place, under the organization's own control. Figma's data residency solution is available only on the Enterprise plan, and Figma states that comments, file names, plugins, fonts and preview thumbnails are not hosted in the chosen region. Figma also does not localize Dev Mode code or AI chats, and it may store new file edits in the US for up to 30 days before moving them to the chosen region.

For a compliance or design operations lead, the gap is the point of the review. Personal data in comments, reviewer names in file metadata and the first weeks of edits to a file may sit outside the region the organization selected, so a data map that stops at the file store will be incomplete. Ask Figma for the current scope in writing, and list every data type your design work produces, from comment threads to shared library assets, before deciding which of them must stay inside the EU.

Self-hosting moves that responsibility to the organization. Hosting in an EU data center, operating PostgreSQL, Valkey and object storage, and handling backups, patching and access reviews become internal or contracted tasks, and the result is only as compliant as those operations and the hosting provider's own terms. This option is conditional on your infrastructure capacity, your hosting contracts and a legal review of transfer exposure under GDPR and the EU Data Act. Confirm those questions before committing to a migration.

What the EU residency constraint requires in practice

EU hosting alone does not settle where design data is reachable from. The cards below set out the transfer triggers, the Figma scope gaps and the legal uncertainty that together decide whether a self-hosted Penpot instance in an EU data center is the simpler position for Self-hosted Figma alternative for EU data residency.

Every third-country transfer needs Chapter V

Under GDPR Article 44, any transfer of personal data to a third country, including onward transfers, must meet the conditions in Chapter V. Design files often carry personal data in comments, mentions, author names and shared prototypes, so the question is not only where the main file store sits. Ask each vendor to map every location where personal data is stored, processed or forwarded, including support tooling and backups, before you accept an EU hosting claim.

Remote access from abroad counts

EDPB Guidelines 05/2021 treat remote access from a third country as a transfer, even when the data is only displayed on a screen for support or administration. A vendor's engineers or support staff outside the EEA who open a customer's design file therefore create a transfer, regardless of where the file is stored. Ask who can access production data, from which countries, and under what logged approval process.

Cloud storage outside the EEA counts

The same guidelines state that storing data in a cloud outside the EEA is a transfer. Figma's residency option stops short of this for some data types, and its documentation says new edits may be stored in the US for up to 30 days before moving to the chosen region. A self-hosted Penpot instance in an EU data center, with PostgreSQL and object storage under your control, keeps these copies in one jurisdiction you can name.

Figma residency covers less than the headline

Figma's residency option is available only on the Enterprise plan. Even on that plan, comments, file names, plugins, fonts, preview thumbnails, Dev Mode code and AI chats are not localized to the chosen region. Each of these can contain confidential product or customer information. Ask Figma in writing which data classes are covered in your region before treating the whole workspace as EU-resident.

Transfer tools remain legally uncertain

The CJEU invalidated the EU-US Privacy Shield in Case C-311/18 (Schrems II) while upholding standard contractual clauses. Commission Implementing Decision (EU) 2023/1795 adequacy for US organizations on the Data Privacy Framework List is under appeal as Case C-703/25 P. If your vendor relies on that framework, the position could change, so plan for an exit that does not depend on it.

Data Act switching rights

Since 12 September 2025, the EU Data Act gives customers of data processing services the right to switch to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition. Switching charges are banned from 12 January 2027. Use these rights to write exit terms into any renewal, and confirm with your vendor how design files and libraries would be exported in a usable form.

Which open-source options fit an EU-only design environment

This table compares self-hosted Penpot, Penpot cloud on EU hosting and diagram tools for an EU-only design environment. Read each row against where design files, comments and accounts must physically sit, and confirm residency terms with each vendor before relying on them. The main takeaway is that self-hosting in an EU data center gives the organization direct control over every component, while vendor-hosted options depend on contract terms.

Option	How it meets the constraint	Trade-offs
Penpot self-hosted in an EU data center	Design files, comments, accounts and uploaded objects run on servers the organization chooses, in the EU region it selects	Licensed under MPL-2.0 with no license fee, but the organization operates PostgreSQL, Valkey and storage. Deployment uses Docker Compose or the official Helm chart.
Penpot cloud on EU hosting	Only if the vendor confirms in writing that the hosting region and all data categories, including comments and accounts, stay in the EU	Residency terms must be confirmed with the vendor. Confirm where backups, logs and support access sit.
Penpot prototyping and migration limits	Migrated files keep their design structure, so residency is unaffected by the exporter	The Figma exporter plugin does not support prototyping settings, so prototype flows need manual rebuilding in Penpot.
draw.io for diagrams	Diagrams are saved where the user chooses, on the device or a connected storage service, and never on draw.io servers	Diagramming only, not interface design. Apache 2.0 licensed, but maintainers do not accept pull requests.
Excalidraw for whiteboards	MIT licensed and offers end-to-end encrypted collaboration, so board content is unreadable to the host	Whiteboard and sketching only. Confirm the hosting location if it runs as a hosted service rather than self-hosted.
Nextcloud Whiteboard	Runs inside a self-hosted Nextcloud instance, so boards stay on servers the organization controls	Built on Excalidraw and licensed under AGPL-3.0. Requires a Nextcloud deployment to operate.

How to deploy Penpot in an EU data center step by step

This sequence takes a team from choosing an EU data center to a Penpot instance that holds design files, comments and accounts in one place, with backups, login controls and a migration checked against the original Figma files.

Confirm the EU data center and provider terms
Your infrastructure or security lead selects the EU data center, whether that is your own facility or a cloud or hosting provider's EU region, and confirms the provider's contract terms for data location, support access and subprocessors. Ask the provider in writing where backups, logs and snapshots are stored and who can access the hosts. The step is complete when the region, contract and access list are recorded in your data inventory. Where a third-country provider is involved, assess its exposure to foreign access requests before you engage it, since the EDPB's guidance treats that exposure as a question for the controller.
Size PostgreSQL, Valkey and object storage
Your platform engineers size three components. Penpot supports only PostgreSQL, with version 13 or later recommended, so you need a managed or self-run instance with backups enabled. Valkey coordinates websocket notifications between sessions. Uploaded objects go to the filesystem or to an S3-compatible store such as MinIO. Confirm capacity against your expected number of editors and the size of your largest library. The step is complete when each component has a named owner, a version and a sizing note that the team has reviewed.
Deploy Penpot with Docker Compose or Helm
Platform engineers deploy the stack using the Docker Compose files from the Penpot technical guide or the official Helm chart, depending on your container platform. Penpot also documents OpenShift, Rancher, Elestio and TrueNAS as deployment options, so choose the one your operations team already supports. Set the public URL, database connection and storage settings in the configuration file before the first start. The step is complete when the web interface loads over HTTPS from inside your network and a test file can be created and reopened after a container restart.
Connect login and turn off open registration
The identity team connects Penpot to your directory. Self-hosted Penpot supports generic OpenID Connect for single sign-on and LDAP, alongside email and password login and the Google, GitHub and GitLab OAuth options. Choose the method that matches your identity provider and remove any login method your policy does not allow. Then disable self-registration so that only accounts created or approved by administrators can sign in. The step is complete when a test user can sign in through the chosen method and a self-registration attempt is refused.
Configure backups for database and object storage
Operations staff schedule backups for PostgreSQL and for the object storage used for uploaded assets, and they must back up both together so that file references and stored objects stay consistent. Store copies in the same EU region or another location your data policy allows, and encrypt them. Test a restore into a separate environment and time how long it takes. The step is complete when a restore has been run successfully and the result, including any mismatched assets, is written into the runbook.
Plan upgrades against published Penpot releases
The platform team sets a regular review of the Penpot release notes on GitHub and a staging environment where each new version is tested before production. Releases have followed in quick succession in recent months, so check each one for database migrations, configuration changes and changes to the Valkey or storage requirements before you apply it. Keep the previous container images and a database backup from just before each upgrade so you can roll back. The step is complete when a documented upgrade has been rehearsed in staging with a recorded rollback path.
Migrate Figma files and check fidelity
Designers and a migration owner move files with Penpot's Figma exporter plugin, which converts Figma files into a .zip that Penpot can import. Start with a pilot set of files that includes components, variants, auto layout and shared libraries, and note that prototyping settings do not convert. Compare each imported file with its original for text, component structure and layout, and record the differences that designers must rebuild by hand. The step is complete when the pilot files have been signed off by their owners and the list of known gaps has been agreed.

What a self-hosted Penpot instance does not solve on its own

Hosting in an EU region does not settle the legal question by itself. A controller still has to assess whether any party with access to the data is exposed to third-country law. Under GDPR Article 44, remote access from a third country, even just displaying data on a screen for support, counts as a transfer under the EDPB's Guidelines 05/2021, so the question covers operators and support staff as well as storage. The EU-US Data Privacy Framework is also not a settled basis: Commission Implementing Decision (EU) 2023/1795 covers only US organizations on the Data Privacy Framework List, and an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. Confirm with counsel which transfer mechanism, if any, applies to each vendor in your chain, and record that assessment before go-live.

Encryption and EU hosting also do not remove US reach where a provider holds data in its possession, custody or control. The CLOUD Act provision at 18 U.S.C. 2713 applies regardless of data location, and the EDPB Recommendations 01/2020 state that where a provider needs data in the clear and the authority's powers exceed what is necessary and proportionate, no effective technical supplementary measure can be envisioned. For a self-hosted Penpot instance, the practical questions are which people and vendors can reach the database, the object storage and the hypervisor, and whether any of them sit outside the EEA. Ask your managed service provider, your hosting provider and any DeployOpen-style implementation partner where administrators log in from, and write those locations into the processing records.

The migration path has its own gap. The Penpot Figma exporter plugin converts components, variants, auto layout, libraries and text into a .zip that Penpot can import, but it does not support prototyping settings. Teams that rely on Figma prototypes should plan to rebuild those flows in Penpot or in a dedicated prototyping tool, and should list every affected file before the cutover. Check fidelity on a sample of files from each team, not only on the largest ones, and keep the original Figma files available until sign-off.

Evidence a DPO or auditor will ask for under this constraint

A data residency decision is only as strong as the records behind it. The cards below list the artifacts a data protection officer, auditor or security reviewer will usually request, so the team can build them while the Penpot instance is being set up rather than after a question arrives. DeployOpen prepares this evidence as part of implementation, but it does not issue audit reports, attestations or certifications; independent auditors and certification bodies do.

Data flow map of the EU instance

A diagram showing every place design files, comments, uploaded objects, accounts and logs are processed or stored, with each location marked as inside the EU. For a Penpot deployment this covers the application containers, the PostgreSQL database, Valkey, the filesystem or S3-compatible store, mail relay, and any reverse proxy or CDN in front of it. Check that nothing in the chain, including the browser fonts or external OAuth providers, sends content outside the region. Revisit the map whenever a login provider or storage backend changes.

Processor and sub-processor register

A list of every service that touches personal data, with the legal entity, the country of processing and the country of storage. For a self-hosted instance the main entries are the hosting provider or data center operator, the backup provider, the email provider and any identity provider used for single sign-on. Ask each vendor for its current sub-processor list and where that list is published, and record the date you checked it. The register should match what the data flow map shows.

Access control and SSO configuration exports

Exported settings that show who can sign in, how, and with what rights. Self-hosted Penpot supports email and password login by default, plus Google, GitHub and GitLab OAuth, generic OpenID Connect and LDAP, so the record should state which method is enforced for each group and whether local password login is disabled. Keep the configuration file, the group mapping and a list of administrator accounts, dated and stored under change control. Confirm the exact keys in your release before exporting them.

Backup and restore test records

Evidence that the database and object storage can be restored into the EU region, and that a restored instance opens the same design files. Record the backup schedule, the storage location of each backup copy, who holds the encryption keys, and the date and result of each restore test. A backup copy held outside the region counts as a transfer or storage location, so it belongs in the data flow map. Ask the operator to confirm how long backups are retained.

Transfer impact assessment and remote access restrictions

A written assessment of whether any person outside the EU, or any provider subject to non-EU law, can access the data, including remote support sessions where someone only views a screen. The EDPB guidelines treat such viewing as a transfer, so the record should list support paths, who holds administrative credentials and where administrators sign in from. Document the legal basis for any transfer that remains, and the controls that limit third-country access to the instance.

Figma-to-Penpot migration and fidelity log

A log of each file moved from Figma, with the export date, the exporter version used, the import result and a fidelity check against the original. Penpot's Figma exporter plugin converts components, variants, auto layout, libraries and text, but it does not carry prototyping settings, so the log should name every file where those were lost. Record who reviewed each file and where the original .fig or exported copy is kept, since older Figma copies may still sit outside the region.

Questions buyers ask before engaging an implementation partner

What drives the cost of self-hosting Penpot?

Most of the cost is staff time and infrastructure, not licensing, because Penpot is licensed under the Mozilla Public License 2.0. The recurring parts are the servers that run the application, a PostgreSQL database (Penpot supports only PostgreSQL, recommending version 13 or later), Valkey for websocket coordination, and storage for uploaded objects on the filesystem or in S3-compatible storage such as MinIO. The one-time parts are the migration, identity setup and testing. Costs rise with user count, file volume, backup scope and the number of environments you run. In a fixed-scope quote, ask for each component listed separately, who operates it after go-live, how backups and restore tests are handled, and what is excluded from the price.

How long does a Figma to Penpot migration take?

The duration depends on what you have in Figma, not on a fixed rule. The main drivers are file size, the number of libraries and components, how heavily teams use variants and auto layout, and how much fidelity checking your designers require after import. Penpot's Figma exporter plugin converts files into a .zip that Penpot can import, but it does not carry prototyping settings, so any prototype-dependent workflow needs rework. A practical way to scope the work is to run a pilot on a representative set of files, measure how many need manual correction, and then size the full move. Ask any partner to base its timeline on that pilot rather than on a generic estimate.

Can our own team deploy and run Penpot without a partner?

Often yes, if you already run containerized services and PostgreSQL. Penpot documents self-hosting with Docker Compose and an official Helm chart, and also covers OpenShift, Rancher, Elestio and TrueNAS. The skills you need are container or Kubernetes operations, PostgreSQL administration, object storage, reverse proxy and TLS configuration, identity integration and backup and restore. Login can use email and password by default, or Google, GitHub, GitLab, generic OpenID Connect or LDAP. A partner is most useful for the parts your team does not run regularly, such as the identity integration, evidence for compliance reviews and upgrade testing. Confirm the exact steps against the current Penpot technical guide before you plan the work.

Is Penpot cloud on EU hosting an alternative to self-hosting?

It can be, but it is a different control model, so confirm the details with the vendor before you rely on it. Penpot publishes cloud plans, including a Private Server option, on its pricing page. Ask in writing where the application, database, backups, uploaded files and support access are located, which sub-processors are involved, whether any of them are subject to non-EU law, and how the provider responds to government access requests. Also ask whether the Private Server tier runs in infrastructure dedicated to you and who holds the keys. If the answers do not meet your residency rules, self-hosting inside your own EU data center keeps those decisions in your hands.

Can Figma files be fully exported, and what do .fig and .jam files leave out?

Figma's local copies are .fig, .jam or .deck files, and Figma describes these formats as proprietary and subject to change. Based on Figma's help documentation, these local copies do not include version history or comments, so they are not a complete record of collaboration. Owners can also restrict copying, which can block a bulk export. Before migration, inventory files for comments, version history, plugin data, fonts and libraries, and decide which of these must survive the move. Penpot's exporter handles design content such as components, variants, auto layout and text, but does not carry prototyping settings. Keep a retained archive of the original files for the records you must keep.

How do EU Data Act switching rights apply to moving off Figma?

The EU Data Act has applied since 12 September 2025 and gives customers of data processing services the right to switch to another provider or to on-premises ICT infrastructure. Under the Act, the notice period can be up to two months and the transition period is 30 days, and switching charges are banned from 12 January 2027. Whether these rights cover your specific Figma contract, and how they interact with your Enterprise terms, is a question for your legal counsel. Your move plan should record the notice you give, the export steps you take and the evidence that your data left the service. Confirm the mechanics with Figma and with your counsel, not only with this summary.

What does DeployOpen cover in a Penpot engagement?

DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure, including cloud accounts, data centers or air-gapped networks. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. For a Penpot project, that could include deployment, identity integration, migration planning and evidence for compliance assessments. DeployOpen prepares systems, controls and evidence but does not issue audit reports or certifications. Ongoing support and upgrades are available as retainers, and a quote follows from the written scope.

How a Figma to Penpot migration runs under the residency constraint

The migration starts with an inventory, because the residency problem is not only the design files. Before any export, the team should list every Figma file, shared library, team project and plugin in use, and record which files hold comments, which depend on fonts that are not standard, and which are owned by people who have left. Figma does not localize comments, plugins, file names, fonts or preview thumbnails, so each of these needs a decision on where it will live after cutover. Ask the Figma admin to confirm, for the Enterprise plan the organization holds, exactly which data categories the localized hosting setting covers and which it does not, and write that list into the migration plan so the residency claim is tested against it rather than assumed.

Export then runs from controlled workstations. Penpot's Figma exporter plugin, maintained by Kaleidos under MPL-2.0, converts a Figma file into a .zip that Penpot can import, and it does not carry prototyping settings, so those must be rebuilt or documented by hand. Run exports only on managed devices located in the EU, under the same access rules that govern the design files, and store the resulting archives in an EU location with restricted access. Local .fig, .jam and .deck copies that Figma offers are a different route: they carry no version history and no comments, so they should not be treated as a backup of collaborative work. The design team must agree in writing what happens to comments, whether they are resolved, copied as notes into the Penpot file, or archived in a separate record with the original authors identified.

After import into the EU Penpot instance, the fidelity review is where most of the effort falls. Check components, variants, auto layout, shared libraries and text styles against a sample of production screens, with designers signing off on each file rather than a single spot check. Confirm that the instance's accounts, comments and uploaded objects sit only in the chosen environment, and that object storage, whether filesystem or S3-compatible, is also located in the EU. Cutover should follow an agreed date after which new work moves to Penpot, and Figma copies are retired according to the organization's retention and legal hold rules. Keep one dated record of the export, import and review results so that the data protection team can show what was moved, when, and by whom.

How DeployOpen deploys Penpot under EU residency requirements

DeployOpen plans, implements, hardens, backs up and documents self-hosted Penpot inside the client's own cloud accounts, data centers or networks, so design files, comments and accounts sit in one place under the client's control. Work starts from a written scope that records which EU region and hosting model apply to each data type.

How we scope

Map which design data, comments, accounts and uploaded assets must stay in the EU and which systems hold them.
Confirm the target EU data center, the PostgreSQL, Valkey and object storage layout, and the login method for staff accounts.
Agree deliverables, timelines and responsibilities in writing before work starts, as engagements are fixed-scope.

How we build

Deploy Penpot with Docker Compose, the official Helm chart or the platform your team already runs, inside your EU environment.
Configure single sign-on through generic OpenID Connect or LDAP, and set up PostgreSQL 13 or later with filesystem or S3-compatible storage.
Test file import, library behavior, access controls and backups, and record the results against your residency requirements.

How we hand over

Document the architecture, data flows, configuration keys, backup and restore steps, and upgrade procedure for your team.
Provide an evidence pack of settings and logs that your compliance lead and independent auditors can review.
Explain what the setup does not cover, such as legal transfer assessments, which remain the controller's responsibility.

How we support

Offer ongoing support, upgrades and continuous testing as a retainer after handover.
Plan Penpot version upgrades and test them in a staging copy before changes reach production.
Ask us to confirm scope for any change in hosting region, identity provider or storage backend.