Self-hosted Lucidchart alternative for EU data residency

Why a self-hosted Lucidchart alternative for EU data residency needs more than a region setting

Self-hosted draw.io can keep diagrams in storage your organization controls, but GDPR and data sovereignty still need checks on the hosting, storage and support chain. Lucid's global data residency, including an EU (Germany) region, is available on the Enterprise plan only and not on FedRAMP accounts. If your Lucidchart plan does not include it, or your account type excludes it, the question is no longer which region Lucid selects. It becomes which systems hold your diagrams, who can reach them, and under which law. Because draw.io's privacy policy says diagrams are saved where the user chooses and never on draw.io's servers, the storage decision moves to you. Confirm that decision in writing before you migrate anything.

Under GDPR, residency is only part of the test. Article 44 requires that every transfer of personal data to a third country, including onward transfers, meets the conditions in Chapter V. Diagrams often contain personal data such as system owners, customer names or process details, so they fall within scope. EDPB Guidelines 05/2021 treat remote access from a third country, even just displaying data on a screen for support, as a transfer. That means your DeployOpen or in-house administrators, your hosting provider's support staff, and any SaaS component that touches the diagram all belong in the review, not only the storage bucket.

The sections below work through each link in that chain: the access and legal exposure that a region setting does not remove, the hosting and storage choices that keep diagrams in your control, and the checks to run with your DPO, legal team and processors. Use them to build a short written position on where diagrams live, who can see them and how you would exit if the constraint changes.

What GDPR and data sovereignty require of a diagramming tool

A diagramming tool holding EU personal data has to answer for where that data is stored, who can reach it from outside the EEA, and which foreign laws can compel access to the provider. The cards below set out the checks that connect those questions for a self-hosted draw.io deployment and for a hosted Lucidchart account.

Transfers outside the EEA

Article 44 of the GDPR applies to every transfer of personal data to a third country, including onward transfers, and the conditions in Chapter V must be met for each one. Diagrams often contain names, system owners, network addresses and customer details, so they count as personal data when they describe people or identifiable records. Map every location where a diagram is saved, cached or processed, then confirm each one sits inside the EEA or under a valid transfer mechanism.

Remote access counts as a transfer

The EDPB's Guidelines 05/2021 treat remote access from a third country as a transfer, even when the person only views data on a screen for support or administration. An administrator in a non-EEA support centre who can open the diagram server, or a vendor engineer troubleshooting a hosted instance, therefore brings the data within Chapter V. Ask every vendor and contractor for their access locations and restrict administrative access to named EEA staff.

Limits of a region setting

A data residency option chooses where the provider stores data at rest, but it does not stop support staff or a parent company from reaching that data from elsewhere. Lucid's global data residency, for example, is limited to the Enterprise plan and does not cover FedRAMP accounts, so the setting alone answers only the storage question. Confirm in writing which processing, support, logging and backup functions stay in the chosen region and which do not.

Third-country legal exposure of a processor

The EDPB's Recommendations 01/2020 state that where a provider must access data in the clear and the destination's public authority powers go beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned. The US CLOUD Act at 18 U.S.C. 2713 reaches data in a provider's possession, custody or control wherever it is located. Before engaging a processor subject to such laws, assess that exposure, document it, and compare it with a self-hosted deployment where the organization holds the keys and the storage.

Transfer tools after Schrems II

The Court of Justice invalidated the EU-US Privacy Shield in Case C-311/18 but held that standard contractual clauses remained valid, so the clauses remain a common basis for transfers. The EU-US Data Privacy Framework adequacy decision applies only to US organizations on the Data Privacy Framework List, and an appeal against the General Court's ruling upholding it is pending. Check whether a vendor relies on the framework, on clauses, or on neither, and track the outcome of the appeal before signing.

Keeping diagrams where you choose

draw.io saves diagrams where the user chooses, on a device or in a connected storage service, and its privacy policy states that diagrams are never stored on its servers. Real-time collaboration and hosted export still pass diagrams through servers run by Cloudflare for processing. Self-hosting the jgraph/drawio Docker image places the application in your own infrastructure, and the export server is not part of that image, so confirm which features your deployment routes outside your network and where your storage sits.

Where Lucid's data residency option stops

Lucid's global data residency is an Enterprise plan setting, not a default, and it is not available on FedRAMP accounts. Lucid offers US, EU (Germany) and Australian regions under that plan, so an EU choice is only real once the reader confirms it in the signed contract and the account configuration. Before relying on it, ask the account owner to check which plan the organization holds, whether the EU region is enabled for the relevant workspace, and whether that setting is documented in the data processing terms. A region choice settles where Lucid stores the primary copy of a document. It does not, by itself, settle who can access the data from outside the EU, what support staff can view, or how sub-processors are used. Those points belong to the transfer assessment under GDPR Chapter V and to the vendor's contract, and they should be reviewed by counsel rather than assumed from the region name.

Exit is the second thing a region choice does not settle. Lucid's bulk export produces a .LAF file, a format that Lucid documents as restorable only within Lucid. That matters for a residency review because a backup taken for data sovereignty reasons may not be readable if the organization later leaves the platform or needs to recover content in its own environment. Individual documents can be exported to formats such as PDF, SVG, Visio, JSON and CSV, and the Lucid help center article on the EU Data Act describes how Lucid approaches portability. The reader should ask Lucid, in writing, what exports cover for their account, what is left out (comments and certain notes are commonly excluded, so confirm this), and whether any export format is usable outside Lucid.

If these answers are not satisfactory, the decision is about control rather than region labels. Self-hosted draw.io keeps diagrams in storage the organization selects, and its privacy policy states that diagrams are never saved on draw.io's servers. Confirm in your own environment which features, such as hosted export or real-time collaboration, send diagram data to third-party infrastructure before adopting the same workflow. Document the answers in a data flow record so that a residency review can trace where each diagram lives.

Which open-source options meet an EU residency constraint

This table compares self-hosted draw.io, Excalidraw, Nextcloud Whiteboard and Penpot on where diagram data is stored, license terms and the trade-offs that matter for an EU residency decision. Read the storage row first, because the answer depends on the deployment you run, not on the tool's brand. The main takeaway is that self-hosting moves the residency question to your own servers, where you must still confirm backups, logs and any external services you connect.

Option	Where data is kept when self-hosted	License	Trade-offs to confirm
Self-hosted draw.io (Docker image or desktop)	Diagrams save to the device or the storage service you connect, such as Nextcloud, OneDrive or GitLab; draw.io's privacy policy says diagrams never reach its servers	Apache License 2.0 for source code; icon sets and templates have separate terms	PDF export uses the browser print dialog unless an export server is configured; Lucidchart import is by copy and paste; Visio rendering can differ and embedded EMF images are not imported; the project does not accept pull requests
Excalidraw (self-hosted)	Boards live in the storage and database you deploy; end-to-end encrypted collaboration is available in the editor	MIT	Designed for free-form whiteboards rather than structured diagrams; confirm how your deployment stores rooms and scenes and who can reach the server
Nextcloud Whiteboard	Boards are stored inside your Nextcloud instance, so residency follows that server and its storage backend	AGPL-3.0	Built on Excalidraw; it depends on a running Nextcloud deployment, and you must confirm the collaboration backend sits in your chosen region
Penpot (self-hosted)	Design files are stored in the PostgreSQL database and file storage you run	Mozilla Public License 2.0	Aimed at interface design and prototyping rather than flowcharts; teams moving Lucidchart diagrams should expect a different editing model
Real-time collaboration on draw.io's hosted service	Hosted export and real-time collaboration process diagrams temporarily on Cloudflare servers, so this is not the configuration for a strict residency requirement	Not applicable	Choose self-hosted draw.io if residency is a requirement; confirm with your counsel whether any temporary processing counts as a transfer for your data

How to deploy draw.io in an EU-hosted environment

This sequence moves diagram storage and editing onto infrastructure you choose in the EU, so diagrams live in storage your organization controls. It ends with a documented data flow that your privacy and security teams can review.

Choose the EU hosting location and provider
Your infrastructure, security and privacy leads select the EU country, data center and hosting provider that will run draw.io, and confirm the contract terms that govern where data is stored and who can access the servers. Ask the provider in writing where backups, logs and snapshots are kept, and whether any support or administrative access can come from outside the EEA. The step is done when the location, provider and contract terms are recorded in your asset inventory. If your processor may be subject to third-country law with extraterritorial effect, record that assessment before you proceed, as the EDPB Guidelines 05/2021 advise controllers to do.
Run the official draw.io Docker image
Your platform team deploys the official jgraph/drawio Docker image on a server, container host or Kubernetes cluster that you administer, behind your internal TLS certificate and reverse proxy. The image is based on Tomcat and is kept up to date with the production app at app.diagrams.net, so plan a repeatable process for pulling new versions and testing them before rollout. The step is done when a test user can open the editor from an internal address, create a diagram and save it, with no dependency on public draw.io hosting.
Connect storage inside your boundary
Connect draw.io to the storage where your teams already keep documents, such as a Nextcloud instance or an internal file share, using the integrations listed in the draw.io documentation. Confirm that the storage server sits in the same EU environment and that access follows your existing identity and permission model. Test saving, reopening and sharing a diagram from the connected storage. The step is done when a diagram saved to the chosen storage can be opened by an authorized user and cannot be reached by an unauthorized one.
Confirm the export path
The jgraph/drawio Docker image does not include an export server, so PDF export uses the browser's print dialog unless you configure an export server. If you configure one, host it inside your network and confirm it is reachable only from internal addresses. In both cases, no diagram data leaves the server for an export. Test PDF, PNG and SVG export with a sample diagram while monitoring network traffic. The step is done when every export format produces a file and the traffic check shows no call to an external host.
Block unapproved outbound connections
Your network security team reviews the outbound traffic of the draw.io host and blocks any destination you have not approved. Review the draw.io privacy policy and trust page, which states that features such as hosted export and real-time collaboration process diagrams temporarily on Cloudflare servers, and decide whether those features stay disabled in your deployment. Confirm with the vendor which external resources the application loads, such as fonts, icons or update checks, and either allow them explicitly or serve them internally. The step is done when a firewall rule set and a test log show that only approved destinations are contacted.
Test the Visio and Lucidchart import path
Import a representative set of Visio files, stencils and Lucidchart diagrams into the self-hosted instance, using the import routes in the draw.io documentation. Record where rendering differs from the original, where interactive behavior is lost, and where embedded EMF images do not import. Decide which items need manual rework before the migration proceeds. The step is done when the test results are recorded and the team has signed off on the known differences.
Document the data flow and retain evidence
Write a data flow diagram that shows where diagrams are created, stored, backed up, exported and logged, the hosting location of each component, and every administrative access path. Keep the firewall configuration, deployment records, export test results and the processor contract together as evidence. This document supports your GDPR records of processing and the transfer assessment that Chapter V requires. DeployOpen can prepare this documentation and the supporting controls as part of a fixed-scope engagement, but independent auditors and certification bodies, not DeployOpen, issue any audit report or certification. The step is done when the document is approved by your data protection officer and stored with the deployment record.

Which transfer paths still need a decision

Where the storage sits decides most of the first question. The EDPB's Guidelines 05/2021 (version 2.0) state that storage in a cloud outside the EEA is a transfer, so a hosting contract that places diagram storage in a third country needs a Chapter V basis. Choosing an EU processor is not itself a transfer under Example 12 of those guidelines, but the same example points out that complying with a third-country authority request would be one, so the controller should assess that exposure before signing.

Region of storage: Confirm the physical location of the virtual machines, object storage, backups and logs, not only the provider's headquarters.
Provider's legal exposure: Ask whether the provider or its parent is subject to third-country law with extraterritorial reach, such as the US CLOUD Act at 18 U.S.C. 2713, which reaches data in a provider's possession, custody or control wherever it is located.
Data Privacy Framework status: The Commission's adequacy decision 2023/1795 covers only US organizations on the Data Privacy Framework List, and an appeal in Case C-703/25 P is pending, so do not treat it as settled.
Sub-processors: Map every onward provider, since onward transfers fall under Article 44.

Check these answers with counsel and your data protection officer before selecting a hosting region.

What auditors and regulators will ask for

An assessor reviewing a move from Lucidchart to self-hosted draw.io will want proof, not promises, about where diagrams live and who can reach them. The cards below cover the records you need to hold yourself, the contract and transfer analysis you need where a third party is involved, and the export path that keeps you from being locked in. DeployOpen prepares this evidence with you, but independent auditors and certification bodies issue any audit report or attestation.

Record of processing and transfer map

Your records of processing should list diagrams as a data set, with the purposes, categories of personal data they may contain (names in org charts, system owners, customer flows) and the storage locations. Map every place a diagram can travel: the browser session, the storage service you connect, backups, and any hosted export or real-time collaboration feature. Ask whether draw.io's hosted features are used in your deployment, since the trust page says those process diagrams temporarily on Cloudflare servers. Your transfer map is what turns that statement into a decision you can defend.

Hosting location and provider contract

Record the physical region and operator of every server and storage bucket that holds diagrams, including the cloud account or data center you control. If a hosting provider or storage vendor is involved, collect its data processing terms, sub-processor list and the location of its support access. Lucid's EU region sits behind an Enterprise plan and is not available on FedRAMP accounts, so compare that with a region you choose yourself. Confirm the contract terms with your provider rather than relying on a general statement from the vendor.

Administrative access logs

Assessors will ask who can open, administer and change the diagram platform, and how that access is recorded. Keep logs for the web server, the storage backend and the identity layer that gates access, and set a retention period that matches your policy. Remote access from a third country, including a support engineer who only views a screen, counts as a transfer under the EDPB guidance, so log remote sessions as well as storage access. Confirm where those logs themselves are stored.

Backup location records

Backups copy diagrams to another place, and each copy needs the same location record as the primary store. Document the backup site, its region, who holds the encryption keys and how long copies persist. Test that a restore produces working diagram files, because a backup that cannot be read will not satisfy an assessor reviewing recovery. If backups go to a provider outside the EEA, that copy is itself a transfer and belongs in the transfer assessment.

Transfer impact assessment

Where any personal data reaches a third country, or a provider subject to foreign law can be compelled to disclose it, a transfer impact assessment documents the legal and practical risk. The CLOUD Act reaches providers regardless of data location, which is why the EDPB says a supplementary measure may not be effective where the destination's access powers go beyond what is necessary. Note that the Data Privacy Framework decision is under appeal before the Court of Justice (Case C-703/25 P), so do not treat it as settled. Ask counsel to confirm the position for your specific provider.

Export and switching path

Regulators and procurement teams both want evidence that you can leave a platform. Document how diagrams leave the current tool: per-document exports to Visio, SVG, PNG and JSON on Lucid's side, and the draw.io import routes for .vsdx files and Lucidchart pastes. Lucid's .LAF bulk backup only restores into Lucid, so do not count it as an exit path. Record which diagrams convert cleanly and which need manual rework, because draw.io warns that Visio imports may change appearance and lose interactive behavior.

What does moving to self-hosted draw.io for EU residency cost and take?

What are the main cost components of moving Lucidchart to self-hosted draw.io?

The main components are hosting, storage, conversion effort and support. draw.io's source code is Apache License 2.0, so there is no license fee for the software itself, but the organization still pays for the servers or cloud accounts that run the jgraph/drawio Docker image, the storage where diagrams are kept, the time to convert and check diagrams, and ongoing operations such as patching and backups. Hosting and storage recur every month or year. Conversion and initial setup are largely one-time. Ask any quote to split these lines so you can compare them with your current Lucidchart seats and the Enterprise terms needed for data residency.

Which costs are one-time and which recur when self-hosting draw.io?

One-time costs cover the initial deployment, storage integration, testing, the conversion of existing diagrams and user onboarding. Recurring costs cover the servers or cloud capacity, backups, storage growth, monitoring, security updates and staff time to keep the service running. draw.io releases new versions frequently, so budget for regular upgrades rather than a single install. Ask the provider which items are fixed for the initial scope and which are priced as ongoing retainers, and how each is billed.

What drives the cost of a draw.io migration up or down?

The biggest drivers are the number of diagrams, how many use Visio, Gliffy or Lucidchart imports that need manual cleanup, the number of users, the storage system you choose, and whether you need SSO, backup and an export server. Diagrams that contain shape data or linked data may need extra checks. Visio imports may look different from the original and may lose interactive behavior, so visually complex diagrams take longer to review. A smaller, well-sorted library with a clear storage target is usually the least expensive path.

Can our internal team move from Lucidchart to self-hosted draw.io without outside help?

Yes, a capable team can deploy the official jgraph/drawio Docker image and run the migration internally, especially for a small diagram library. The work still needs someone to own hosting, access control, storage integration, backups and patching. It also needs time for a review of converted diagrams, because the Lucidchart copy-and-paste route and Visio import both need checking. Estimate the effort honestly against the staff who would do it, and decide who will run the service after go-live.

What does the work need from our side, including legal review?

Expect to provide hosting access in your cloud account, data center or network, a named owner for the service, storage and identity decisions, and a sample of diagrams for testing. For GDPR and data sovereignty you will need a legal or privacy review of where diagrams and any personal data sit, which storage services are connected, and whether any hosted export or real-time collaboration features process data on third-party servers. draw.io's privacy policy notes that Cloudflare handles some temporary processing, so confirm that against your own transfer assessment. Ask your counsel to review this before the scope is signed.

Do Lucidchart diagrams import into draw.io, and how long does it take?

Lucidchart diagrams can be imported into draw.io by copying everything in Lucidchart with the keyboard shortcut and pasting into the draw.io online editor, or by exporting to Visio and importing the VSDX file. Expect differences in rendering and possible loss of interactive behavior, and check that embedded EMF images are handled. Timing depends on scope, so confirm the duration with each provider against your diagram count and complexity. Do not assume a single schedule across all diagram types.

What should a quote for a self-hosted draw.io migration include?

A quote should list the written scope, the deployment target, the storage integration, the number of diagrams and users in scope, the conversion method for each diagram type, testing and sign-off criteria, backup and upgrade responsibilities, and the support model. It should separate one-time work from recurring retainers and name any third-party costs such as cloud hosting or storage. Ask how exit is handled too. Under the EU Data Act, customers can switch from a data processing service to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition, and switching charges are banned from 12 January 2027. Ask the provider and your current vendor how those terms apply to your contract.

What to confirm before you commit to an EU-hosted setup

Start by confirming your Lucid plan and account type, because the answer decides whether a vendor-side data residency option is even on the table. Lucid's global data residency, including its EU (Germany) region, is available on the Enterprise plan only and not on FedRAMP accounts. Check the contract and admin console, not the marketing page, and ask Lucid in writing what your current plan includes. Whatever the answer, record it: it is the baseline you compare draw.io against, and it determines whether you are moving data out of a region you already chose or out of a shared cloud you never configured for residency.

Next, confirm where the diagrams will physically sit. draw.io's privacy policy says diagrams are saved where the user chooses, on the device or in a connected storage service, and never on draw.io's servers. Decide which storage backend holds your .drawio files, such as a file share, Nextcloud or a Git repository in your own region, and map who can read it. Note that hosted export and real-time collaboration process diagrams temporarily on servers run by Cloudflare, so if you use the public editor at app.diagrams.net, confirm whether those features are permitted for your data class. A self-hosted Docker deployment keeps the editor itself in your environment, but you still need to verify the network path your users take. Run the Lucidchart export and restore test before anything else. Confirm that your diagram set converts to the formats draw.io imports, and that your storage and backup copies sit in the region you have approved.

Then assess third-country legal exposure for every processor in the chain, including your hosting provider, backup vendor and any support staff who can view data remotely. The EDPB's Guidelines 05/2021 treat remote access from a third country, even only displaying data on a screen, as a transfer, so an EU-region bucket does not settle the question if a non-EU administrator can see the content. Ask each processor whether it is subject to laws such as the US CLOUD Act (18 U.S.C. 2713), and whether it has a process for responding to foreign authority requests. Keep in mind that the Data Privacy Framework adequacy decision is under appeal (Case C-703/25 P), so treat it as a fact to recheck, not a settled basis. Finally, confirm the current release on the official jgraph/drawio releases page before you pin a version, and plan your own patch cadence, since the project does not accept pull requests and you own the upgrade schedule.

How DeployOpen deploys draw.io under EU residency requirements

DeployOpen plans, implements and hands over a self-hosted draw.io environment inside your own infrastructure, so diagrams are stored where your data protection and sovereignty decisions say they should be. We start with a written scope that maps your residency, transfer and storage requirements to concrete technical choices before any work begins.

How we scope

Engagements are fixed-scope, with scope and deliverables agreed in writing before work starts.
We document where diagrams, exports and integration data would sit, and which third-country access paths your team must assess.
We agree which storage services, identity sources and wikis or file platforms draw.io must connect to in your environment.
Quotes follow from the written scope, so you can compare options on the same defined work.

How we build

We deploy draw.io from the official jgraph/drawio Docker image or desktop app into your cloud account, data center or air-gapped network.
We configure storage integrations so diagrams save only to locations you choose, and we verify that hosted export is disabled or routed as you require.
We test import of your existing Lucidchart and Visio files, record rendering differences, and document the results for your review.
We harden the deployment, set up access controls and prepare the evidence your compliance team needs for assessment.

How we hand over

You receive architecture documentation, configuration records, runbooks and a list of data flows that your privacy and legal teams can review.
We walk your administrators through upgrades, backups of the diagram storage and the process for applying new draw.io releases.
We identify the residual decisions that stay with you, such as your transfer impact assessment and processor contracts.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
We can support periodic reviews of your self-hosted deployment as draw.io releases ship and your residency obligations change.
DeployOpen prepares systems and evidence for compliance assessments, but independent auditors and certification bodies issue any audit reports or certifications.