Zuvo supports building GDPR-compliant applications. Building a compliant application is a shared responsibility: Zuvo secures the underlying infrastructure, while you're responsible for your application's data processing activities, consent flows, and access controls.
Data residency
Each Zuvo project is deployed to a single primary region, and your project's primary Postgres database, Auth service, and Storage objects are hosted in that region. Choosing a specific region within the EU pins these services to that exact AWS region.
Note that the "Europe" general region grouping also includes London (UK) and Zurich (Switzerland) — both have GDPR-adequacy data protection regimes, but neither is an EU member state. If your compliance requirements call for data to stay within the EU specifically, choose a specific EU region rather than the general Europe grouping. See available regions for the full list.
Choosing a region is a data-location control and does not make your application GDPR compliant on its own. Backups, logs, data exported to external systems, Edge Function execution, and sub-processors can affect your data residency and international transfer analysis.
Data processing agreement (DPA)
If you need a formal data processing contract under GDPR, Zuvo provides a Data Processing Agreement (DPA). Request or view the DPA.