Medusa is an open-source commerce platform started in Copenhagen in 2021 by Sebastian Rindom, Nicklas Gellner and Oliver Juhl. The core is a Node.js / TypeScript framework of composable commerce modules (products, carts, orders, pricing, promotions, inventory, fulfilment) plus a React admin dashboard, published under the MIT licence on GitHub with roughly 35,700 stars. Merchants named publicly by the vendor include Heineken, Mitsubishi Motors Netherlands, Eight Sleep and Redington; the Mitsubishi Netherlands store is self-hosted and was delivered by an implementation partner.
There are two ways to run it, and the sovereignty verdict differs sharply between them.
Medusa Cloud is the managed offering, from $29 per month (about €25) on the Develop plan, then $99 and $299, with no GMV fee. A project picks one region at creation and cannot change it later: US East (us-east-1), Europe Central (eu-central-1) or Asia Southeast (ap-southeast-1). An EU region is therefore available but is not the default, and Medusa does not publicly name the underlying cloud provider, though the region codes and the per-environment private S3 bucket match AWS naming. The decisive fact for procurement is corporate rather than geographic: the Cloud terms of service and the DPA are both concluded with MedusaJS, Inc., a Delaware corporation, under California law, and Danish registry data lists that same US corporation as the sole owner of the Danish operating company. CLOUD Act exposure for the managed service is therefore Direct. The DPA is public and readable without an account, but no sub-processors list is published and Medusa holds no certification of its own, saying only that its infrastructure provider maintains GDPR-aligned controls and certifications that Medusa leverages.
Self-hosting is the other path and it is genuinely unconstrained: the MIT licence carries no GMV cap and no paid commercial tier, and Medusa states there is no lock-in and that data can be exported at any time. Run on Hetzner, OVHcloud or Scaleway, no US counterparty touches the data at all.
Best fit: developer teams and agencies building bespoke commerce on Node.js. EU buyers who need a clean sovereignty story should take the self-hosted path rather than Cloud.