Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Sylius

VERIFIED
E-commerce · Poland
Founded 2011 · sylius.com ↗

Polish open-source Symfony e-commerce framework (MIT); commercial Plus modules from €800/yr GMV-based.

In short

Sylius, in the E-commerce category, is an EU-owned service with Poland as its hosting location and no identified CLOUD Act exposure.

Assessment notes

Sylius sp. z o.o. (Opole, PL, NIP 7272867768) is EU-owned and MIT open-source with no US hosting dependency when self-deployed. Signals: EU-owned ✓, no CLOUD Act exposure ✓. No public DPA, no sub-processors list, and no certifications: the commercial Plus licence adds SLA support but not compliance documentation.

CLOUD ACT
OWNERSHIP
SUB-PROCS
— not disclosed
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Sylius

Sylius (Sylius sp. z o.o., Opole, Poland, founded 2011) is an open-source e-commerce framework built on Symfony/PHP, serving 10,000+ online stores with 700+ community contributors. The core is MIT-licensed and free to self-host; the commercial Sylius Plus licence adds enterprise modules (B2B Suite, Marketplace, Multi-store, Returns Management, Loyalty) with pricing starting from €800/year scaled to GMV. Sylius is on-premise by design: there is no proprietary managed SaaS; merchants self-host on their own EU infrastructure (Hetzner, OVH, Scaleway) or via the Platform.sh PaaS partner, keeping full data control. When self-hosted on EU infrastructure, CLOUD Act exposure is effectively zero. Best fit for mid-market merchants who need deep Symfony customisation, B2B/wholesale flows, or multi-store setups and prefer full control over a managed SaaS. No public DPA or sub-processors list published; enterprise buyers should request via sales.

SUB-PROCESSORS

Sub-processor map · not disclosed

Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-05-21).
FEATURES

Capability matrix

Self-hostable Yes
Recurring / subscriptions Yes
Multi-currency Yes
Multilingual Yes
Product variants Yes
Multi-vendor marketplace Yes
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option Yes
PRICING

Pricing & tiers

FREEMIUM
Custom pricing

Contact vendor for tier or volume pricing.

View pricing page ↗
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    — missing
    missing
  • Terms of Service
    sylius.com/terms-and-conditions…
    Open ↗
ALTERNATIVES

Alternatives in this category

Shopware
Germany · Founded 2000
EU-HOSTED

German mid-market commerce platform (Schöppingen, est. 2000); Cloud entry €600/mo. PayPal owns ~41% as of Oct 2025.

Public DPA Sub-processors Open source
FROM
€600/mo
CLOUD ACT
MATERIAL
View profile →
PrestaShop
France · Founded 2007
EU-HOSTED

French open-source e-commerce with hosted SaaS option; parent group Fortidia is an Oaktree Capital portfolio company.

Public DPA Sub-processors Open source
FROM
—
CLOUD ACT
MATERIAL
View profile →
MyCashflow
Finland · Founded 2007
EU-SOVEREIGN

Finnish all-in-one e-commerce SaaS with own Helsinki hosting and 0% commission across plans.

Public DPA Sub-processors Open source
FROM
€49/mo
CLOUD ACT
NONE
View profile →
See all e-commerce alternatives →