Directus

What Directus is

Directus is an open source headless CMS and data platform created in 2004 and now developed by Monospace Inc. with teams in Brooklyn (United States) and Bordeaux (France). It connects to any SQL database (PostgreSQL, MySQL, MariaDB, SQLite, MS SQL) and turns existing tables into a fully featured admin interface with REST and GraphQL APIs. Directus is published under a Business Source License that becomes open source after a delay, and most teams use it as a self hosted application running in containers on their own infrastructure. A managed offering called Directus Cloud is also available on Google Cloud Platform, with the ability to pick a hosting region including europe west.

What data Directus stores in the browser

By default Directus only sets technical cookies that are strictly necessary to operate the admin interface. The main cookies are directus_session_token (a short lived JWT used to authenticate the editor), directus_refresh_token (used to issue new access tokens, with a typical lifetime of 7 days) and directus_session_id (used by the admin app to track the session). There is no analytics, advertising or third party tracking embedded in the product. Public visitors of a website built on top of Directus do not receive any Directus cookie because they only consume the public API, which does not require a browser session.

Self hosted vs Directus Cloud under GDPR

When you self host Directus, you are the sole controller and the sole processor of the data, which makes the GDPR analysis very simple: data stays in the database you chose, in the region you chose, with the providers you contracted with. When you use Directus Cloud, Monospace Inc. acts as a processor and Google Cloud as a sub processor. You can pick a European region to keep data in the EEA and rely on the EU SCCs for any onward transfer. This flexibility is the main reason Directus is frequently selected as a GDPR friendly alternative to US first SaaS CMS platforms.

Regional residency options

For self hosted deployments, residency depends entirely on where the containers and the database run. Many teams deploy Directus on EU hosters such as Scaleway, OVHcloud, Clever Cloud, Hetzner or on the EU regions of AWS, Azure and Google Cloud. For Directus Cloud, the customer chooses a Google Cloud region at project creation time, including europe west which is suitable for European data residency commitments. Storage of uploaded files can be redirected to any S3 compatible bucket, which lets European customers store media on EU only object storage even when using Directus Cloud.

Integration with frontend frameworks

Directus is commonly paired with modern frontends such as Next.js, Nuxt, SvelteKit, Astro or Remix, which fetch content through the REST or GraphQL API at build time or on demand. Because the frontend does not need a Directus session, end users of the public website never receive Directus cookies and do not need a consent banner for the CMS itself. The cookie banner only needs to cover the analytics, advertising or chat tools that the frontend may add on top.

Practical compliance steps for self hosted deployments

To keep a self hosted Directus deployment compliant, document the hosting provider and region in your record of processing activities, restrict admin access through SSO or strong passwords plus multi factor authentication, enable role based access control to limit who can read personal data, configure backups with an appropriate retention period and rotate the admin secret keys. Add Directus and its sub processors (hoster, object storage, email provider) to your privacy policy, and remember that Directus cookies are strictly necessary so they do not require prior consent, only a clear mention in the cookie policy.