Penpot vs Miro
Penpot is a European alternative to Miro: same use case, headquartered in Spain and governed by EU GDPR, while Miro is based in the United States.
By the EU Alternatives team Last updated
Design tool that connects designers and developers seamlessly. Create prototypes, UI designs, and generate code in one platform with no handoff drama.
- Jurisdiction
- EU / EEA
- Primary privacy law
- EU GDPR
- US CLOUD Act exposure
- No
- Open source
- Yes
- Free tier
- Yes
An online whiteboard teams reach for out of habit: infinite canvas, templates and integrations that make workshops easy to run and hard to leave. A free plan exists with tight board limits, then Starter costs 8 dollars per member monthly billed annually. The legal entity is RealtimeBoard, Inc., registered in San Francisco, with Amsterdam as a co-headquarters that does not change the US parent.
- Jurisdiction
- United States
- GDPR by default
- Requires DPA + TIA
- US CLOUD Act exposure
- Yes
Penpot vs Miro at a glance
| Penpot | Miro | |
|---|---|---|
| Headquarters | Spain | United States |
| Data jurisdiction | EU / EEA | United States |
| Primary privacy law | EU GDPR | Requires DPA + transfer assessment |
| US CLOUD Act exposure | No | Yes |
| Best for | Teams that need this built for European data-protection requirements | Teams already invested in the Miro ecosystem |
Choose Penpot if…
- You want a provider governed by a European privacy regime
- GDPR or public-sector data-protection requirements apply to you
- You want to start free and scale up later
- Open-source code and self-hosting matter to you
- You'd rather back the European tech ecosystem
Stick with Miro if…
- You depend on integrations only available in the Miro ecosystem
- Your organisation has no EU data-residency constraints
- Migration costs outweigh the jurisdiction benefits for now
About Penpot
Penpot is the world's first open-source design tool built on open standards (SVG, CSS, and HTML), so every design file is readable without proprietary software. Made by Kaleidos in Madrid, Spain, it covers the full design workflow: vector editing, component libraries, responsive prototyping, and CSS-ready developer handoff, all running in the browser.
Teams use penpot.app (EU-hosted cloud) or deploy a self-hosted instance via Docker in minutes. Native design tokens link design decisions directly to code variables, eliminating the back-and-forth of traditional handoff. Developers inspect real CSS values, copy HTML snippets, and export assets without a separate handoff tool.
Key benefits:
- Open standards (SVG/CSS/HTML) keeping files vendor-neutral and parseable by any tool
- Design tokens as a native feature linking design decisions directly to code variables
- Real-time collaboration with multiplayer editing, comments, and shared cursors
- Prototyping with transitions, interactions, scroll behaviour, and presentation mode
- Developer inspect mode with copy-paste CSS, HTML, and asset export
- Self-hosting via Docker for complete data sovereignty on your own infrastructure
- Free and open-source under AGPL with no per-seat pricing in the community edition
- Component libraries with master components, overrides, and nested instances
Penpot's cloud service is hosted in the EU with GDPR-compliant data practices. As a fully open-source project (AGPL) maintained by Kaleidos in Spain, self-hosting teams keep all design data on their own servers, with no telemetry, no lock-in, and no dependency on U.S. design SaaS infrastructure.
Used by hundreds of thousands of designers and developers worldwide, with 40,000+ GitHub stars and an active community that includes contributors from across Europe.
Why choose Penpot over Miro?
The decisive argument is data jurisdiction. Miro is headquartered in the United States, which means personal data processed through it can be subject to non-EU legal regimes: the US CLOUD Act, FISA 702, or similar laws depending on the provider. After the 2020 Schrems II ruling, EU organisations must carry out a transfer impact assessment for every such data flow.
Penpot removes that overhead. As a Spain-based provider, it operates under EU GDPR, and data stays inside the EU/EEA by default. For regulated sectors such as health, public administration, and finance, that's not a nice-to-have but a requirement. For everyone else, it's concentration-risk insurance: you avoid depending on a single jurisdiction that can change the rules without warning.