What self-hosting does for GDPR
Self-hosting gives you control over where personal data physically sits and who can touch it — encryption keys, retention rules, access policies, and audit trails are yours to set. For a team that cares about data residency and minimising third parties, that is genuinely useful. But control is the means, not the end: GDPR judges what you do with the data, not where the server is.
The myth: self-hosting equals compliance
It does not. If you decide why and how customer data is processed, you are the data controller and carry primary responsibility, whether you self-host or use SaaS. Moving the servers into your VPC changes the residency and the risk surface; it does not discharge a single obligation. This is the single most important thing to get right, and the most commonly oversold.
Residency is not the same as a storage rule
A common misreading: that GDPR requires personal data to stay in the EU. It doesn't. GDPR's Chapter V restricts transfers of data outside the EEA unless there's an adequacy decision or appropriate safeguards — that's a rule about transfers, not a mandate to store everything locally. Self-hosting lets you choose your data's jurisdiction, which can simplify transfers, but the obligation is about how you move data, not merely where you keep it.
Your logs are personal data too
One under-appreciated point: the consent records and audit logs you keep to prove compliance themselves contain personal data. They need a lawful basis, minimisation, security, and a retention limit like any other data. Built-in consent tracking, suppression, and audit logs are tooling that supports compliance — they make the obligations operable. They are not a substitute for the legal work, and they don't replace a data protection officer or legal counsel.