What self-hosting does for GDPR
Self-hosting gives you control over where personal data physically sits and who can touch it — encryption keys, retention rules, access policies, and audit trails are yours to set. For a team that cares about data residency and minimising third parties, that is genuinely useful — and if you are still choosing a platform, our roundup of open-source marketing automation tools compares options that keep customer data on your infrastructure. But control is the means, not the end: GDPR judges what you do with the data, not where the server is.
The myth: self-hosting equals compliance
It does not. If you decide why and how customer data is processed, you are the data controller and carry primary responsibility, whether you self-host or use SaaS. Moving the servers into your VPC changes the residency and the risk surface; it does not discharge a single obligation. This is the single most important thing to get right, and the most commonly oversold.
Residency is not the same as a storage rule
A common misreading: that GDPR requires personal data to stay in the EU. It doesn't. GDPR's Chapter V restricts transfers of data outside the EEA unless there's an adequacy decision or appropriate safeguards — that's a rule about transfers, not a mandate to store everything locally. Self-hosting lets you choose your data's jurisdiction, which can simplify transfers, but the obligation is about how you move data, not merely where you keep it. What self-hosting takes to run — the stack, the data model, the deployment — is laid out on our self-hosting architecture page.
Your logs are personal data too
One under-appreciated point: the consent records and audit logs you keep to prove compliance themselves contain personal data. They need a lawful basis, minimisation, security, and a retention limit like any other data. Built-in consent tracking, suppression, and audit logs are tooling that supports compliance — they make the obligations operable. They are not a substitute for the legal work, and they don't replace a data protection officer or legal counsel.