Can a self-hosted NetSuite alternative keep EU ERP data in the EU?
Yes, a self-hosted Odoo or ERPNext instance in an EU datacenter can meet most residency goals, but residency depends on who can reach the data, not only where it sits. NetSuite runs as a multi-tenant service from Oracle Cloud Infrastructure regions in North America, Europe and Asia Pacific, and the provider's operating model, support staff locations and legal exposure all have to be checked against your own obligations. Under GDPR Article 44, every transfer of personal data to a third country, including onward transfers, must meet Chapter V conditions. The EDPB's Guidelines 05/2021 treat remote access from a third country as a transfer, even when a support engineer only views data on a screen, and storage in a cloud outside the EEA is also a transfer.
That makes access control part of the residency design. Ask any hosting or support provider, including a hosted Odoo or ERPNext provider, where administrators sit, which subprocessors can open a database, and whether support sessions can display personal data from outside the EEA. The EDPB's Example 12 notes that using an EU processor subject to third-country law is not itself a transfer, but complying with a third-country authority request would be, so you should assess that exposure before you sign. The EDPB Recommendations 01/2020 also state that where the destination's public authority powers go beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned. Confirm these points with counsel and your provider in writing.
In practice, the options are a self-hosted deployment in your own datacenter or an EU provider's facility, with administrator access limited to named staff inside the EEA, or a hosted deployment with contractual and technical limits on remote access. DeployOpen plans, installs, hardens and documents the chosen Odoo or ERPNext platform inside your own cloud accounts or data centers, and prepares the access controls, logs and evidence that your data protection team will ask for. DeployOpen does not give legal opinions on transfer mechanisms and does not issue attestations. Your legal team, your data protection officer and an independent assessor make those determinations, and the scope of any engagement is agreed in writing before work starts.
What EU data residency requires from an ERP host
For an ERP holding customer, supplier and employee records, residency is less about where a server sits and more about who can reach the data, from where, and under which legal order. The cards below set out the transfer, access and legal-exposure questions to answer before choosing between a hosted ERP and a self-hosted one in your own or an EU provider's datacenter.
Transfers to third countries
Article 44 applies to every transfer of personal data to a third country, including onward transfers made later by a provider or its subprocessors. An ERP holds personal data in invoices, customer contacts, payroll exports and employee records, so each vendor or hosting entity in the chain needs to be mapped. Ask the provider for a list of subprocessors, their locations and the transfer mechanism used for each, and confirm that the list is kept current.
Remote access counts as transfer
The EDPB's guidelines state that remote access from a third country is a transfer, even if the person only views data on a screen for support or administration. Storage in a cloud outside the EEA is also a transfer. A hosted ERP can therefore involve transfers through support staff logging in from abroad, not only through where the database sits. Ask who can open production data, from which countries, and how those sessions are logged.
Schrems II and the Data Privacy Framework
The Court of Justice invalidated the EU-US Privacy Shield in *Schrems II* but held that standard contractual clauses remained valid. The EU-US Data Privacy Framework adequacy decision covers only US organizations on the Data Privacy Framework List, and an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. Ask a US-headquartered vendor whether it is on that list, and plan for the possibility that the decision could change.
US CLOUD Act reach
The CLOUD Act provision at 18 U.S.C. 2713 requires US providers of remote computing services to preserve or disclose data in their possession, custody or control, whether that data is stored inside or outside the United States. A US-controlled ERP host in an EU datacenter can therefore still face such requests. Under GDPR Article 48, a third-country order is generally recognized only through an international agreement such as a mutual legal assistance treaty. Your counsel should assess this exposure before signing.
Third-country access to processors
EDPB Recommendations 01/2020 note that where a provider must access data in the clear and a third country's authority powers go beyond what is necessary and proportionate, no effective technical supplementary measure may be available. Encryption alone may not resolve this when the provider holds the keys. Ask whether customer-managed keys and operator access controls are possible, and document the assessment for each processor that handles ERP data.
Switching and exit rights
The EU Data Act has applied since 12 September 2025 and gives customers a right to switch from a data processing service to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition. Switching charges are banned from 12 January 2027. Write these terms into any hosted ERP contract, and confirm that exports include the data an open-source replacement needs, such as internal IDs and attachments.
Where NetSuite's hosting model meets residency and where it does not
NetSuite runs as a multi-tenant service on Oracle Cloud Infrastructure, with data centers in North America, Europe and Asia Pacific. Which of those regions holds your production account, backups and disaster recovery copies depends on your contract and provisioning, so treat the location as a written commitment to confirm rather than a default you can assume from the product name. Ask the vendor to state the region for each data set in writing, and whether any copy moves during maintenance or failover. Residency also covers access. Under the EDPB's Guidelines 05/2021, remote access from a third country, even only displaying data on a screen for support, counts as a transfer, so where support staff can view your records matters as much as where the data is stored.
The harder question is control. NetSuite is operated by a US-headquartered provider, and under 18 U.S.C. 2713 (the CLOUD Act) such providers must preserve or disclose data in their possession, custody or control whether it sits inside or outside the United States. A European data center does not remove that exposure on its own. Put three questions to the vendor and to your counsel: who holds administrative control over the environment, what the provider's process is for handling government requests and whether it notifies customers, and which of its personnel outside the EU can reach your data. The EDPB's Example 12 says controllers should assess this exposure before engaging such a processor. Self-hosting Odoo or ERPNext in your own datacenter or an EU provider's facility changes who holds those keys, which is the main reason many teams make the move.
Exit is the practical consideration to plan for early. NetSuite's Full CSV Export is available only to the Administrator role, covers lists such as customers, vendors, items and employees along with a transaction detail report, and Oracle states it does not currently export all data as CSV files. Build an inventory of what sits outside that export, including custom records, scripts-dependent reference data and historical transactions, and confirm with Oracle which further extracts are supported. Saved search and report CSVs cover many of the gaps, but each one needs its own check for completeness. Start that inventory before any contract decision, because the export scope determines how much data your target system must rebuild by hand. The NetSuite CSV Export documentation sets out the current limits to check against.
Which open-source ERP fits an EU hosting constraint
This table compares Odoo Community, Odoo Enterprise and ERPNext on how each fits a self-hosted deployment in your own or an EU provider's datacenter. Read the hosting and licensing rows first, because the vendor-hosted options change where personal data sits even when the software itself is open source.
| Criterion | Odoo Community or Enterprise | ERPNext |
|---|---|---|
| License | Community is LGPLv3. Enterprise source is not public and needs a subscription or partner access | GPL-3.0 for ERPNext, MIT for the Frappe Framework |
| Self-hosting in your datacenter | Community can be installed from source. On-premise Enterprise needs a subscription code to activate | Free to self-host with Docker Compose, the bench CLI or manual install, per the README |
| Vendor-hosted options | Odoo Online and Odoo.sh are vendor-hosted, so confirm hosting location before using them for residency | Frappe Cloud is vendor-hosted; confirm its data location and the support plan that applies |
| Production container setup | Confirm the Odoo packaging and reverse proxy setup your team will run | frappe_docker provides production images and Compose files; the single-file demo is for short evaluation only |
| Support lifecycle | Each major version has three years of standard support, then two years to upgrade. Odoo 18.0 standard support ends September 2027 | Version 15 is supported until end of 2027 and version 16 until end of 2029. Version 14 reached end of life January 31, 2026 |
| Enterprise needed for on-premise | Yes for the upgrade service and on-premise Enterprise features, so budget a subscription | No license fee for the core. Warranty coverage from Frappe needs a matching Frappe Cloud support plan |
| Residency fit | Strong when Community or on-premise Enterprise runs in your datacenter; confirm the upgrade path and any external services | Strong when self-hosted; confirm third-party services and the chosen support plan do not move data abroad |
How to deploy ERPNext or Odoo under an EU residency constraint
This sequence turns an EU residency requirement into a documented deployment: a named hosting jurisdiction, a complete map of access paths, a supported install method, controlled identity and admin access, and backups and upgrades that stay inside that boundary.
Confirm datacenter and provider jurisdiction
Your team, with the legal or data protection lead, records where the servers, databases, object storage and backup copies will physically sit, and which legal entity operates the infrastructure. If you use an EU provider, ask whether that provider or its parent is subject to third-country law with extraterritorial reach, since EDPB Guidelines 05/2021 treat compliance with a third-country authority request as a transfer. Done when a signed hosting record names every country and every operating entity, and the legal team has accepted the exposure assessment in writing.
Map every access path and data copy
List each route by which someone or something can see the data: administrator and developer logins, vendor or partner support sessions, remote screen sharing, monitoring and log shipping, error reporting, backup replicas, test copies and exports to spreadsheets. EDPB Guidelines 05/2021 treat remote access from a third country, even only displaying data on a screen, as a transfer, so each path needs an owner and a location. Done when the register covers every path and each entry states where the person or system sits and what it can see.
Choose the install method for your control
Select Docker Compose with the frappe_docker images for ERPNext, or the bench command line tool for a manual install, and for Odoo select a packaged installer or a source installation on servers you run. The frappe_docker single-file demo is for short-lived evaluation only, so use the production Compose files with MariaDB, Redis, workers, the scheduler and Nginx as separate, monitored services. Done when a staging environment built from the chosen method runs inside the approved EU boundary and the build is recorded in version control.
Connect identity under your control
Configure LDAP or social login against your own directory so that user lifecycle, password policy and multi-factor rules stay under your identity team rather than a vendor cloud. Odoo and ERPNext both document LDAP integration, and ERPNext also documents social login keys, so confirm which option your directory supports and test deprovisioning with a disabled account. Done when a disabled directory account can no longer sign in to either the application or its admin pages, and the test result is filed with the access register.
Restrict Server Scripts and admin access
In ERPNext, Server Scripts run Python on document events and API endpoints, and from version 15 they are disabled by default. Keep them disabled unless a named developer needs them, enable them only through the server_script_enabled setting in a reviewed change, and limit the Administrator role to a small break-glass group. For Odoo, restrict custom modules and external API access to reviewed code and named accounts. Done when the list of enabled scripting features and administrator accounts is approved, and changes to either pass through a recorded review.
Plan backups and EU-located storage
Define where database dumps, file attachments and snapshots are written, how long they are kept, and who can restore them. Keep all storage in the approved EU locations, encrypt backups before they leave the application host, and test a full restore into an isolated environment inside the same boundary. Confirm with your storage provider that replicas, support snapshots and disaster recovery sites do not leave the EU. Done when a restore test has rebuilt a working instance from backups that meet the residency record.
Build test copies with neutralization
Refresh test and training environments from production only through a controlled copy. For Odoo, use database duplication with neutralization, which disables outgoing mail, payment and external connectors in the copy, so test environments do not send live data or messages elsewhere. For ERPNext, scrub personal data or use a masked extract before it reaches a lower environment. Done when a test copy is confirmed to have no active external connectors and its location is listed in the access register.
Run the upgrade cadence on supported lines
Apply minor releases on a regular schedule, since Odoo minor versions are usually released every two months and ERPNext publishes frequent minor releases on both supported lines. Plan major upgrades on versions still inside their support window: Odoo major versions have three years of support followed by two years for the upgrade, and ERPNext version 14 is end of life. Test each upgrade in a copy first and confirm support status with Frappe's supported versions page or Odoo's documentation before scheduling it. Done when a dated upgrade calendar is approved and each change has a tested rollback.
Evidence regulators and auditors ask for under residency rules
What proves where our ERP data is stored?
A written data location record, listing each country and facility that holds ERP databases, file attachments, backups and logs, is the first document a DPO will request. For a self-hosted deployment, the record names your own data center or the EU cloud account you chose, the region or availability zone, and the physical or logical location of any secondary site. Keep it current, dated and signed by the owner of the infrastructure. Under GDPR Article 44, the question is not only where data sits at rest but also whether anyone outside the EEA can reach it, so the record should cover remote access paths too.
Which processors and subprocessors must be listed?
Your processor register should list every organization that touches the ERP data or the systems hosting it, with the service each one provides and its location. For a self-hosted Odoo or ERPNext stack this typically covers the hosting provider, any managed database or backup service, the email relay, and the implementation partner for the period of work. Each entry needs a signed data processing agreement that matches the actual processing. Ask each provider to confirm in writing whether it is subject to third-country law with extraterritorial effect, because the EDPB Guidelines 05/2021 say controllers should assess that exposure before engaging such a processor.
When is a transfer impact assessment required for ERP data?
A transfer impact assessment is needed only where personal data actually leaves the EEA or becomes accessible from a third country. Examples include a US-headquartered support vendor viewing records remotely, a backup copy stored outside the EEA, or a cloud region chosen outside the EU. The EDPB Guidelines 05/2021 treat remote display of data for support as a transfer, so screen-sharing sessions count. If a transfer exists, the assessment examines the destination's surveillance laws against the EDPB Recommendations 01/2020. Independent counsel or your DPO makes the legal determination. DeployOpen documents the technical facts for that assessment but does not issue it.
What access logs do auditors expect for remote administration?
Auditors expect a log showing who connected to the ERP servers, when, from where, and what they did. For self-hosted systems, this means SSH and VPN session logs, bastion or jump host records, database administrator sessions, and application audit trails for privileged roles such as Odoo administrators or ERPNext System Managers. Logs should be stored in a location the administrators cannot edit and retained for a period your policy sets. Confirm with your security team which events you log by default in Odoo and ERPNext, since audit depth differs between the two and between versions. Record every approved support session that involved an EEA-located engineer or a third-country one, because each is a potential transfer event.
Where must backups be stored and how are they proven?
Backups are personal data copies, so their location must appear in the same register as the live system. Document the backup target, its region, the encryption method and the key custody, plus the retention schedule and restore test dates. The restore test record matters as much as the storage location, because it proves the backup is usable inside the residency boundary. Ask your backup provider for the location of any replication target, and confirm that no snapshot is copied to a third-country region by default. Backups taken from a cloud platform that stores data in a third country may themselves constitute a transfer.
What exit and switching record does the EU Data Act require?
The EU Data Act gives customers of data processing services the right to switch to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition. It also bans switching charges from 12 January 2027. For an ERP move, keep a dated exit plan that lists the export formats, the data inventory, the contract notice terms and the target environment. Export tests with your chosen open-source platform provide evidence that the exit path works. Confirm with your legal team how these provisions apply to your current contract, since the answer depends on the service type and the contract text.
Does DeployOpen certify our ERP for GDPR compliance?
No. DeployOpen plans, implements, hardens and documents self-hosted platforms inside your own infrastructure, and it prepares systems, controls and evidence for compliance assessments. It does not issue audit reports, attestations or certifications. Independent auditors and certification bodies issue those. In practice, DeployOpen can produce the data location record, the processor register template, the access log configuration and the backup and restore evidence, and then hand them to your DPO and external assessor. Scope, deliverables and timelines are agreed in writing before work starts, and a quote follows from that written scope.
Which documents should we request from our ERP provider now?
Request a current list of data center locations, a subprocessor list with contract dates, the data processing agreement, the transfer mechanism in use if any, and the support access model showing where engineers connect from. Ask whether support staff can view production data remotely and under which approval. Also request the backup location and retention terms, and the export options with their formats. Confirm with the vendor how a request from a third-country authority would be handled, since that determines the exposure your assessment must address. Written answers from the vendor become part of your evidence file.
How the data leaves NetSuite without leaving the EU
The extraction path decides where personal data sits during the move, so plan it before any cutover date is set. NetSuite's Full CSV Export is limited to the Administrator role and, as Oracle states, does not currently export all data as CSV files. Its list exports cover items such as customers, vendors, items and employees, plus a transaction detail report. Anything outside those lists will need saved search or report CSVs, which NetSuite documents as the alternative when Full CSV Export does not meet your needs. Confirm in the account which roles and export methods are permitted, because a role restriction can decide who performs the extraction and on which workstation the files are created.
Treat every exported file as personal data in its own right. A CSV of customers, employees or payroll-adjacent records is a copy of data subject to GDPR, so the download folder, the migration workstation, any shared drive and any consultant's laptop must be in the EU or in infrastructure you control. Under the EDPB's guidance, displaying data on a screen for remote support is itself a transfer, so the people handling the files must also work from locations that keep the data within the approved perimeter. Record where each file is stored, who accessed it and when it was deleted after import.
Sequence the import so that masters come first, then open balances, then transactions. Load customers, vendors, items and the chart of accounts, keeping the NetSuite internal IDs in a column that can serve as an External ID in Odoo or as a reference field in ERPNext Data Import. ERPNext's documentation advises importing only a few thousand records at a time, so split large masters into batches and reconcile record counts after each one. Confirm with your implementer whether open balances will be loaded as journal entries or migrated as summary figures, and agree that reconciliation in writing before the first batch runs.
How DeployOpen implements ERP inside your EU boundary
DeployOpen plans, implements, hardens, backs up, documents and supports self-hosted Odoo or ERPNext inside your own cloud accounts, data centers or air-gapped networks. The work starts with a written scope that fixes where ERP data is stored, who can reach it from outside the EU and how it is recovered.
How we scope
- Map every location where ERP data is stored, processed, backed up or administered, including vendor support access
- Record which personal data sets sit in customers, vendors, employees and payroll, and who controls them
- Confirm the target EU data center or provider and whether remote administration would occur from outside the EEA
- Agree the Odoo or ERPNext version, edition, modules and integrations in a written, fixed-scope document
How we build
- Install Odoo or ERPNext in your environment using packaged installers, source installation or Docker Compose, as the scope specifies
- Configure authentication with LDAP or social login where your identity provider is already in use
- Restrict administrator access, network paths and backup storage so that data stays inside the agreed boundary
- Test imports from NetSuite exports in staging copies before any production cutover is scheduled
How we hand over
- Deliver architecture, data flow and hosting diagrams that show the EU boundary and every administrative access path
- Document backup, restore and upgrade runbooks, including the Odoo or ERPNext version support windows you must plan around
- Provide a list of third-country access points and the contractual or technical controls covering each one
- Train your administrators on operating, patching and recovering the platform without relying on the vendor
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover
- Plan major version upgrades on a test copy first, since each release line has its own support end date
- Re-check the data transfer position when your provider, administration model or legal basis changes
- Confirm with your legal counsel and your data protection officer which assessments your organization needs
