Self-hosted JumpCloud alternative for EU data sovereignty

Why a self-hosted JumpCloud alternative for EU data sovereignty changes the transfer question

Self-hosting authentik or FreeIPA in a datacenter you control, or in an EU provider's facility under your contract, keeps the directory, its logs and its credentials under your own administrative control. That is the core of the sovereignty argument. The trade-off is that your team, or a partner, takes on the operations the vendor performs today: patching, backups, replication, certificate renewal and on-call response. For a European organization whose directory holds personal data, the question shifts from where the data is stored to who can reach it and from where. Your JumpCloud contract, the Frankfurt data center option and the DPA may not answer that for support staff, sub-processors or backup jobs. As we understand it, the Frankfurt option is limited to new customers, so confirm whether your tenant can select it. This page covers data residency and transfer exposure, not legal advice, so use it as a checklist for your DPO and counsel.

GDPR Article 44 applies to every transfer of personal data to a third country, including onward transfers. The EDPB Guidelines 05/2021 (version 2.0) state that remote access from a third country counts as a transfer, even when data is only displayed on a screen for support or administration, and that storage in a cloud outside the EEA also counts. A Frankfurt data center therefore does not settle the question if an engineer, a sub-processor or a backup process touches the directory from elsewhere. The US CLOUD Act, under 18 U.S.C. 2713, reaches data in a provider's possession, custody or control whether that data sits inside or outside the United States. Article 48 of the GDPR limits when a third-country disclosure order can be recognized or enforced in the EU. Self-hosting changes who holds the keys and who can receive a demand, but it does not remove the duty to assess an EU provider that is itself subject to third-country law.

Before you decide, ask JumpCloud in writing for its current DPA, its sub-processor list, the countries from which support and engineering staff can access tenant data, and where backups and logs are stored. Map the same questions to any self-hosting partner or EU hosting provider, including who in its organization could reach your servers and which legal regime applies to it. Do not rely on the EU-US Data Privacy Framework alone for a provider with US links. The adequacy decision is under appeal as Case C-703/25 P, which you can follow in the Official Journal entry. In parallel, plan the operational side: FreeIPA's deployment guidance calls for at least two to three replicas in each datacenter, and an authentik deployment depends on PostgreSQL backups that you have tested and can restore.

What GDPR and EU rules require for identity data held outside the EU

Identity data such as directory records, group memberships and authentication logs is personal data, so where it is stored, who can administer it and who can compel access to it all fall under GDPR. The cards below set out the transfer rules, the enforcement exposure, the limits on foreign disclosure orders and the switching rights that apply when an organization moves its identity platform.

Transfer conditions reach onward transfers

Article 44 requires that every transfer of personal data to a third country, including onward transfers made by a provider or its subprocessors, meets the conditions in Chapter V. For a directory service, this means the question is not only where the database sits but also which support staff, subprocessors or backup locations can reach it. Ask the provider for a complete list of processing locations and subprocessors and check each one against the DPA.

Remote access counts as a transfer

The EDPB's Guidelines 05/2021 state that a support engineer in a third country viewing data on a screen during administration is a transfer, and so is storing data in a cloud outside the EEA. A vendor that stores your Frankfurt tenant in the EU but permits administration or troubleshooting from outside the EU still creates transfers. Ask who can open sessions into the tenant, from which countries, and whether those sessions are logged and approved by you.

Fines reach four percent of turnover

Article 83(5)(c) sets the ceiling for infringements of the transfer rules in Articles 44 to 49 at EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Regulators assess the fine case by case, but the ceiling makes transfer mapping a board-level matter for identity systems that hold every employee's login data. Document the transfer assessment before the directory goes live, not after an incident.

Limits on foreign disclosure orders

Article 48 means a third-country court or administrative order to disclose personal data is enforceable in the EU only when it rests on an international agreement, such as a mutual legal assistance treaty, in force with the Union or a Member State. The CLOUD Act, under 18 U.S.C. 2713, requires US-based providers to preserve or disclose data in their possession, custody or control wherever it is stored. Ask a provider how it handles such requests, whether it notifies you and whether it has ever been compelled to disclose data held in the EU.

Switching rights under the Data Act

The EU Data Act, applicable since 12 September 2025, lets customers switch from a data processing service to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition. Switching charges are banned from 12 January 2027. Confirm these terms in the contract, and check whether the export format for identity data supports a clean move to another platform.

Where JumpCloud's Frankfurt option meets the constraint and where it does not

The Frankfurt option is a hosting location choice, and it is available only to new JumpCloud customers. Existing tenants should not assume they can move, so confirm their current storage location and whether a move is offered. A hosting region answers only one question, which is where stored data sits. It does not answer where people or systems can view or process that data.

Eligibility: Ask whether an existing tenant can move to Frankfurt, under what conditions, who performs the move and whether it carries a charge.
Scope of the region: Ask which data categories are stored in Frankfurt, such as user attributes, device inventory, authentication logs and audit records.
Backups and replicas: Ask where backups, disaster recovery copies and log archives are kept, and whether any of them leave the EU.
Change control: Ask whether the hosting region can change later and how and when customers are notified.

Confirm each answer in the signed contract or data processing terms, not only in a sales conversation.

Which open-source options keep identity data under EU control

This table compares Keycloak, authentik and FreeIPA on license, where identity data is stored, what each platform holds and which protocols it covers. Read the rows for protocol coverage and edition limits against your own mix of LDAP, RADIUS, SSO, MFA and Linux access, since no single option matches every JumpCloud package. The main takeaway is that all three run on infrastructure you control, so data location depends on where you host them, not on the vendor.

Criterion	Keycloak	authentik	FreeIPA
License	Apache License 2.0	MIT for most code; enterprise directory under the separate authentik EE License	GPL-3.0-or-later, community project with no paid edition
Where the data sits	In your PostgreSQL or database, in the cloud account or data center you choose	In your PostgreSQL database on your own servers or an EU provider you select	On your own IdM replicas in your data centers, with no vendor-hosted tier
What it stores	Realms, users, clients and roles, with users optionally federated from LDAP or Active Directory	Configuration and all data except uploaded files, held in PostgreSQL	Users, groups, hosts, policies, Kerberos keys and Dogtag certificates
SSO protocols	OpenID Connect, OAuth 2.0 and SAML 2.0	OIDC, SAML, proxy authentication and SCIM	Kerberos single sign-on for Linux and UNIX; web SSO needs an extra component
LDAP and RADIUS	LDAP through user federation; no native RADIUS server, so a separate component is needed	LDAP and RADIUS providers, with outposts for network clients	LDAPv3 directory natively; OTP checks can be proxied to an existing RADIUS server
MFA	Built-in second factor options; confirm the methods your policy requires	Built-in MFA stages in the free edition; confirm the methods you need	HOTP and TOTP tokens, including hardware tokens such as YubiKeys
Linux and SSH access	Not a focus; needs an LDAP or SSSD bridge for host logins	Covered through LDAP and Kerberos providers; confirm for your host fleet	Core strength: SSSD on clients, host-based access control and sudo rules
Enterprise trade-offs	Commercial support comes from vendors and partners, not from the project itself	Enterprise adds Google Workspace and Entra ID integrations, mTLS, privileged access management and ticket-based support	No SaaS SSO connectors and no Windows or macOS device management; Active Directory trusts are possible
Who runs it	Your team or an implementation partner, including the database and clustering	Your team or a partner, with PostgreSQL and upgrade work on your side	Your team, with replica topology and certificate renewal planned in advance

How to deploy authentik or FreeIPA inside EU infrastructure

This sequence moves the identity service into an EU datacenter or provider you choose, with administrative access controlled and backups tested before any user depends on it. The result is a production-ready directory or SSO platform whose location, operators and recovery path you can document for your data protection assessment.

Select the EU datacenter and provider
Your infrastructure or security lead chooses the hosting location, either your own facility or an EU provider, and records the legal entity that operates it. Ask the provider in writing where its staff and support engineers are located, whether any administrative or remote access path leads outside the EU, and how it responds to requests from non-EU authorities. Under the EDPB Guidelines 05/2021, even remote viewing of data from a third country counts as a transfer, so this review must cover support sessions as well as storage. The step is done when the decision record lists the location, the operator, every administrative access path and the contract clauses that govern them. Confirm these details with your counsel, since the assessment is yours as controller.
Size authentik database and containers
For authentik, the platform team sizes the server container (core plus embedded outpost), the worker container and PostgreSQL, which stores all configuration and data except uploaded files. The authentik 2025.10 release notes state that Redis is no longer used, so caching, tasks and sessions now run on PostgreSQL, and they warn of roughly 50% more PostgreSQL connections after an upgrade. Plan connection limits and database capacity with that in mind, and confirm the current minimums in the authentik Docker Compose or Kubernetes guide. Compose suits test setups and small production deployments, so a larger identity service should use the Kubernetes path or a comparable orchestrated setup. The step is done when a load test on a staging copy shows the database stays within its connection and memory limits under expected login volume.
Build the FreeIPA replica topology
If you choose FreeIPA, the Linux or identity team deploys dedicated servers, with the FreeIPA deployment recommendations calling for at least two to three replicas in each datacenter. Limit each replica to no more than four replication agreements, run PKI or DNS on at least one replica per datacenter if you use those services, and give clients at least two DNS servers in their resolv.conf. Keep the servers dedicated to FreeIPA, without other applications on them. The step is done when replication status is clean between all replicas, client enrollment resolves to the nearest EU servers, and a failover test shows authentication continuing when one replica is stopped.
Set up backups and test restores
The backup owner configures scheduled backups and stores copies in the same EU jurisdiction, encrypted and with access restricted to the identity team. For FreeIPA, ipa-backup and ipa-restore offer full or online data-only backups, and the documentation warns that the first server handles certificate renewal and CRL publication by default. For authentik, back up PostgreSQL and the uploaded files as well. Restoring an outdated backup into an active FreeIPA replica topology can break replication, so every restore test must run in an isolated environment. The step is done when a restore into a separate EU test system succeeds, logins work there, and the runbook records how long the recovery took, which you then compare with your recovery objectives.
Schedule patches against vendor policies
The operations lead builds a patch calendar using the upstream sources. The authentik security policy lists 2026.5.x and 2026.8.x as the supported lines receiving security fixes, and the project announces security releases at least 24 hours in advance, so subscribe to those notices and keep a staging environment ready to test. For FreeIPA, the 4.13.4 release notes describe a July 9, 2026 stabilization release that fixed two CVEs, including LDAP access control flaws, which shows why the team should track release notes for each supported branch. Confirm with your distribution's packaging team which FreeIPA version it ships and how fast it delivers fixes. The step is done when a named owner, a test window and a rollback plan exist for each platform.
Restrict admin and support access
The security engineer limits administrative access to named EU-based staff, enforces MFA on every admin account, and routes all administrative sessions through logged bastion hosts inside the EU. Remove any vendor or external support remote access that would show data on a screen from outside the EU, or make it an explicit, documented exception covered by your transfer assessment. Enable audit logging in authentik, and review FreeIPA access controls, including who can read directory data and which hosts can request certificates. If you use an external support contract, the contract should name the locations from which support is performed. The step is done when an access review confirms that every admin path is inside the approved locations and every privileged action appears in the audit trail.
Document controls for the assessment
The compliance lead assembles the evidence file for the transfer and processing review: the hosting decision record, the administrative access map, backup and restore results, patch procedures and the vendor support terms. This file supports your own assessment and any independent audit, but it does not create a certification. Under Article 44 of the GDPR, every transfer to a third country must meet Chapter V conditions, so keep the documented data flows aligned with what the infrastructure actually does. The step is done when the file is reviewed by legal and security, and an owner has scheduled a review after each major upgrade.

Evidence a DPO, auditor or regulator will ask for

A self-hosted identity service moves the transfer question from a vendor's contract to your own records. A DPO or regulator will look for where each identity record lives, how it moves, who can reach it and how it is recovered. The cards below list the documents and logs to assemble before the first user is migrated.

Processing location register

Record every system holding directory data, including the authentik or FreeIPA servers, PostgreSQL or the FreeIPA data directories, replicas, backup targets, log stores and support tooling, with the city, provider and legal entity for each. Under Article 30 of the GDPR, this register is part of the controller's records of processing activities. Confirm that no replica, log shipper or monitoring agent sends data outside the EEA without a documented basis.

Data flow map for identity events

Draw how a login travels from the user's browser or device through the identity provider, into LDAP or RADIUS clients, and out to SaaS applications through SAML or OIDC. Mark every point where attributes such as email, department or group membership leave your network. A third-country remote administration session that only displays data counts as a transfer under EDPB Guidelines 05/2021, so mark support access paths too.

Administrator and sub-processor access logs

Keep logs of who administers the identity platform, from which network and under which account, and retain them outside the directory itself. For FreeIPA, this covers Kerberos and LDAP administrative changes. For authentik, it covers the admin interface, the audit trail and database access. List every external party with access, such as a managed hosting firm or support engineer, and confirm whether any of them can reach data in the clear from a third country.

Backup location and encryption record

Document where each backup is stored, which keys encrypt it, who holds those keys and how long copies are kept. FreeIPA provides ipa-backup and ipa-restore, and authentik's data sits in PostgreSQL, so both need an encrypted off-site copy in the EU. Also record the restore test results. A backup in a non-EU bucket is a transfer, so it belongs on the same register as production data.

Transfer impact assessment for third parties

If any component, provider or subprocessor is subject to non-EU law with extraterritorial reach, such as the US CLOUD Act's 18 U.S.C. 2713, record a transfer impact assessment before engaging it. EDPB Recommendations 01/2020 state that where a provider must access data in the clear and foreign powers exceed what is necessary, no effective technical supplement exists. Keep the assessment with the contract and revisit it when the legal basis changes.

Patch and access review procedures

Write down how security releases are tracked, tested and applied, and how privileged and user access is reviewed on a set schedule. Record which versions are supported, for example authentik's supported release lines in its security policy, and how the project's advance notice of security releases feeds your change calendar. For FreeIPA, log the upgrade of replicas and the review of administrative group membership. Certification bodies and auditors decide whether these procedures satisfy any framework, so confirm that with them.

How much work is a self-hosted EU identity directory?

What drives the cost of self-hosting an EU identity directory?

The cost comes from four components: people, servers, PostgreSQL and the migration itself. Software licensing is often zero for the open-source core, but that does not make the project free. Engineers who install, harden and operate the directory are the largest recurring line. Servers and database capacity recur monthly or yearly depending on where you host. The migration is usually a one-time cost covering user export, group rebuilds, client repointing and cutover testing. Ask any provider to price each component separately so you can see what recurs and what does not.

Does authentik Enterprise have to be bought for EU data sovereignty?

No. Data residency depends on where you host the deployment, not on which edition you run. The authentik repository places most of its code under the MIT license, and the free edition supports OIDC, SAML, LDAP, SCIM, RADIUS and Kerberos, with community support only. Enterprise adds Google Workspace and Microsoft Entra ID integrations, mTLS, privileged access management, password history and ticket-based support, according to the authentik pricing page. Choose Enterprise only if you need those features or a support contract, and confirm with the vendor which edition covers your requirements.

Can a small team run a self-hosted directory without outside help?

It can, if it has someone who already operates Linux, PostgreSQL and TLS certificates and who can keep up with security releases. authentik publishes security fixes for the versions listed in its security policy and announces security releases at least 24 hours in advance, so someone must watch for them. FreeIPA is a community project with no paid edition, so fixes come from the community and your own patching process. Assess your team's skills honestly, and consider a fixed-scope implementation plus a retainer for upgrades and testing if the skills are missing.

What does the infrastructure need for a self-hosted directory?

The baseline differs by product. The authentik Docker Compose guide positions Compose for test setups and small-scale production and calls for at least 2 CPU cores and 2 GB of RAM on the host. A production authentik deployment runs a server container, a worker container and PostgreSQL, and since the 2025.10 release PostgreSQL also handles caching, tasks and sessions because Redis is no longer used. The release notes warn of roughly 50% more PostgreSQL connections after upgrading, so size the database accordingly. FreeIPA's deployment recommendations advise at least two to three replicas in each datacenter, with dedicated servers and at least two DNS servers in each client's resolv.conf.

Which factors change how long the migration takes?

Timing depends on the number of applications that need re-federation, the number of LDAP clients and RADIUS devices that must be repointed, and whether MFA enrollments must be rebuilt. Users and groups can be imported from another LDAP server with ipa migrate-ds in FreeIPA, but sudo and HBAC rules need manual translation through LDIF. Your export options from the current provider also matter, because some directories do not export password hashes in standard exports. Ask the provider to break the timeline into discovery, build, cutover and post-cutover stabilization, and to name the dependencies it expects you to supply.

What should a fixed-scope quote for this work include?

Most DeployOpen engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. A useful quote lists the directories and protocols in scope, the number of identity sources and applications, the hosting location and provider, the high-availability design, the backup and restore test, the migration steps and cutover plan, and the documentation handed over. It should also separate one-time implementation from recurring retainer work such as upgrades, security patching and continuous testing. DeployOpen does not publish a price list, so ask for a quote that follows from the written scope.

How do you keep backups and recovery under control in a self-hosted directory?

Define recovery objectives and test them before cutover. FreeIPA provides ipa-backup and ipa-restore, with full backups or online data-only backups. Its documentation warns that restoring an outdated backup into an active replica topology can break replication, and that the first server handles certificate renewal and CRL publication by default. Keycloak's realm export and import is documented as having limitations as a backup mechanism and requires all nodes to be stopped while it runs. Include restore drills in the plan and ask the provider how often they will repeat them after go-live.

How DeployOpen deploys identity under EU data constraints

DeployOpen plans, implements, hardens, backs up and documents self-hosted open-source identity platforms inside your own cloud accounts, data centers or air-gapped networks. For EU data sovereignty, that means the directory, SSO and MFA stack and its backups stay under your control, with the evidence needed for your own assessments.

How we scope

We map where personal data, directory replicas and backups would sit, including any support access from outside the EU.
The written scope lists which platform fits (authentik, FreeIPA or another option), the systems it covers and the deliverables.
Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.

How we build

We deploy the chosen identity platform in your chosen EU location, with PostgreSQL or FreeIPA replicas placed where your data rules require.
We connect LDAP clients, SSO applications and MFA, and migrate users and groups from the exported JumpCloud data.
We run security testing against the identity services and document the configuration, access paths and vendor support boundaries.

How we hand over

You receive architecture, data flow and hosting location documentation that your DPO and legal team can review.
Runbooks cover backup and restore, replica recovery, upgrades and the security release process for the platform you run.
We prepare systems, controls and evidence for your compliance assessment, while independent auditors issue any attestation.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainer scope is agreed in writing, including who on your side approves upgrades and access changes.
Ask any provider, including DeployOpen, to confirm in writing where support staff access data from and under which conditions.