Self-hosted Freshservice alternative for EU data sovereignty

Can a self-hosted Freshservice alternative keep EU service desk data under EU control?

Yes, GLPI or iTop running in your own data center or in an EU provider's data center can meet a residency goal, but whether the data stays under EU control depends on who operates the systems and who can reach them. Freshservice's Frankfurt hosting answers the question of where data sits. It does not, by itself, settle who can access it, which is the question the GDPR's transfer rules and your own risk assessment turn on. A self-hosted deployment moves that answer into your hands, along with the obligations that come with it.

The constraint is narrower than the marketing around data residency suggests. Under GDPR Article 44, any transfer of personal data to a third country, including onward transfers, must meet Chapter V conditions. The EDPB's Guidelines 05/2021 treat remote access from a third country, even just displaying data on a screen for support, as a transfer, so an administrator or vendor engineer abroad with access to your tickets counts. The guidelines also say that using an EU processor subject to third-country law is not itself a transfer, but complying with a third-country authority request would be. Before choosing any hosting provider, ask who holds administrative credentials, where support staff connect from, and whether the provider could be compelled to disclose data under a non-EU statute such as the US CLOUD Act. The EDPB guidelines set out the reasoning in full.

Self-hosting shifts these questions to your team and your contracts. You must keep your own access logs, restrict administrator accounts to EU staff or to vetted EU providers, and document which personnel can reach the database and the config directory holding glpi.key and glpicrypt.key. Any EU hosting provider needs a written statement of its own sub-processors and support access paths. Confirm with counsel whether your data protection impact assessment covers the GLPI Agent's inventory data, which may include user and device identifiers. The operating work is real: patching, backups, and upgrades become your responsibility, and that is where most of the ongoing effort and risk sits.

What GDPR and the Data Act require for ITSM data hosting

Where ITSM data sits is only part of the question. Who can reach it, from where, and under which legal orders determines whether a hosting choice holds up. The cards below cover the transfer, access, disclosure and switching rules that connect hosting location to vendor and provider exposure.

Transfers include onward transfers

Article 44 of the GDPR requires every transfer of personal data to a third country to meet Chapter V conditions, and that duty extends to onward transfers made by a provider or its sub-processors. Ticket histories, requester names and asset owner data often pass through several parties. Map each processor and sub-processor in the Freshservice contract and in any EU host's contract, and record where each one stores or accesses the data.

Remote access counts as a transfer

EDPB Guidelines 05/2021 (version 2.0) state that remote access from a third country is a transfer, even when the person only views data on a screen for support or administration. A vendor engineer troubleshooting a ticket queue from outside the EEA can therefore trigger Chapter V obligations. Ask vendors where support staff sit, which access paths exist, and whether break-glass access is logged and approved.

Third-country court orders need a treaty

Article 48 of the GDPR says a third-country court judgment or administrative decision requiring disclosure of personal data is recognized or enforceable only when it rests on an international agreement in force with the Union or a Member State, such as a mutual legal assistance treaty. This limits how foreign orders can compel disclosure, but it does not stop a provider from being asked. Confirm with counsel which orders a provider has said it would challenge and how it notifies customers.

CLOUD Act reaches data outside the US

The US CLOUD Act provision at 18 U.S.C. 2713, added on 23 March 2018, requires electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control. The obligation applies whether the data sits inside or outside the United States. An EU data center run by a US-parented provider therefore does not remove this exposure on its own. Ask providers whether they can refuse, and what legal process they require.

Data Act switching and Article 32 safeguards

The EU Data Act, applicable since 12 September 2025, gives customers the right to switch from a data processing service to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition. Switching charges are banned from 12 January 2027. Article 32 requires providers to take measures against third-country governmental access to non-personal data held in the Union. Write the exit terms, export format and notice periods into the contract before signing.

What Frankfurt hosting changes and what it does not change about vendor access

Storage location is only one input to the transfer analysis under Chapter V of the GDPR. A Frankfurt data center answers where the data sits at rest, but it does not settle who can reach it, from where, or under which foreign legal order. The EDPB's interplay guidelines say that remote access from a third country, even only displaying data on a screen for support, counts as a transfer. So a Frankfurt-hosted SaaS tool can still involve a transfer every time vendor staff in another country open a ticket to troubleshoot it. The same guidelines (Example 12) add that using an EU processor subject to third-country law is not in itself a transfer, but complying with a third-country authority request would be. Controllers should assess that exposure before signing.

The US CLOUD Act provision at 18 U.S.C. 2713 reaches providers' data in their possession, custody or control whether it sits inside or outside the United States, so a Frankfurt location does not remove that exposure for a US-parented vendor. Under GDPR Article 48, a foreign court order is recognized in the EU only where an international agreement such as a mutual legal assistance treaty supports it. The transfer framework itself has moved over time. The CJEU's Schrems II judgment in Case C-311/18 invalidated the Privacy Shield while upholding standard contractual clauses. The Data Privacy Framework adequacy decision, Commission Implementing Decision (EU) 2023/1795, depends on a pending appeal, Case C-703/25 P, so the legal basis for US transfers should be re-checked before each renewal.

Ask the vendor, in writing, which countries its support staff access customer data from, whether production access is granted by default or only through an approved request, and how remote sessions are logged. Ask for its published policy on government access requests, including how it notifies customers and whether it challenges overbroad orders. Ask whether it can restrict data and support access to the EEA. DeployOpen does not issue legal opinions or transfer impact assessments. Route these answers to your data protection officer and counsel, because a self-hosted GLPI or iTop instance in your own or an EU provider's data center removes the vendor access question for the application data, while leaving your own administrators and the hosting provider's staff to be assessed.

How GLPI and iTop compare for sovereignty and operating cost

GLPI is distributed under GPL-3.0 and maintained by Teclib'. Installed on your own servers or in an EU provider's data center that you contract directly, tickets, assets, contracts and inventory stay inside infrastructure you control. The inventory side uses GLPI Agent, the successor of FusionInventory Agent, which sends hardware and software data to your GLPI instance rather than to a vendor. The software itself has no per-agent or per-asset license fee, so cost centers on hosting, administration and any support you choose to buy.

Data location: On a self-hosted instance, the database (MariaDB 10.11 or later, or MySQL 8.0 or later, per the current README) and file store remain on your servers. Confirm where backups are replicated.
Runtime: The current README lists PHP 8.3 or later. The installation docs for GLPI 11.0 list PHP 8.2 or later, so check which line you deploy.
GLPI Network: Teclib' offers a vendor-hosted cloud at 19 euros per user per month (public cloud) or 21 euros per user per month (private cloud, 25-user minimum), per the subscriptions page. Treat this as a new processor: it needs its own transfer and contract review before any data moves there.
Support tiers: Self-hosted GLPI Network subscriptions run from 100 euros per month (Basic) to 4,500 euros per month (Enterprise), per the same page. Confirm which tier includes the level 3 support and marketplace plugins you need.
Operating work: Updates require backing up the database, files and the config directory with glpi.key and glpicrypt.key, and plugins are suspended after a new version until reactivated.

Before you commit, confirm with Teclib' or your own architect which hosting model, support tier and plugin set match your data residency obligations.

How to deploy GLPI in an EU data center under these rules

This sequence takes a team from a documented transfer assessment to a running GLPI instance in a chosen EU data center, with a tested backup and update path that the team owns after go-live.

Map personal data flows and transfer exposure
Before choosing a host, list every place ticket, asset and user data will sit or be viewed: the GLPI database, file uploads, backups, inventory agents, email gateways and any support session from outside the EU. Mark each flow as staying in the EU or crossing a border. The EDPB guidelines treat remote viewing of data from a third country as a transfer, so support access counts too. Your privacy and legal teams should own this map. It is done when every flow has a location, an operator and a documented reason for its legal basis.
Choose the hosting entity and jurisdiction
Decide who operates the servers: your own data center, a cloud account you control in an EU region, or an EU hosting provider. Ask each candidate in writing who holds administrative access, where support staff are located, whether any parent company is subject to non-EU law, and how they would respond to a foreign authority request. The EDPB Recommendations 01/2020 suggest that where a provider must access data in the clear under powers beyond what is necessary and proportionate, no technical supplementary measure may be effective, so this question carries weight. It is done when the hosting decision and its answers are recorded in your transfer assessment.
Size the web and database tiers
Estimate ticket volume, number of concurrent technicians, asset count and the inventory agent check-in rate, then size a web server and a database server separately. GLPI requires PHP 8.3 or later with MariaDB 10.11 or later or MySQL 8.0 or later for the current README, while the installation docs list older minimums for GLPI 11.0, so confirm the version you deploy against the release you pick. The iTop sizing guidance (2 vCPU and 4 GB for small installations, up to 8 vCPU and 16 GB for larger ones) is a reference point only, since GLPI has its own load profile. Ask your hosting provider for the exact instance sizes and storage performance. It is done when you have a written sizing with a load test plan.
Point the web server at GLPI's public directory
Install the web server (Apache, Nginx, lighttpd or IIS) and set the document root to GLPI's public directory, not the installation root. Enable URL rewriting so that requests route through index.php. Serving the installation root exposes files that should never be reachable. Terminate TLS on the web tier with certificates issued by your own certificate authority or a public one you control. You know the step is done when the login page loads over HTTPS and a direct request to a file in the config directory returns no content.
Configure authentication sources
Set the authentication order in GLPI, which tries the internal database, then LDAP directories, IMAP mail servers and other external methods such as REMOTE_USER. Keep a local administrator account for recovery and store its credentials in your password vault. Bind LDAP with a read-only service account over an encrypted connection, and test it with a user from each group that needs access. If you use REMOTE_USER behind a reverse proxy, verify that the proxy strips any client-supplied header. You know it is done when a test user from each source logs in and the recovery account also works.
Deploy GLPI Agent for inventory
Install GLPI Agent on Windows, macOS or Linux endpoints to send hardware and software inventory to your GLPI server. The agent is the successor of FusionInventory Agent and can also run network discovery and inventory, which you should enable only on subnets you have authorized. Push the agent configuration from your endpoint management tool, and confirm the target URL points to the EU instance. Review the first inventory run for duplicate or missing assets. It is done when a sample of endpoints appears in GLPI with current hardware and software records.
Back up database, files and encryption keys
Before any update, take a database dump and a copy of the GLPI files directory and the config directory, including glpi.key and glpicrypt.key. The update documentation requires these keys, and a restore without them can leave encrypted data unreadable. Store backups in the same EU jurisdiction, encrypted, with a separate copy you can restore from. Test a restore on a separate host at least once. You are responsible for backup schedules, retention and restore testing, and DeployOpen can run those as a retainer if you want. It is done when a restored copy starts and logs in.
Update GLPI and reactivate plugins
Replace the application files with the new release, keeping your config directory, then run php bin/console db:update to migrate the schema. Since GLPI 11.0, plugins are suspended when a new version is detected, so reactivate each plugin after a major update and check its compatibility first. Read the release notes for the target version before you start, including the GLPI 12.0.0 notes if you move to that line. Run the update on a staging copy first. It is done when the upgraded instance passes your smoke tests and every required plugin is active. Patching the operating system, web server, PHP and database remains your responsibility.

What self-hosting adds to the operating workload

Moving from Freshservice's managed Frankfurt service to GLPI or iTop moves the platform operations into your organization or your chosen hosting partner. The six areas below recur on different schedules, and each one needs a named owner before the migration starts.

Patching and version upgrades

GLPI 11.0 and 12.0 each bring their own PHP and database requirements, and the GLPI installation docs list only MySQL and MariaDB as supported databases. Every GLPI release needs the application files replaced and php bin/console db:update run, so the web server, PHP runtime and database must be tested together. Ask your hosting provider or internal team who owns the PHP and database lifecycle, and how often security patches are applied.

Backups and restore testing

The GLPI update procedure requires a backup of the database, the files and the config directory, including glpi.key and glpicrypt.key. Losing those keys can make encrypted stored data unreadable, so they must be backed up separately and kept with the database snapshots. A backup that has never been restored in a test environment is not evidence of recovery, so schedule restore tests as a recurring task and record the results.

Plugin revalidation after major updates

Since GLPI 11.0, plugins are suspended when a new version is detected and must be reactivated after major updates. Each plugin you depend on needs a check against the new core version before you upgrade production, and some may need replacement or removal. Confirm with your team which plugins are in use and whether each has an active maintainer.

Endpoint agent rollout

Freshservice's asset discovery is replaced here by GLPI Agent, which collects hardware and software inventory on Windows, macOS and Linux. Deployment, version updates and the handling of devices that are offline or roaming are ongoing tasks, not a one-time install. Decide early how the agent is packaged and pushed, and who responds when inventory stops arriving from a device group.

Identity integration

GLPI authenticates against its internal database, LDAP directories, IMAP servers and external methods such as REMOTE_USER, tried in that order. Directory changes, group mappings and account offboarding must be checked whenever the directory team changes its schema or policies. Agree on who maintains the LDAP bind account, its password rotation and the mapping from directory groups to GLPI profiles.

Monitoring and incident response

Freshservice's uptime is operated by its vendor, while a self-hosted GLPI or iTop instance depends on your own alerting for web server, database, disk and certificate health. Define who receives alerts out of hours, how long a ticketing outage can be tolerated, and how the service is reported to IT leadership. Ask any hosting partner for their monitoring scope in writing, including what happens when the database fails at night.

Questions European IT teams ask before self-hosting Freshservice

Does self-hosting GLPI cost less than staying on Freshservice?

It can, but the answer depends on which costs you count. GLPI is free under GPL-3.0, so the license line disappears. What remains is the infrastructure to run it, the initial migration, the staff time to operate and upgrade it, backup and monitoring, and any paid support you choose to buy. The GLPI Network subscriptions page lists per-user cloud pricing and self-hosted subscriptions starting at 100 euros per month, which is useful for comparison if you want vendor support. Freshservice costs are set by your plan and agent count, so ask your Freshservice account team for the current quote for your agents and asset units. Then ask DeployOpen for a written scope so you can compare one-time migration work and recurring operations on the same sheet.

How long does an EU migration from Freshservice take?

No single duration applies, because the timeline depends on the volume and quality of your data and on how much you rebuild. The main drivers are the size of the XML account export, how many asset records need reconciling, how many workflows, SLAs and service catalog items must be recreated in GLPI, the number of integrations to Freshservice that need replacement, and how many approval steps your data protection and security teams require before go-live. Parallel running and user training also add time. Ask for a timeline with named phases in the written scope, and confirm which items are in scope for the export and which are excluded.

Can our own team run GLPI without an external partner?

Many teams can, provided they have someone who owns the platform. GLPI needs a supported web stack, with PHP 8.3 or later and MariaDB 10.11 or later or MySQL 8.0 or later for the current README requirements, and the web server document root must point to GLPI's public directory. Upgrades require backing up the database, files and the config directory including glpi.key and glpicrypt.key, replacing application files and running php bin/console db:update. Since GLPI 11.0, plugins are suspended after a new version is detected and must be reactivated after major updates. Your team also owns backups, patching, monitoring, LDAP or SSO integration and GLPI Agent rollout. If those skills are thin, a retainer or fixed-scope engagement can cover them.

Does hosting Freshservice in Frankfurt satisfy GDPR?

Regional hosting addresses where data sits at rest, but it does not settle every GDPR question. Under the EDPB Guidelines 05/2021, remote access from a third country, even only displaying data on a screen for support, is a transfer, and so is storage in a cloud outside the EEA. Whether a Frankfurt-hosted service is compliant depends on whether the provider or its staff can access data from elsewhere and on the legal exposure of the provider to third-country authorities. The US CLOUD Act at 18 U.S.C. 2713 applies regardless of where data is located, so ask Freshservice in writing about support access locations, sub-processors and how it handles government requests. Your data protection officer should make that assessment, and DeployOpen does not issue legal opinions.

What does the EU Data Act switching right mean for exit planning?

The Data Act, applicable since 12 September 2025, gives customers the right to switch from a data processing service to another provider or to on-premises ICT infrastructure, with a maximum two-month notice period and a 30-day transition. Switching charges are banned from 12 January 2027. For an exit plan, this means you can request the switch, but you still need working exports, a tested import path and internal capacity to receive the data. Article 32 also requires providers to address third-country governmental access to non-personal data held in the Union. Confirm the contract terms and export formats now, while the account is still active.

Which Freshservice export do we need before a migration?

Freshservice account administrators can export the full service desk from Admin, Account, Export, and the data arrives as XML at the registered agent email address. That export is the starting point for a GLPI migration. Before you start, confirm that the export includes the conversation history you need, check the file size and whether your mailbox accepts it, and inventory the fields that do not map cleanly to GLPI. Keep a copy stored under your own retention rules. Your migration partner should review the export against the target data model before any import.

What should DeployOpen put in writing before we start?

DeployOpen works on fixed scope, so the written agreement should state the target environment in your cloud account, data center or air-gapped network, the GLPI version and components in scope, the data sources to migrate, the deliverables for hosting, hardening, backup and documentation, and the acceptance criteria. It should also name your responsibilities, such as providing access, approving data mapping and testing workflows. Ask for how support and upgrades are handled after go-live, whether through a retainer, and for the evidence package your compliance team needs. DeployOpen prepares systems and evidence for compliance assessments but does not issue audit reports or certifications. Quotes follow from this written scope.

Can we keep our Freshservice data in an EU provider's data center?

Yes, self-hosting in your own infrastructure or in an EU provider's data center keeps the platform under your control, but it moves responsibility to you or your contractors. Your provider choice still matters, because a provider subject to third-country law with extraterritorial effect should be assessed before you engage it, as the EDPB Guidelines 05/2021 (Example 12) explain. Confirm where backups and logs are stored, who holds administrative access and whether the provider receives access requests from foreign authorities. Also check the GLPI Agent network traffic paths, since agents send inventory to your GLPI server.

Evidence auditors and data protection officers ask for

Moving Freshservice data to GLPI or iTop in an EU data center changes where records sit, but auditors and data protection officers will ask for paper that shows where data lives, who can reach it and how it is recovered. DeployOpen prepares this evidence from the implementation, while independent auditors and data protection authorities decide whether it is sufficient.

Records of processing and transfer assessments

The record of processing activities should name the GLPI or iTop instance, the categories of personal data in tickets and asset records, and the hosting location. Where any support person, vendor or sub-processor could view data from a third country, the transfer assessment must cover that remote access, not only storage. Check that the record matches the actual hosting and support setup, since EDPB guidance treats screen-level remote access from outside the EEA as a transfer.

Data location and access logs

Keep a current map of where the database, file store, backups and GLPI Agent inventory data sit, including any replicas. Access logs should show who logged in as an administrator, from which network and when, so you can answer a question about a specific record. Confirm that logs are retained in the same jurisdiction as the data and are not sent to a third-party log service you have not assessed.

Vendor and hosting contracts with processing terms

Each hosting provider, managed database operator or support firm that touches the platform needs a contract with data processing terms that match GDPR Article 28 duties. Ask providers where they store and access data, which sub-processors they use, and how they respond to foreign government requests. Include a contract clause for exit assistance, because moving off a provider later is harder without it.

Backup and restore test records

A backup is evidence only after a restore has been tested. Keep records of each restore test with the date, the backup set used, the GLPI version, and whether the database and the files directory came back together with the glpi.key and glpicrypt.key files. Without those keys, restored encrypted data may be unreadable, so the restore record should show that the keys were included and checked.

Configuration baselines for web and database

Document the configuration of the web server and database tiers as a baseline: the document root pointing to GLPI's public directory, URL rewriting, TLS settings, PHP version, and the MariaDB or MySQL version and settings. Store the baseline under version control and record each approved change. Auditors use these baselines to confirm that the production system matches what was reviewed.

Administrators with remote access

Maintain a named list of every person and service account with administrative or remote access to the servers, the database and the GLPI console, with the reason for access and the date it was granted or removed. Include vendor engineers who connect for support. Review the list on a set schedule and compare it with login records, since a remote session from outside the EEA may itself be a transfer to record.

How to move Freshservice data out without losing the ticket history

The first exit step is to get a complete copy of the service desk out of Freshservice before any cutover decision is made. A Freshservice account administrator starts the full XML export from Admin, Account, Export, and the file arrives at the registered agent email address rather than as a download in the browser. Confirm that the mailbox is monitored by someone who can hand the file to the project team under your own data handling rules, and confirm with Freshservice support how long the export link stays valid and whether it covers every module your team uses, including conversation history, assets and knowledge base content.

The XML file is not directly importable into GLPI. Ticket, requester, asset and conversation records must be mapped to GLPI's data model, and the mapping decisions (which Freshservice statuses become GLPI statuses, how requesters are matched to GLPI users, how custom fields and attachments are carried over) determine whether the ticket history stays readable after the move. Keep the export as an untouched archive, and treat each mapping decision as a record your auditors may later ask about. The sibling migration page covers the field-level work in detail.

Plan the exit as an operating decision, not only a data task. Under the EU Data Act, the right to switch from a data processing service to another provider or to on-premises ICT infrastructure applies from 12 September 2025, with a maximum two-month notice period and a 30-day transition, and switching charges are banned from 12 January 2027 (Articles 25, 29 and 50). Read your Freshservice contract against those terms, and ask your provider to confirm in writing which export formats, timelines and assistance they will provide during the transition. Start the export rehearsal before notice is given, so the cutover date is driven by test results instead of the contract calendar.

How DeployOpen deploys GLPI or iTop under EU residency rules

DeployOpen is a Chainscore Labs company that plans, implements, hardens, backs up, documents and supports self-hosted open-source platforms inside the client's own infrastructure, including EU data centers and EU provider accounts. For EU data sovereignty work, we scope the hosting location, access paths and operating duties in writing before any build starts, so the residency decision is tested against the real deployment.

How we scope

Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
The written scope names the hosting location, the operator accounts and who holds administrative and remote access.
We map which personal data and attachments enter the system and where backups and logs are stored.

How we build

We install GLPI or iTop in the agreed EU environment, with the web server, database and PHP versions matched to the vendor requirements.
We configure authentication, role-based access and encrypted backups, and confirm that no vendor-hosted component receives ticket data.
We test restores, the GLPI or iTop update path and inventory agent deployment before go-live.

How we hand over

Handover includes configuration records, access inventories, backup and restore runbooks and the update procedure.
We document the data flows and transfer assessment inputs so your legal and compliance teams can review them.
We provide DeployOpen documentation for operators, and we do not issue audit reports, attestations or certifications.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can cover applying GLPI or iTop releases, re-activating plugins after major updates and checking backups.
Ask for the support response terms, escalation path and any SLA in writing before you sign.