Self-hosted Confluence alternative for EU data sovereignty

Why a self-hosted Confluence alternative fits EU data sovereignty

For a European organization, the question is where page content and user data are processed and who can reach them. The short answer is that XWiki or Docmost running in your own data center or in an EU provider's data center can meet that requirement, subject to a transfer assessment that you carry out for your own processing. Atlassian's data residency option keeps page content in a region you choose, but user account data sits outside that scope, so your records of who edits, views and administers pages can still be processed under terms you did not select. Under GDPR, that gap matters because personal data about staff and contractors is personal data whether it sits in a page or an account profile.

Self-hosting moves both layers under your control. With XWiki or Docmost, the application, the database (PostgreSQL for Docmost, a MySQL, PostgreSQL or MariaDB variant for XWiki), user directory and file storage all run in infrastructure you choose. The decisions that remain are concrete: which region hosts the database and attachments, whether your identity provider stays in the EU, and whether any support engineer, backup vendor or hosting provider can view data from a third country. The EDPB's 05/2021 guidelines treat remote access from a third country, even just displaying data for support, as a transfer, so vendor support access needs the same review as storage. Confirm these points with your hosting provider and your data protection officer rather than assuming them.

Hosting in the EU does not settle every question. The EDPB's Recommendations 01/2020 note that where a provider can be compelled to hand over data in the clear, an effective technical measure may not exist, and the US CLOUD Act reaches providers regardless of data location. Those risks apply to any cloud provider subject to foreign law, so ask each processor about government access requests and document your assessment. Public sector bodies should also check the rules that apply to them, since national requirements can be stricter than GDPR. The next sections cover how each platform handles these questions in practice.

What GDPR and public sector rules require for hosted wiki data

A wiki holds personal data in page content, comments, attachments and user accounts, so every copy, backup and support session counts as processing. The cards below set out the transfer, access and enforcement rules that decide where a self-hosted XWiki or Docmost instance can safely run, and where a vendor's residency promise still needs legal review.

Chapter V applies to every transfer

Article 44 requires every transfer of personal data to a third country to meet Chapter V conditions, and that includes onward transfers made by your processors. For a wiki, this covers page content, attachments and the user records that the platform holds. Map where each copy lives, including backups and log files, and confirm with your data protection officer which of those locations are outside the EEA before you pick a host.

Fines for transfer infringements

Infringements of Articles 44 to 49 fall under the higher fine tier in Article 83(5)(c), with a ceiling of EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Your wiki's hosting decision is therefore a board-level compliance item, not only an IT one. Document the transfer analysis for each wiki component, and keep it current when you change hosts, regions or subprocessors.

Remote access counts as a transfer

The EDPB's Guidelines 05/2021 state that remote access from a third country is a transfer, even when the data is only displayed on a screen for support or administration. An administrator in another country who troubleshoots your wiki from home is therefore in scope. Restrict vendor and contractor access to EEA locations, log administrative sessions, and write these access paths into your records of processing.

Limits on third-country disclosure orders

Article 48 allows a third-country court judgment or administrative decision requiring disclosure of personal data to be recognized or enforced only if it rests on an international agreement, such as a mutual legal assistance treaty, in force with the Union or a Member State. The CLOUD Act's 18 U.S.C. 2713 reaches data under a US provider's control wherever it sits. Ask any hosted wiki vendor how it assesses such requests before you rely on its residency commitments.

Data Act duty for non-personal data

Article 32 of the EU Data Act requires providers of data processing services to take technical, organisational and legal measures against third-country governmental access to non-personal data held in the Union, where that access would conflict with EU or national law. Wiki metadata, usage logs and configuration exports often fall under non-personal data. Ask the provider for its written measures, and confirm with the relevant public authority which rules apply to your sector.

How XWiki and Docmost compare on hosting control

XWiki is licensed under the LGPL 2.1, and its official Docker images are published under the same license. You can run it in your own data center, in a private cloud account or in an EU-based provider's environment, so page content, attachments and user data stay where you place them. The official images come in MySQL, PostgreSQL and MariaDB variants, each running on Tomcat, for amd64 and arm64v8, which gives you a choice of database engine to match your existing operations skills.

Self-hosted placement: Your team controls the hosts, the database and the storage, so you decide the country and provider for every copy of the data.
Support from XWiki SAS: On-premises professional support, installation help and training are sold separately, and the company also offers XWiki Cloud hosting on ISO 27001 certified infrastructure.
Cloud hosting is a provider choice: If you use XWiki Cloud, the hosting company, its sub-processors and any entity with access to the systems must be assessed for third-country transfer exposure. Certification of the infrastructure does not answer that question on its own.
Paid extensions: Confluence Migrator Pro and XWiki Pro add-ons are commercial products, so confirm which features you need and whether they are covered by the LGPL core.
Operations ownership: Patching, backups and TLS are your responsibility unless you contract them out.

Confirm with XWiki SAS which hosting location and sub-processors apply to any cloud offer, and confirm the license of each extension you plan to deploy.",

Where Atlassian data residency meets the constraint and where it does not

Atlassian data residency keeps page content in a region you choose, but user account data falls outside that scope. For a GDPR review, the gap matters because account data, such as names, work email addresses and login records for employees, is personal data in its own right. A residency setting that covers page content does not, on its own, answer where account data is stored, who can reach it, or whether it leaves the EEA. Before relying on the setting for a data protection impact assessment, ask Atlassian to confirm in writing which data categories the setting covers and which it does not, and record the answer in your register of processing activities.

The transfer questions that remain sit with the vendor and its sub-processors. Under EDPB Guidelines 05/2021 (version 2.0), remote access from a third country, even only displaying data on a screen for support or administration, is a transfer, and so is storage in a cloud outside the EEA. Ask Atlassian which sub-processors can access content or account data, where each operates, and whether support or operations staff outside the EEA can view customer data. Also ask for the current list of sub-processors and how changes to it are notified, since both change over time.

The legal exposure is a separate question from location. The US CLOUD Act provision at 18 U.S.C. 2713 requires providers to preserve or disclose data in their possession, custody or control, wherever that data is located. EDPB Recommendations 01/2020 state that where a provider needs access to data in the clear and the destination's public authority powers go beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned. Review the data processing terms, the standard contractual clauses in use, your transfer impact assessment and Atlassian's policy for government access requests with your data protection officer and counsel. This page does not decide whether that arrangement is compliant. That conclusion belongs to your organization and, where required, your supervisory authority.

Deploying XWiki or Docmost in an EU data center

This sequence produces a self-hosted wiki whose database, files, secrets, sign-in and administrative access are all placed and documented inside the EU, with the Confluence content moved in under the same controls.

Choose the hosting location and provider
Decide whether the wiki runs in your own data center or in an EU provider's facility, and confirm the contract places compute, storage and backups in the EU or EEA. Your data protection officer and legal team should sign off the provider terms, including any clause on sub-processors and their locations. The output is a written hosting decision naming the region, the provider entity and the data center. Ask the provider in writing where support staff, backup copies and monitoring data are held, because each of those can be a transfer under the EDPB Guidelines 05/2021 even when the primary data stays in the EU.
Map every transfer path before deployment
Draw a data flow map covering the wiki's users, the server, the database, file storage, backups, logs, email relays, and every remote administration route. Mark each point where data could be displayed, copied or accessed from outside the EEA, including vendor support sessions and remote console access. Under Article 44 of the GDPR, onward transfers count too, so the map must include subcontractors. The output is a signed-off transfer register that the team reviews before go-live. Anything you cannot place inside the EEA needs a documented legal basis or a supplementary measure before it is used.
Deploy from the official image or compose template
For XWiki, deploy the official Docker image with a MySQL, PostgreSQL or MariaDB variant and confirm the database volume sits on storage in the chosen region. For Docmost, use the compose template, which runs PostgreSQL 18 and Redis 8 images and stores files locally by default, and point the S3-compatible or Azure Blob option at a bucket in the EU if you use object storage. Pin image versions and record the tags you deployed. The output is a running stack whose container, database and file locations are written into your configuration inventory. Confirm each image source against the official repository before pulling it.
Set the APP_SECRET and identity provider inside the EU
For Docmost, generate an APP_SECRET of at least 32 characters, store it in a secrets manager located in the EU, and never place it in a shared compose file. Connect sign-in to an identity provider you control inside the EU, such as an on-premises directory or an EU-hosted SAML or OIDC service, and confirm the authentication path does not send credentials to a third-country identity service. Note that SAML, OIDC, LDAP and SCIM are paid-edition features for Docmost, so check the edition before relying on them. The output is a test login from an EU network with the secret stored and logged outside the wiki host.
Configure the reverse proxy with WebSockets
Place the wiki behind a reverse proxy in the same EU environment, terminate TLS there, and enable WebSocket support, which Docmost requires for its real-time editor. Restrict the proxy's access logs, error logs and certificate handling to EU systems, and disable any third-party CDN or analytics script that would send page or user data outside the EEA. The output is an editing session in two browsers that updates live, plus a captured trace showing that no request from the wiki front end goes to a non-EU host.
Restrict administrative access to assessed locations
Limit administrator accounts to named staff located in the EEA, or to staff in third countries only after a transfer assessment and documented supplementary measures. Require multi-factor authentication for admins, use a bastion or VPN from managed devices, and disable vendor remote access unless it is logged and time limited. Under EDPB Guidelines 05/2021, even viewing data on a screen during remote support counts as a transfer, so vendor engineers outside the EEA should not get standing access. The output is an access list, a session log sample and a written rule for emergency access.
Run the Confluence export and import under the same controls
Export the Confluence content using the format your target supports, and move the export files only through the EU transfer path mapped earlier. Run the import into a staging instance in the same region, then check page counts, attachments, permissions and internal links against the source. Migration paths differ by target: XWiki's Confluence Migrator Pro and its open-source filter read XML or CSV backups, while Docmost imports HTML space exports and treats its Confluence importer as a paid-edition feature. See the sibling migration topics for those details. The output is a reconciliation report, kept as compliance evidence, and deletion of staging copies once it is accepted.

Evidence a regulator or auditor will ask for

A self-hosted wiki moves the question from where a vendor stores data to what your organization can prove about storage, transfers, access and deletion. The cards below list the records a data protection authority, public sector reviewer or external auditor is likely to request, and what each one must show for this wiki. DeployOpen prepares the controls and evidence, but independent auditors and certification bodies issue any attestation.

Record of processing and data locations

Under GDPR Article 30, controllers keep a record of processing activities. For a wiki, that record should name each data category the wiki holds (page content, attachments, user accounts, audit logs, backups), the hosting location of each, and the systems that replicate or cache them. Confirm whether draft pages, file uploads and search indexes sit in the same region as the database. A diagram alone rarely satisfies a reviewer, so pair it with the configuration that proves each location.

Transfer impact assessments per path

Each third-country route needs its own assessment: remote administration from outside the EEA, a support vendor with access to the database, a hosted backup target, or a cloud provider subject to foreign law. EDPB Guidelines 05/2021 treat even screen-only remote access as a transfer. For each path, record the legal basis, the supplementary measures, and the conclusion on whether a third-country authority could compel access. Reassess the file when the Data Privacy Framework appeal, Case C-703/25 P, is decided.

Provider contracts and sub-processor lists

If an EU hosting provider, managed service firm or consultant processes personal data, a data processing agreement under GDPR Article 28 must exist, and each sub-processor must be listed and approved. Ask each provider where its support staff sit, whether it uses a parent company with foreign ownership, and how it notifies you of changes. For implementation partners, the written scope should state which systems they can reach, from where, and for how long. Store the signed contracts next to the transfer assessments so they can be produced together.

Access logs and admin access records

Auditors will ask who could reach page content and who actually did, over a defined period. Keep administrator account lists, role assignments, SSO and MFA settings, and a log of privileged sessions, including vendor logins. For Docmost, confirm which features needed a paid edition for SSO, LDAP, SCIM or audit logs, because the Community edition may not provide the same records. For XWiki, check which logs the platform writes and where the reverse proxy and database logs go. Test that logs are retained and cannot be altered by the people they record.

Backup and deletion procedures

Erasure requests under GDPR Article 17 must reach backups within a documented process, not only the live database. Write down the backup schedule, backup encryption, the location of each copy, the restore test results, and the rule for purging personal data from older backups. Confirm that deleting a page or user also removes attachments, search index entries and cached copies. Also record how the organization will export its content if it leaves the platform, since the Data Act gives customers switching rights for many cloud services.

Questions European buyers ask before hiring help

What does a self-hosted XWiki or Docmost project cost, and what drives it up?

The software licenses are not the main cost. XWiki Standard and the Docmost Community edition are free to run, so the spend falls on hosting, migration work, configuration, administration and any support you buy. Hosting in your own data center or an EU provider's cloud is recurring. Migration effort rises with the number of spaces, attachments, macros and Marketplace apps you need to rebuild. For XWiki, the supplied list prices include consulting at 1200 EUR per day, available with a Business or Enterprise support plan, and the Confluence Migrator Pro priced from 2000 EUR. For Docmost, the Business plan is listed at $6 per seat per month billed annually with a 10-seat minimum, and the Confluence importer is a paid-edition feature. Ask any provider for a written quote that separates one-time work from recurring hosting, support and seats.

Does hosting in an EU data center remove the GDPR transfer question?

No. An EU location removes the transfer only if no one outside the EEA can access the data, and the assessment still has to be done. The EDPB Guidelines 05/2021 state that remote access from a third country, even just displaying data on a screen for support, is a transfer. A provider with an EU data center may still be subject to third-country law with extraterritorial reach. The guidelines say using such an EU processor is not itself a transfer, but complying with a third-country authority request would be, so you should assess that exposure before engaging the provider. Ask who holds administrative access, where support staff sit, and which sub-processors touch the data.

What are my switching rights under the EU Data Act?

Under the Data Act, which has applied since 12 September 2025, you have the right to switch from a data processing service to another provider or to on-premises ICT infrastructure. Articles 25, 29 and 50 set a maximum two-month notice period and a 30-day transition, and switching charges are banned from 12 January 2027. This matters when your current cloud wiki provider is the obstacle. Check your contract for the exit terms and export formats now. Confirm with counsel whether your service fits the Act's definition of a data processing service, because that determines which obligations apply.

Can our own IT team run a self-hosted wiki without outside help?

Yes, many teams do, especially for a single wiki with a modest number of users. The official XWiki Docker images come in MySQL, PostgreSQL and MariaDB variants, and Docmost recommends Docker with PostgreSQL 18 and Redis 8, so the platform setup is manageable for a container-experienced team. The harder work is a controlled migration, permissions mapping, SSO and MFA configuration, reverse proxy setup with WebSockets for Docmost's real-time editor, backups, and patching. Check whether your team has capacity for those tasks over time, not just the first install. Many organizations split the work: internal staff run the platform and an outside firm handles the migration or hardening.

How long does a Confluence migration to XWiki or Docmost take?

No duration is supplied for this work, so no timeline can be quoted from the research. The scope sets it. The main drivers are the number of spaces and pages, the volume and type of attachments, how many macros and Marketplace apps you depend on, the permission model you must reproduce, and whether SSO and integrations must be live at cutover. Confluence Cloud XML site and space export reaches end of life on December 1, 2026, so plan the export format early. DeployOpen agrees a fixed scope and timeline in writing before work starts, so ask for a scoped plan with milestones rather than a generic estimate.

Which compliance evidence does a migration give an auditor?

A migration gives you configured systems, documented controls and collected evidence, such as access settings, logging, backup records and data flow maps. It does not give you an audit report or certification. DeployOpen prepares systems, controls and evidence for compliance assessments, but independent auditors and certification bodies issue the reports. For public sector work, confirm the applicable national security and records rules with your authority, because those requirements may go beyond GDPR. Ask any implementation partner which evidence they will deliver and in what form.

What public sector buyers should confirm before choosing

The first thing a public sector buyer should confirm is which rules actually apply, because data protection, procurement, records management and information classification requirements vary by member state and by body. A federal ministry, a regional authority, a municipality and a publicly funded hospital may each face different hosting and sourcing conditions. Before comparing XWiki and Docmost on features, ask the contracting authority and its data protection officer which hosting locations, subprocessors and access conditions it will accept, how the wiki's content is classified, and whether any national cloud or sovereignty framework applies. Those answers decide whether a self-hosted deployment in your own data center, or in an EU provider's data center, is the simpler path.

If a hosted option or a managed service is on the table, the Data Privacy Framework needs specific attention. The Commission's adequacy decision, Implementing Decision (EU) 2023/1795, covers transfers to US organizations that appear on the Data Privacy Framework List, and no other US provider. An appeal against the General Court's September 2025 judgment upholding the decision is pending as Case C-703/25 P. Do not assume a US vendor or its EU subsidiary is covered. Ask the provider for its current listing status in writing, which legal entity would process the data, which subprocessors and support locations are involved, and what the contract says if the adequacy decision is set aside. Involve your legal team in that review, since the answer depends on the entity and the contract, not on the marketing page.

How DeployOpen works on this

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source wikis inside the client's own infrastructure, including the cloud accounts, data centers or EU provider environments where the wiki must reside. For EU data sovereignty, the work starts with where personal data flows and who can reach it, then sets up the wiki to match that answer.

How we scope

Map which user, page and attachment data would sit in each candidate region and provider environment
Record the chosen target, XWiki or Docmost, and the edition needed for SSO, MFA and importers
Agree deliverables and timelines in writing before work starts, as fixed-scope engagements

How we build

Deploy the wiki and database in the agreed location, with storage, backups and logs kept in-region
Configure identity sign-in, MFA and permissions against the client's own directory service
Test the migration path from the Confluence export format the client can still obtain

How we hand over

Document the data flow map, sub-processor list and access model for the client's records of processing
Provide runbooks for hosting, backups, upgrades and restoration, with the controls evidence gathered
Deliver the evidence pack that the client's own auditors or certification bodies will need to review

How we support

Offer ongoing support, upgrades and continuous security testing as a retainer after handover
Keep upgrade and patch cycles under the client's change control, with testing before each release
Confirm legal questions about transfers and third-country access with the client's counsel and data protection officer