Self-hosted HubSpot alternative for EU data sovereignty

Can a self-hosted HubSpot alternative meet EU data sovereignty needs?

For a regulated EU organization whose marketing contacts, consent records and campaign data sit with a US-owned SaaS vendor, the main route is to self-host Mautic for automation and listmonk for newsletters in EU infrastructure the organization controls. That answer depends on three things: the transfer analysis for the data already held, the physical and administrative location of the hosting, and the email sending provider chosen for outbound mail. HubSpot's EU data center may reduce some exposure, but it does not by itself settle what happens when a US parent company, support staff or a US authority can reach the data. Whether a transfer occurs is a question the GDPR answers through Chapter V, and the EDPB Guidelines 05/2021 treat remote access from a third country, even for support screens, as a transfer.

Start by mapping every place marketing data flows today: contact records, consent and preference history, form submissions, tracking data, CRM sync and backups. For each one, ask HubSpot in writing where the data is stored, which sub-processors can access it, which support locations can view it, and how it is covered by the transfer mechanisms in its data processing terms. Then run the same mapping for the target design. Mautic is licensed under GPL-3.0 and runs on your own database, so the data location is your decision, but you still need to confirm the cloud account, the backup location and the operators with administrative access. Mautic's requirements page advises against shared hosting, so plan for a dedicated VPS or server in an EU region you select.

The email sending provider is the component most often overlooked. Mautic and listmonk send mail through an SMTP relay or API that you choose, and that provider receives recipient addresses, message content and delivery events. Evaluate it under the same transfer test as the rest of the stack, and confirm whether it offers EU-based processing and where its logs are kept. DeployOpen can prepare the hardening, configuration, documentation and evidence for these controls, but it does not issue audit reports, attestations or certifications. Independent auditors and certification bodies make those determinations, so involve your data protection officer and assessor early.

What EU data sovereignty requires for marketing data

Marketing data is personal data, so the moment contacts, form submissions or campaign logs leave the EU or become reachable from outside it, GDPR Chapter V applies. The cards below set out the transfer rules, the court and regulator positions that shape them, and the foreign-law exposure you need to assess for any provider you choose.

Transfers to third countries

GDPR Article 44 requires every transfer of personal data to a third country to meet Chapter V conditions, including onward transfers made by your processors. For marketing data, that covers exported contact lists, form submissions, email engagement logs and tracking data. Map every system that stores or processes these records, including backups and support tooling, and record the country where each one holds data.

Remote access counts as a transfer

The EDPB's Guidelines 05/2021 treat remote access from a third country as a transfer, even when the person only views data on a screen for support or administration. Storage in a cloud outside the EEA is also a transfer. Ask any SaaS vendor which staff can see your contact database from outside the EU, which support tools mirror it, and where their administrators sign in from.

Schrems II and supplementary measures

In Case C-311/18 (Schrems II), the Court of Justice invalidated the EU-US Privacy Shield while upholding standard contractual clauses. The EDPB's Recommendations 01/2020 add that where a provider must access data in the clear and the destination's public authority powers exceed what is necessary and proportionate, no effective technical supplementary measure can be expected. Marketing platforms that need plaintext contact data for sending and segmentation fall into this category, so ask for the provider's transfer impact assessment.

Data Privacy Framework and its appeal

Commission Implementing Decision (EU) 2023/1795 recognizes adequate protection only for US organizations on the Data Privacy Framework List. Check that your vendor is on that list, not just claiming compliance. An appeal against the General Court's September 2025 judgment upholding the framework is pending as Case C-703/25 P, so treat the framework as a basis that may change and keep a fallback contract structure in your records.

CLOUD Act exposure

18 U.S.C. 2713 requires US electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control, wherever that data is stored. A provider headquartered in the US can therefore be compelled to produce EU-hosted marketing records. Confirm with the vendor whether it is subject to this provision, whether it has a policy for handling government requests, and whether your data is in its control in the first place.

Foreign authority requests and Article 48

GDPR Article 48 allows a third-country court order to be recognized in the EU only when it rests on an international agreement, such as a mutual legal assistance treaty, in force with the Union or a Member State. This is the legal gap a foreign disclosure order exploits. Self-hosting in EU infrastructure you control removes the vendor as the party receiving such orders, but your email sending provider and any hosted add-on still need the same review.

What HubSpot's EU data center covers and what it does not

The constraint is about where marketing data is stored, who can access it, and which legal regime governs that access, not only where a server sits. A HubSpot account can be hosted in an EU data center and still involve sub-processors, support staff, or corporate parents outside the EU, so the hosting region answers only one of the questions a transfer assessment asks. Treat the EU hosting setting as a starting point for your own review rather than as a finished answer.

The supplied facts do let you see what leaves the platform. Contacts, companies, deals, tickets and custom objects can all be exported as CSV, XLS or XLSX files, with exports delivered by email link, and the CRM Contacts API reads, creates, updates and upserts contact records. Any of these routes is a copy of personal data that must stay under your control after it leaves HubSpot, including the exported spreadsheets sitting on laptops and the records your integrations cache. Inventory where each export and API consumer writes its data before you decide what moves.

The facts do not establish which HubSpot sub-processors, support access paths or US legal exposure apply to your account. Ask HubSpot in writing for its current sub-processor list, where support staff access data from, whether remote access from outside the EU occurs, and how it responds to government requests. Then run your own transfer assessment under EDPB Guidelines 05/2021 and the Data Privacy Framework position noted in the same review. Record the answers, because they determine whether a self-hosted deployment in EU infrastructure you control removes a transfer or only narrows it.

Which open-source options fit the sovereignty constraint

Mautic covers the core marketing work: contacts, segments, forms, campaigns and workflows that connect to a CRM. It is licensed under GPL-3.0, and the project describes self-hosting on your own database as the way to own your data. Contact records, segment membership, form submissions and campaign history sit in the database you provision, so the location of that database becomes your data residency decision.

License: GPL-3.0 applies to Mautic itself. Ask counsel what obligations apply to any custom plugins you distribute outside the organization.
Hosting: The project says Mautic should not run on shared hosting and recommends a VPS or dedicated server. Mautic 7.0 expects MySQL 5.7 or higher with InnoDB, or MariaDB 10.2 or higher.
Background jobs: Segment updates, campaign triggers and broadcasts depend on cron jobs and a messenger consumer. Your operations team must monitor these inside EU infrastructure.
CRM gap: Mautic has no built-in CRM. Sales data requires the documented Salesforce plugin, the HubSpot plugin or a sync you build and maintain.
Version support: Support windows differ by release. Mautic 7.2 has security support until 30 September 2026, and Mautic 7.3 is planned as the long-term support release with security support through 31 December 2027.

Before committing to a hosting design, confirm which Mautic version you will run, its support end date and the CRM integration you need.

Mautic, listmonk and Dittofeed trade-offs at a glance

This table compares Mautic, listmonk and Dittofeed on license, where data sits, channels, and CRM plugin availability, along with what each leaves out. Read it as a shortlist filter: the option that covers your campaign and CRM needs in your own EU infrastructure is the one to test first, and any gap should be confirmed with the vendor before you commit.

Trade-off	Mautic	listmonk	Dittofeed
License	GPL-3.0 or later, free to self-host	AGPL-3.0, self-hosted	MIT-licensed
Data location	Your own database and servers in EU infrastructure you control	Single binary with PostgreSQL on your servers	Self-hosted on your infrastructure; confirm required components
Channels	Email, forms, landing pages, campaigns and segments	Email newsletters and campaigns, lists and templates	Email, mobile push, SMS, WhatsApp and Slack
Salesforce plugin	Documented plugin; confirm version fit with your Salesforce setup	Not documented as a CRM connector	Not documented as a CRM connector
HubSpot plugin	Documented HubSpot plugin; confirm current scope with Mautic	Not documented as a CRM connector	Not documented as a CRM connector
Forms and landing pages	Included	Not included	Not included
What it leaves out	Operations work: cron jobs, mail queues, upgrades and PHP hosting	Forms, landing pages, lead scoring and CRM	Forms, landing pages and a full marketing suite; confirm with vendor

Choosing an EU email sending provider

Self-hosting Mautic and listmonk moves the application and its database into infrastructure you control, but it does not move the sending path. Every campaign still leaves your servers through an SMTP relay or an email API operated by a third party, and that provider receives recipient addresses, message content and engagement signals. Treat the sending provider as a processor in your data map from day one, with the same scrutiny you apply to the database host. Choosing it is a sovereignty decision in its own right, and it is one the self-hosted stack does not make for you.

Ask each candidate provider where mail is processed, where delivery logs, bounce records and complaint data are stored, and whether any of those stores are replicated outside the EEA. Ask for the current list of sub-processors with their locations, the transfer mechanism that covers any non-EEA access, and whether support staff can view message content from a third country. Ask whether the provider is itself subject to third-country law with extraterritorial reach, such as a US-headquartered parent that could receive an order under 18 U.S.C. 2713. The EDPB's Example 12 in EDPB Guidelines 05/2021 says using such an EU processor is not by itself a transfer, but complying with a third-country authority request would be, so the exposure needs an assessment before you sign.

Confirm every answer in writing with the provider rather than relying on marketing pages, and record the answers in your transfer assessment alongside the Mautic and listmonk hosting decisions. Ask for data processing terms that name the storage locations for logs and bounces and set retention periods for each. If the provider cannot give a precise answer on access by foreign authorities, plan for that risk explicitly, for example by limiting the personal data sent through the provider, minimizing stored logs, or choosing a second EU-based provider for sensitive lists.

How to deploy Mautic and listmonk in EU infrastructure you control

This sequence takes you from choosing an EU hosting location to a documented, backed-up, access-controlled deployment of Mautic and listmonk, with the data flows recorded for your transfer assessment. Each step ends with a check you can verify before moving on.

Choose the EU hosting location and provider
Your team, or DeployOpen under a written scope, selects a hosting provider and data center location inside the EU or EEA that you can contract with directly. Confirm the legal entity behind the provider, where support staff can access systems from, and whether any sub-processors or management tools sit outside the EEA. Ask the provider for its data processing terms and sub-processor list in writing. The step is done when you have a signed contract and a documented region for every server, backup and database.
Provision a VPS or dedicated server
Provision a virtual private server or dedicated server in the chosen region. The Mautic project states that it should not be installed on shared hosting and recommends a VPS or dedicated server instead, so confirm the plan is not a shared web hosting product. Size CPU, memory and disk against your expected contact volume and sending plan, and ask the provider what is included for snapshots and backups. The step is done when you can log in as a non-root administrative user with key-based access and the server reports its region in your inventory.
Install Mautic with a supported PHP and database stack
A systems administrator installs Mautic using Composer with the recommended project template, or the web or command-line installer from the production package. Mautic 7.0 requires PHP 8.2, 8.3, 8.4 or 8.5, MySQL 5.7 or higher with InnoDB or MariaDB 10.2 or higher, and Apache, Nginx or IIS, and npm is needed from Mautic 5.0 onward. Pick the version whose support window matches your plans, and check the release page before you choose. The step is done when the admin login works over HTTPS and the installer reports no outstanding requirement errors.
Configure staggered cron jobs and the messenger consumer
Schedule the Mautic cron jobs for segment updates, campaign updates and campaign triggers, staggering their start times as the documentation advises so they do not run at the same moment. Add the broadcasts command for segment emails, and run a messenger consumer as a supervised service whenever emails are queued. Log each job's output to a file you review. The step is done when a test segment rebuild, a campaign trigger and a queued test email each complete and appear in the logs without errors.
Deploy listmonk with PostgreSQL
Install listmonk as its single binary, backed by a PostgreSQL database on the same EU infrastructure, and run it behind HTTPS with its own domain or subdomain. Keep the database on a private network interface, restrict its access to the listmonk service account, and keep the listmonk configuration file under version control without the secrets. The step is done when a test list accepts a subscription, the confirmation flow works and the admin interface loads over TLS.
Connect the sending provider and verify domains
Choose the email sending provider deliberately, because it becomes a processor that receives recipient addresses and message content, and the transfer analysis depends on where it stores and processes that data. Ask the provider for its data location, sub-processors and whether any support access happens from outside the EEA. Configure SMTP or API credentials in both Mautic and listmonk, publish SPF, DKIM and DMARC records for your sending domain, and send test messages to seed accounts. The step is done when test messages pass authentication checks and the provider's terms are on file.
Set up backups, access control and logging
Create encrypted, scheduled backups of both databases, the Mautic file store and the listmonk configuration, and store copies in the same EU region or another EU location you have documented. Test a full restore on a separate server and record the time it took. Enforce multi-factor authentication for administrators where your stack supports it, limit administrator accounts to named people, and forward web server, cron, database and application logs to a central store that retains them under your policy. The step is done when a restore test succeeds and an access review lists every account with its role.
Document data flows for the transfer assessment
Write a data flow record that lists each system, the personal data it holds, where it is stored and processed, every processor and sub-processor, and every point where a person outside the EEA can access data. Include the sending provider, backup locations, support channels and any monitoring service that receives personal data. Give this record to your data protection officer and counsel so they can assess transfers under Chapter V of the GDPR and the EDPB guidance. The step is done when the record is approved and versioned, and each entry links to a contract or assessment that covers it.

Evidence to keep for a transfer assessment and audit

A transfer assessment is only as defensible as the records behind it. The cards below list the documents and logs an EU team should hold for a self-hosted Mautic and listmonk stack, from the data flow map to the release status of the software in use. Independent auditors and regulators, not DeployOpen, decide whether the resulting position is adequate.

Transfer impact documentation

Record, for each data flow, whether any personal data leaves the EEA, who can reach it from a third country, and which Chapter V transfer tool applies. Remote support sessions that display contact records count as access from a third country under the EDPB guidance, so include administrator and vendor access in the review. Ask your sending provider and hosting provider to confirm in writing where support staff are located.

Records of processing and data flow maps

Keep a current record of processing activities for marketing, with a diagram showing every system that touches contact data: the Mautic web server, its database, the cron host, the listmonk instance, the email sending provider, tracking pixels and any CRM connector. Mark which hops cross a border. Without this map, the transfer review cannot start, and each new integration needs an update before it goes live.

Sending provider terms and sub-processor list

The email sending provider usually receives recipient addresses, message content and bounce data, so it is a processor in its own right. Collect its data processing agreement, its current sub-processor list with locations, and its transfer mechanism for any non-EEA sub-processor. Note the date of each copy, because sub-processor lists change and you need to show which version applied when a message was sent.

Standard contractual clauses and transfer tools

Where a provider transfers data outside the EEA, the transfer tool relied on must be on file. Commission Implementing Decision (EU) 2021/914 sets out the standard contractual clauses, so record which module applies, who signed, and the date. If the provider relies on the Data Privacy Framework instead, record that it is on the DPF list, and track the pending appeal in Case C-703/25 P as a change to monitor.

Backup, restore and deletion records

Backups copy personal data, so they belong in the transfer and retention review. Record where backup copies are stored, who can restore them, how long they are kept, and how a deletion request reaches them. Keep restore test records as well, since they show the backups are usable and that the stack can be rebuilt inside the same jurisdiction if a provider exits.

Access logs and Mautic release status

Retain administrator and API access logs, cron run records and the software version in production. Mautic's release page lists which versions receive security support and when that support ends, so record the version in use and its support end date. Confirm the current support window with the Mautic project before you write the assessment, because the dates change with each release.

Questions buyers ask before self-hosting for EU sovereignty

What drives the cost of self-hosting Mautic for EU data sovereignty?

The cost depends on five components: infrastructure to host Mautic and its database, a transactional or bulk email sending provider you choose, the one-time data migration, ongoing upkeep, and the staff time needed to run cron jobs, upgrades and backups. Hosting and sending costs recur monthly and scale with your contact count and email volume. Migration is mostly one-time, but its size grows with the number of forms, workflows, emails and integrations you rebuild. Mautic itself has no license fee, since the project offers the software as a free download. Ask any provider for a quote that lists each component separately, states who pays for each one, and names what is one-time and what recurs.

How long does a migration from HubSpot to Mautic and listmonk take?

The timeline is set by scope, not by the software. The main drivers are how many contacts and custom properties must move, how many workflows, forms, landing pages and email templates need rebuilding, whether HubSpot CRM stays in place, and how much data-protection review your organization requires before go-live. Each EU hosting decision, sending provider contract and records-of-processing update adds steps that run in sequence. Ask for a written milestone plan with each dependency named, and confirm the schedule against your own change calendar and approval gates before work starts.

What must our internal team provide for a self-hosted Mautic deployment?

You need named data owners who decide which contact fields and consent records move, a DPO or privacy lead who reviews the lawful basis for each list and the transfer map, and system administrators who own the server. Mautic depends on cron jobs for segment updates, campaign updates and campaign triggers, plus a broadcasts command and a messenger consumer when emails are queued. Someone must patch the platform on the project's release cadence, monitor the queue, and restore backups. Confirm these roles in writing before scope is signed, because gaps in ownership are the most common reason self-hosted marketing systems stall after launch.

Can our own team migrate and run Mautic without an implementation partner?

Yes, if you already operate Linux servers, PHP applications and PostgreSQL or MySQL-class databases, and you have capacity to own upgrades and incident response. Mautic's installation paths include the web installer, the command-line installer and Composer. Mautic should not run on shared hosting, so the work starts with a VPS or dedicated server in infrastructure you control. Teams without that experience usually bring in an implementation partner for the architecture, hardening, migration and handover, then keep the operation in-house. Whichever path you choose, document the decision and the skills gap in your risk register.

Do Mautic's Data Act switching rights apply to this kind of move?

The EU Data Act gives customers of data processing services the right to switch to another provider or to on-premises ICT infrastructure, with a maximum two-month notice period and a 30-day transition, and it bans switching charges from 12 January 2027. Mautic is open-source software you download and run yourself, so no Mautic vendor contract is being switched. Whether the Data Act applies depends on whether the service you leave is a data processing service under the regulation, such as your current HubSpot agreement. Ask your legal team to confirm how the switching terms apply to your HubSpot contract and to document the exit steps you take.

Does an EU data center make HubSpot compliant for sovereignty purposes?

An EU data center reduces storage exposure, but it does not settle the transfer question on its own. GDPR Article 44 covers every transfer to a third country, including onward transfers and remote access from outside the EEA. Support staff or group affiliates in other countries can still create transfers, and US providers can be subject to the CLOUD Act regardless of data location. Obtain the provider's current list of sub-processors, its transfer impact documentation and its government access policy, then have counsel assess whether that position meets your requirements.

What should we ask for in a written scope and quote?

Ask for a written scope that lists the systems in scope, the Mautic version and PHP and database requirements, the hosting location and provider, the sending provider and its data processing terms, the migration inventory of contacts, lists, forms, emails and workflows, the cron and queue design, backup and restore tests, and the handover documents. Request deliverables, acceptance criteria, responsibilities for each party, change control and exclusions. The quote should separate one-time work from recurring hosting, sending and support, and state each component's basis. DeployOpen works on fixed-scope engagements, with scope, deliverables and timelines agreed in writing before work starts, and ongoing support available as a retainer.

Keeping a self-hosted Mautic supported

Plan your Mautic upgrade path around the support dates before you go live, because a self-hosted install that falls out of security support becomes your own patching liability. Mautic 7.2 (Absolunto) supports PHP 8.2 to 8.5 and receives active and security support until 30 September 2026. Mautic 7.3 is planned as the long-term support release, with security support through 31 December 2027. For an EU deployment that must hold personal data for several years, the 7.3 line is the more practical baseline, provided the release is published on the schedule Mautic has stated.

The project's stated cadence has three layers: monthly patch releases, minor releases every three months and major releases every two years. Patch releases should be applied quickly, usually in a staging copy first, since they carry security fixes. Minor and major releases change more of the codebase and plugin interfaces, so they need a test pass of your campaigns, segments, custom plugins and the Salesforce or HubSpot integrations if you use them. Ask the implementation partner or your internal team to record which version runs in each environment and who owns each upgrade window.

Confirm the current status of every line before you commit to a date. Support windows are published on the Mautic releases page and can change, so check it at the start of each planning cycle and again before any production change. Keep the PHP and database versions in the requirements page in view as well, because a PHP upgrade needed by a newer Mautic line can trigger work outside the application itself. Record the decision, the check date and the named owner in your change log so auditors and your own data protection team can see how the platform stayed within supported versions.

How DeployOpen deploys Mautic and listmonk under a sovereignty constraint

DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks. For an EU data sovereignty requirement, that means starting from where personal data must reside and which parties can reach it, then building Mautic and listmonk to match that answer.

How we scope

Written scope maps every data flow for contacts, forms, tracking and email to a named EU location.
Scope names the hosting provider, the email sending provider and each party with administrative or support access.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work starts.

How we build

Mautic and listmonk are installed in infrastructure the client controls, with their PostgreSQL or MySQL databases kept in the same region.
Cron jobs, the broadcasts command and the messenger consumer are configured and staggered so campaigns and segments run reliably.
Access controls, backups and hardening follow the scope, and any HubSpot or Salesforce connectors are configured only where the client needs them.

How we hand over

Documentation covers data locations, sub-processors, access roles and the transfer assessment inputs the client's counsel will need.
Runbooks explain upgrade paths for Mautic's monthly patch, quarterly minor and two-yearly major releases.
Compliance readiness evidence is prepared for independent auditors and certification bodies, which issue any formal reports.

How we support

Ongoing support, upgrades and continuous security testing are available as retainers after handover.
Security testing of the Mautic installation, forms and tracking endpoints can be scheduled as part of the retainer.
Ask any implementation partner to confirm in writing which parties can access data after go-live and how support access is logged.