Why a self-hosted Smartsheet alternative for EU data residency starts with the data split
The residency question for Smartsheet starts with a split: customer content is hosted in Germany under smartsheet.eu, while usage data and account information go to its US operations. For a regulated EU organization whose transfer review has flagged the tool, the main option to evaluate is self-hosting OpenProject in your own data center or in one run by an EU provider. Whether that move is needed depends on your own transfer assessment, which should map each category of data to its storage location, its processor and every party that can reach it from outside the EEA.
Under Article 44 of the GDPR, every transfer of personal data to a third country, including onward transfers, must meet the conditions in Chapter V. The EDPB's Guidelines 05/2021 treat remote access from a third country as a transfer, even when data is only displayed on a screen for support, so US-side support or administration access must be counted, not just storage. The EU-US Data Privacy Framework adequacy decision covers only US organizations on the Data Privacy Framework List, and an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. The US CLOUD Act also reaches providers' data regardless of where it is stored, so EU hosting alone does not settle the question for a US-parented provider.
Ask Smartsheet for its current data processing terms, the list of subprocessors, the entities that can access customer content for support, and whether each of them holds Data Privacy Framework certification. Then run the same exercise for a self-hosted OpenProject deployment, including who holds administrator and database access and from which countries. The Community edition is free and licensed under GPL-3.0, but SSO and LDAP group synchronization are Enterprise features, so access control costs need to be part of the comparison. Check the current tiers on the OpenProject pricing page before you put them in a business case.
What GDPR Chapter V and related rules require of a project tool
A task tracker holds names, assignments, comments and client details, so every copy of that data and every person who can view it from outside the EEA counts for transfer purposes. The cards below set out the rules that decide where the data may sit, who may see it and which legal orders can reach it.
Transfers to third countries
Article 44 requires every transfer of personal data to a third country, including onward transfers, to meet the conditions in Chapter V. For a project tool, this covers the vendor's main database, its backups, its logs and any support copies that leave the EEA. Map each location where task records, comments and attachments are stored or processed, and ask the vendor for the list of countries and sub-processors involved. Infringements of Articles 44 to 49 carry fines of up to EUR 20 million or 4% of worldwide annual turnover under Article 83(5)(c).
Remote access counts as a transfer
EDPB Guidelines 05/2021 state that remote access from a third country is a transfer, even when the person only views data on a screen for support or administration. This matters for vendor support engineers, follow-the-sun operations and administrators who log in from abroad. In a self-hosted deployment, ask who holds administrator and database access, from which countries, and whether those sessions are logged and reviewed.
Schrems II and the Data Privacy Framework
On 16 July 2020, the Court of Justice invalidated the Privacy Shield in Case C-311/18 while holding that standard contractual clauses remained valid. Commission Implementing Decision (EU) 2023/1795 covers only US organizations on the Data Privacy Framework List, and an appeal in Case C-703/25 P is pending. If a US vendor relies on the framework, confirm the exact legal entity is listed and keep a fallback transfer mechanism in the contract. Note that the framework is less certain than a plan built only on EU hosting.
CLOUD Act reach over US providers
18 U.S.C. 2713, added on 23 March 2018, requires electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control, whether that data sits inside or outside the United States. An EU data center run by a US company can therefore still be reached. EDPB Recommendations 01/2020 say that where access goes beyond what is necessary and proportionate, no effective technical measure is foreseen. Ask vendors how they handle government requests and whether they commit to challenging them.
Self-hosting and control of access
Running OpenProject in your own data center or an EU provider's facility means the data is stored where you choose, and no vendor operator sits in the access path by default. This shifts the question to your own administration: who holds server and database credentials, where backups are kept, and whether any operations contractor is established outside the EEA. Document these answers, because they determine whether the transfer analysis is short or lengthy.
Data Act switching rights
Regulation (EU) 2023/2854 applies from 12 September 2025 and gives customers of data processing services the right to switch to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition. Article 32 also requires providers to prevent third-country governmental access to non-personal data held in the Union where that conflicts with Union or national law. Use these rights in contract talks, and confirm with the vendor how exit assistance and data return are handled.
Where Smartsheet's EU hosting meets the constraint and where it leaves questions
The documented split is the starting point. Smartsheet hosts EU customer content in Germany under smartsheet.eu, while usage data and account information go to its US operations. Residency for content and residency for account and usage data are therefore separate questions, and a yes on one does not answer the other. Before you rely on the EU hosting statement, ask Smartsheet to confirm in its contract and data processing terms which contracting entity and sub-processors handle each category of data, and whether any US-based staff can view customer content for support or administration. Under EDPB guidance, remote access from a third country counts as a transfer even when data is only displayed on a screen, so support access is part of the assessment.
The transfer basis for the US operations needs its own check. The adequacy finding in Commission Implementing Decision (EU) 2023/1795 covers only US organizations on the Data Privacy Framework List, so confirm that the Smartsheet entity processing your data appears on that list. Track the appeal pending as Case C-703/25 P against the General Court's September 2025 judgment that upheld the decision, because an outcome could change the position. If the entity is not listed, ask which standard contractual clauses under Decision (EU) 2021/914 apply, and which transfer impact assessment supports them. Under GDPR Article 44, every transfer to a third country must meet Chapter V conditions, so get these answers in writing rather than inferring them from marketing pages.
Third-country authority requests are the hardest part to resolve by contract alone. The US CLOUD Act provision at 18 U.S.C. 2713 applies to data in a provider's possession, custody or control wherever it is stored, and the EDPB's Recommendations 01/2020 state that where access goes beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned. Ask Smartsheet for its government access request policy, its transparency reporting and its commitments to challenge overbroad requests. Self-hosting removes the vendor's position from the picture for the data you run, but the jurisdiction of your own cloud or hosting provider still matters, so apply the same questions to any provider you choose.
Choosing where OpenProject runs: your data center, an EU provider or a managed cloud
Running OpenProject in your own data center keeps the largest share of control with your organization. Your staff hold administrative access to the operating system, the database and the application, and they control who can enter the building and the racks. Because the processing sits on your premises, no processor outside your organization needs access to the content, so the processor analysis in the other tabs does not arise. The trade-off is that your team carries patching, backups, capacity planning and on-call duty. OpenProject's Community edition is free, and its Enterprise on-premises plans add SSO and LDAP group synchronization for a per-user monthly fee.
- Administrative access: Your administrators alone hold root, database and application admin rights, unless you grant a vendor or partner temporary access under a written procedure.
- Physical access: Your facility controls govern who can reach the servers, storage and backup media.
- Support access: Any remote session a vendor opens should be logged, time-limited and approved, because remote viewing from a third country can itself count as a transfer.
- Operating burden: Your team owns upgrades, such as the 17.9.2 release, and restore testing.
- Sizing: OpenProject's sizing guide lists 4 cores and 4 GB RAM for up to 200 users, scaling upward from there.
Before choosing this model, confirm in writing that your facility, backup sites and any disaster recovery location are all inside the EEA or in locations you have assessed.
An EU-based hosting provider can run the infrastructure while your organization keeps administrative control of the platform. The key question is whether the provider or its parent company is subject to third-country law with extraterritorial reach. The EDPB's Guidelines 05/2021 address this in Example 12: using an EU processor that is subject to third-country law with extraterritorial effect is not in itself a transfer. However, if that third-country law obliges the processor to comply with an authority's request for data, that compliance would be a transfer, so the controller should assess this exposure before engaging the processor. Under the US CLOUD Act provision at 18 U.S.C. 2713, a US-parented provider can be required to preserve or disclose data in its possession, custody or control regardless of location.
- Administrative access: Confirm which of your staff, and which provider staff, hold root and hypervisor rights, and who can open a support session.
- Physical access: Ask where the data centers, backup copies and replicas are located and whose staff can enter them.
- Legal exposure: Ask for the provider's written position on how it handles third-country government requests, including its challenge procedure and whether it can notify you.
- Corporate ownership: Identify the ultimate parent and any foreign shareholders or contractual obligations that could compel access.
- Exit terms: Under the EU Data Act, customers of data processing services have a right to switch providers or move to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition.
Ask the provider to put these answers in the contract and the data processing agreement before you sign.
OpenProject Enterprise cloud is hosted by the vendor, so the administrative and physical controls sit with OpenProject and its hosting arrangements rather than with your team. This model removes most server work, but it also changes the transfer analysis. Your organization is then relying on a processor's infrastructure, support staff and sub-processors, and the EDPB treats storage in a cloud outside the EEA, and remote access from a third country, as transfers. The vendor's hosting region, its sub-processors and the location of any support personnel with access to your tenant are therefore the first items to pin down. OpenProject is developed by OpenProject GmbH, which is a useful starting point for the contract discussion but does not answer the location questions on its own.
- Administrative access: Vendor operations staff manage the platform, while your administrators control accounts, roles and SSO configuration.
- Physical access: Request the names of data centers, their country locations and whether backups are replicated outside the EEA.
- Sub-processors: Ask for the full list, including any support tooling that may display your content from a third country.
- Government access: Ask for the vendor's written policy on third-country authority requests and how it would notify you.
- Lock-in: Confirm the export formats and the notice period if you later move to on-premises infrastructure.
Enterprise cloud should be checked against the same written questions as an EU provider, because a hosting location in the EU does not settle who can reach the data.
Whichever model you choose, the decision should rest on written answers rather than on marketing claims about location. Start by mapping every place personal data could be stored, processed or displayed, including backups, logs, monitoring and support tooling. Then collect the answers below from each candidate, and keep them with your transfer impact assessment. This also helps your DPO and any auditor you engage, since DeployOpen prepares the systems and evidence for an assessment but does not issue audit reports or certifications.
- Access list: Named roles with administrative and support access, and the country each person works from.
- Hosting map: Facilities, backup sites and disaster recovery sites, with country locations.
- Legal position: The provider's documented response to third-country authority requests, and the basis it would rely on under GDPR Article 48.
- Transfer tools: Whether the contract uses the standard contractual clauses in Commission Implementing Decision (EU) 2021/914, and which supplementary measures apply.
- Scope of the Data Privacy Framework: If a US organization is involved, check whether it is on the Data Privacy Framework List, noting that the General Court's September 2025 judgment upholding the framework is under appeal in Case C-703/25 P.
Ask for these items in a quote or a due diligence questionnaire, and do not sign until your legal and security teams have reviewed them.
Comparing OpenProject, Plane and Redmine against the residency constraint
This table compares OpenProject Community, OpenProject Enterprise on-premises, Plane Community Edition and Redmine on the factors that matter when EU content must stay under your control. Read each row as a question to answer in your own environment, because hosting location, identity requirements and export paths decide the fit more than feature lists do. The main takeaway is that residency is set by where you host, not by which tool you pick, and the Smartsheet export gaps apply to every target.
| Factor | OpenProject (Community and Enterprise on-premises) | Plane Community Edition | Redmine |
|---|---|---|---|
| Licence | GPL-3.0, developed by OpenProject GmbH | AGPL-3.0 | GPL v2 |
| Residency fit when self-hosted | Runs in your or an EU provider's data center; you control storage and access | Runs in your or an EU provider's data center; confirm the self-hosted deployment matches your residency design | Runs in your or an EU provider's data center on Ruby on Rails; you control storage and access |
| SSO | Enterprise plans only (SAML, OIDC, CAS, Kerberos, Okta) | Confirm SSO options for your edition before planning | Confirm SSO options with your chosen plugins or front-end proxy |
| LDAP | LDAP synchronization sits in Enterprise plans; Redmine offers LDAP authentication in the core product | Confirm LDAP support for your edition | Not applicable |
| Smartsheet import path | Migration from Smartsheet exports is manual or scripted; Jira Migrator does not apply to Smartsheet | Importers cover Jira, Linear, Asana, ClickUp, Notion, Confluence, Flatfile and CSV, with no Smartsheet importer | No Smartsheet importer; CSV-based import is the practical route to confirm |
| Gantt and portfolio depth | Gantt charts and work packages in Community; portfolio and resource management in Enterprise | Confirm Gantt and portfolio depth against your current Smartsheet plans | Gantt charts and issue tracking; portfolio views depend on plugins to confirm |
How to deploy OpenProject in an EU data center under this constraint
This sequence turns an EU residency requirement into a documented, operated OpenProject instance where content, logs, administrators and backups stay under the controls the organization set. Each step ends with a check that the previous decision holds.
Confirm the residency scope in writing
The data protection owner, with legal and the business sponsor, writes down which data must stay in the EU: project content, attachments, user accounts, audit logs, backups and support access. Record which parties may touch the system, including vendors and implementation partners, and whether any remote access from outside the EEA is allowed. Ask counsel to confirm how the EDPB Guidelines 05/2021 treat remote viewing from a third country for your operating model. The step is done when a signed scope document exists and every later decision can be traced back to it.
Choose the data center location and operator
Select a facility and operator in the EU or EEA that you can contract with directly, then ask the operator to confirm in writing where storage, backups and snapshots are physically held and which legal entity controls the infrastructure. Check whether the operator or its parent is subject to non-EU law with extraterritorial reach, and document that assessment before signing, since the EDPB treats compliance with a third-country authority request as a transfer. Ask for the sub-processor list and the location of any management plane. The step is done when the operator's answers are in the file and counsel has accepted the exposure assessment.
Install OpenProject with Docker or a packaged install
The platform team installs OpenProject on 64-bit Linux, using the Docker-based installation that OpenProject recommends, or the .deb or .rpm packages on a supported distribution such as Ubuntu 22.04, Debian 12, RHEL 9.x or SUSE Linux Enterprise Server 15. Pin the image or package version and record it in the configuration repository. Keep the environment definition in infrastructure as code so the build can be reproduced inside the EU boundary. The step is done when a test instance starts, serves the login page and reports the pinned version in its administration area.
Provision PostgreSQL 16 with required extensions
The database administrator provisions PostgreSQL 16 or later, which OpenProject officially supports since version 16.0.0, and enables the pg_trgm, btree_gist and unaccent extensions that the system requirements list. Place the database on storage inside the same EU facility, restrict network access to the application tier, and enable encrypted connections. Confirm the extensions are present by querying the installed extension list before the application connects. The step is done when the application connects without errors and the extension check passes.
Size the server against the user count
The platform team uses OpenProject's sizing guide to match hardware to the expected number of named users. The guide suggests 4 cores and 4 GB RAM for up to 200 users, 8 cores and 8 GB for about 500 users, and 16 cores and 16 GB for about 1,500 users, and Kubernetes with Helm charts is available for horizontal scaling. Load test with realistic project data before go-live and confirm that the chosen tier also covers the Enterprise plan's per-user licensing if you need it. The step is done when a load test on the sized environment meets the response targets the business agreed.
Configure SSO and LDAP under Enterprise
The identity team connects OpenProject to the EU-hosted identity provider. Single sign-on (SAML, OIDC, CAS, Kerberos or Okta) and LDAP group synchronization are Enterprise features, so confirm the plan covers them before configuring. Map directory groups to OpenProject roles, disable local accounts that are not needed, and keep the identity source inside the residency boundary. The step is done when a test user signs in through the identity provider, receives the expected role, and a removed directory account loses access.
Restrict administrative and remote access to EU personnel
The security lead defines which administrator and support accounts can reach the production system, limits them to staff who are located in the EEA or who have been approved under the residency scope, and routes access through a logged bastion or VPN in the EU facility. Require multi-factor authentication for administrators and remove vendor access that is not covered by a signed processing agreement. Review the logs for remote sessions from outside the approved locations. The step is done when the access list matches the scope document and a test attempt from an unapproved location is blocked and logged.
Set backups and upgrades against OpenProject releases
The operations team writes a backup procedure that stores encrypted database dumps and attachment copies in an EU location, separate from the production host, and tests a full restore on a clean server. Set a routine to track OpenProject releases, such as the 17.9.2 release published on October 15, 2026, review the release notes for breaking changes, and apply upgrades first to a staging copy inside the same EU environment. Keep a record of each version change for the compliance file. The step is done when a restore test succeeds and one upgrade has been rehearsed from staging to production.
Evidence to collect for a residency or transfer review
A residency review rarely turns on the platform alone. It turns on a file of records that shows where personal data sits, who can reach it, and what happens if you leave. The cards below list the evidence a DPO, auditor or regulator is likely to request, and what to check in each item before the review starts.
Records of processing and data maps
Your Article 30 records should name every place Smartsheet content, usage data and account data flow today, including the US operations that receive usage and account information. For the OpenProject target, record the hosting location, the data categories and the people with administrative access. Ask whether each record matches a current data map, not last year's plan.
Transfer impact assessments
Where any personal data still reaches a third country, the file needs a documented transfer assessment. EDPB Guidelines 05/2021 treat remote access from outside the EEA, even only viewing data on a screen for support, as a transfer. Confirm whether vendor support staff or sub-processors in the US can view tenant content, and record the answer with its source.
Vendor contracts and sub-processor terms
Collect the current data processing agreement, the list of sub-processors with their locations, and the standard contractual clauses or other transfer tool that applies. Check whether the list names the US operations that handle usage and account data. Ask the vendor in writing to confirm how each term applies to your tenant, since these documents change.
Government access exposure
A reviewer will ask whether a foreign authority could compel access to the data. The US CLOUD Act reaches providers regardless of where data is stored, so a EU data center does not settle the question for a US-controlled provider. Document which provider and jurisdiction controls the keys and the hosting, and what the contract says about responding to authority requests.
OpenProject configuration and SSO settings
Export the configuration that determines who can sign in and what they can see: the authentication method, the SSO provider, group synchronization, role assignments and admin accounts. SSO, LDAP group synchronization and custom branding sit in Enterprise plans, so confirm which plan your deployment uses. Keep dated screenshots or config exports as proof of the state at review time.
Backup locations and switching rights
Document where OpenProject backups and the PostgreSQL database are stored, how they are encrypted, and who can restore them. Under the EU Data Act, Articles 25 and 29 give customers the right to switch to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition. Record your exit plan and the notice steps against those articles.
Questions buyers ask before choosing a self-hosted residency option
What does running OpenProject for EU data residency cost?
The software license cost depends on whether you stay on the free Community edition or buy Enterprise on-premises. Community is free and includes work packages, Gantt charts, agile boards, time tracking and dashboards, with community support. Enterprise on-premises is priced per named user per month: Basic at 5.95 euros and Professional at 10.95 euros with a 25-user minimum, Premium at 15.95 euros with a 100-user minimum, and Corporate on request for 250 or more users, according to OpenProject's pricing page. SSO, LDAP group synchronization and the Jira Migrator sit in Enterprise plans, so those features drive the license decision. Hosting, staffing and migration are separate costs you pay for in addition to the license. Ask any quote to separate one-time setup from recurring license, hosting and support.
Which costs recur after a self-hosted OpenProject go-live?
Recurring costs are the infrastructure, the people who operate it and any Enterprise subscription. Infrastructure scales with user count: OpenProject's sizing guide suggests 4 cores and 4 GB RAM for up to 200 users, 8 cores and 8 GB for about 500 users, and 16 cores and 16 GB for about 1,500 users. Operations include patching the operating system, PostgreSQL 16 or later with the pg_trgm, btree_gist and unaccent extensions, backups, upgrades and monitoring. Upgrades follow releases such as 17.9.0 on September 30, 2026 and 17.9.2 on October 15, 2026. Ask for a quote that lists who patches, who restores backups and what support level is included.
How much effort does migrating from Smartsheet backups take?
Effort depends on how much of your Smartsheet logic you need to keep. Smartsheet's backup on Business and Enterprise plans is a zip of Excel files with comments and attachments, but it excludes reports, dashboards, formulas, workflows, cross-sheet references and formatting. Rows, dates and dependencies can be mapped into OpenProject work packages and Gantt charts, while the excluded items must be rebuilt by hand, which is usually the largest share of the work. A sheet with heavy formulas and several dashboards takes far longer than a simple task list. Ask the supplier to inventory your sheets, reports and automations before quoting.
Can our team set up self-hosted OpenProject without outside help?
A capable platform team can install OpenProject alone if it has Linux administration, container or Kubernetes experience, and PostgreSQL skills. Docker-based installation is recommended, and .deb and .rpm packages are available for 64-bit Linux, including Ubuntu 22.04, Debian 12, RHEL 9.x and SUSE Linux Enterprise Server 15. The harder parts are identity integration, data residency controls, backup testing and the migration of Smartsheet logic. Ask yourself whether those tasks fit your current staffing before deciding.
When should we bring in an implementation partner?
Bring in a partner when the migration scope, compliance evidence or integration work exceeds what your team can absorb alongside daily operations. DeployOpen plans, implements, integrates, hardens, backs up and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, typically under a fixed scope agreed in writing before work starts. DeployOpen prepares systems and evidence for compliance assessments but does not issue audit reports or certifications. Ongoing upgrades and support are available as retainers. Request a written scope, deliverables, a timeline and the exclusions in any quote.
Does self-hosting OpenProject remove all cross-border transfer risk?
Self-hosting in an EU data center removes the transfer created by Smartsheet's US operations, but it does not settle every question on its own. EDPB Guidelines 05/2021 treat remote access from a third country, even just displaying data for support, as a transfer, so vendor and support access must be controlled too. Confirm where backups, logs, support tooling and any EU provider's own staff access data. Your legal or privacy team should review those paths with your GDPR counsel rather than rely on a hosting label.
Which OpenProject features need an Enterprise plan for a residency setup?
Single sign-on with SAML, OIDC, CAS, Kerberos or Okta, LDAP group synchronization and custom branding are listed as Enterprise features. SSO and LDAP matter most for residency because they keep identity under your control rather than in a US-operated account system. Portfolio and resource management also sit in paid plans. The Jira Migrator is listed from Basic upward, but it is in beta and supports only Jira Data Center 10.x and 11.x, not Jira Cloud. Confirm the plan that covers each feature you need before you commit to a per-user count.
What should we request in a quote for a self-hosted residency setup?
Ask for a written scope listing the OpenProject edition, the named user count and the Enterprise features required. The quote should separate one-time work (installation, identity integration, migration, backup testing and documentation) from recurring work (hosting, patching, upgrades and support). Request the sizing assumptions for your user count, the list of Smartsheet items that will be rebuilt rather than migrated, the deliverables, the timeline, and the acceptance criteria. Also ask who is responsible for data location, sub-processors and support access. Compare quotes by these line items, not by a headline total.
What moving data out of Smartsheet involves and what the Data Act gives you
Plan the rebuild before you plan the export. A Smartsheet backup on Business and Enterprise plans gives you a zip of Excel files that includes comments and attachments, which covers the row data but not the working parts of the account. Reports, dashboards, formulas, workflows, cross-sheet references and formatting are excluded, so each of these must be inventoried and recreated in OpenProject as work packages, queries, Gantt views or automations. Build that inventory from the Smartsheet side before you agree a cutover date, listing every sheet's reports, dashboards and automated workflows. The full list of exclusions is in Smartsheet's backup file contents article.
The EU Data Act gives you a statutory route out of a data processing service, with fixed timing. Under the regulation, which has applied since 12 September 2025, customers can switch to another provider or to on-premises ICT infrastructure, which is the option this page covers. The maximum notice period is two months, followed by a 30-day transition, and Articles 25, 29 and 50 set out the switching obligations. From 12 January 2027, switching charges are banned, so any exit fee a provider attaches to a move after that date falls outside the rules. Before that date, ask Smartsheet in writing whether it will charge for a switch and how it counts the notice and transition periods.
Confirm three things before you give notice. First, check your agreement and plan terms, and identify the account owner who will send the notice, because the statutory timing only helps if the notice is clear and dated. Second, test how long a full export takes on your real data volume by loading it into a staging OpenProject instance, rather than relying on the 30-day transition period alone. Third, decide who rebuilds the excluded items and how that work is paid for. DeployOpen can scope the export, rebuild and cutover in writing from the list of sheets and reports you provide. Keep a dated copy of every backup and all notice correspondence for your records.
Where to verify the residency and transfer position
This sequence gives your legal, privacy and security owners a short path from the claims on this page to the primary texts and decisions behind them, so the residency and transfer conclusions are confirmed before any data moves. The output is a dated record of what was checked, by whom, and what remains open.
Map each data category to its current location
Ask Smartsheet in writing where each category sits today: sheet content, attachments, usage data, account information, support access and backups. Your privacy lead should also list which of your own data categories are personal data and which are non-personal. The check is complete when every category has a named location, a named operator and a matching entry in your records of processing.
Read the GDPR transfer rules in the official text
Your privacy counsel should read Regulation (EU) 2016/679 on EUR-Lex, focusing on Chapter V, including Article 44 on onward transfers and Article 48 on third-country orders for disclosure, and the fine levels in Article 83. Record the article numbers that apply to your data flows. The check is complete when counsel has a short memo tying each data category from the previous step to a specific transfer or no-transfer finding.
Review the EDPB transfer guidelines and recommendations
Read EDPB Guidelines 05/2021 on the interplay between Article 3 and Chapter V, which address remote access from third countries and cloud storage outside the EEA, and EDPB Recommendations 01/2020 on supplementary measures. Confirm you are reading version 2.0 of each document on the EDPB site. The check is complete when your memo states whether support access, administrative access or storage outside the EEA counts as a transfer in your setup.
Check the Schrems II judgment and its status
Read the CJEU press release on Case C-311/18, which invalidated the Privacy Shield while keeping standard contractual clauses valid. Counsel should confirm which transfer tools your contracts rely on today. The check is complete when your transfer register names the tool for each transfer and notes the judgment that governs it.
Confirm the Data Privacy Framework position
Open Commission Implementing Decision (EU) 2023/1795 on EUR-Lex and check the Data Privacy Framework List for the specific US entity involved, since the adequacy finding covers only listed organizations. Then check the status of the appeal in Case C-703/25 P, recorded in Official Journal C/2025/6610. The check is complete when counsel records the listing status and the appeal status with the date of review.
Verify the Data Act switching and access provisions
Read Regulation (EU) 2023/2854 on EUR-Lex, focusing on Article 32 on third-country governmental access to non-personal data and on Articles 25, 29 and 50 on switching rights. Ask counsel to confirm how these provisions apply to your contract and service type. The check is complete when you have a written note on your switching rights and on the provider's access safeguards for non-personal data.
Record the open questions for legal counsel
Collect the points the sources leave open for your situation, such as the effect of US law on provider-held data and the status of pending appeals, and send them to your legal counsel with the memos from earlier steps. Counsel should confirm current status on the day of decision, since these positions change. The check is complete when counsel has signed off on a single dated residency and transfer record, which your team keeps with the migration plan.
How DeployOpen deploys OpenProject under EU residency constraints
DeployOpen plans, implements, hardens, backs up, documents and supports self-hosted open-source platforms inside the client's own infrastructure, including EU data centers and EU-based cloud accounts. For an OpenProject deployment, the work starts with where each data flow actually goes, then builds the platform to match that map.
How we scope
- Written scope lists the data flows, hosting locations and administrator access paths for the OpenProject deployment.
- We map which Smartsheet data sets are migrated, which are rebuilt by hand, and which stay outside the new system.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work starts.
- Quotes follow from the written scope, so the reader can ask for each component and its recurring costs to be itemized.
How we build
- We install OpenProject in your own or an EU provider's environment, using the Docker-based method or packaged installs your team prefers.
- We configure PostgreSQL 16 or later with the required extensions, and size the hosts against your expected user count.
- We set up identity integration, access controls and logging, and confirm which edition covers the features you need.
- We test restores, data import from Smartsheet exports, and access from every location where your staff work.
How we hand over
- Documentation covers the architecture, the data locations, the sub-processors and the administrator procedures.
- We prepare evidence of configuration and controls that your assessors or auditors can review. DeployOpen does not issue audit reports or certifications.
- Your team receives runbooks for upgrades, backups and incident handling, and a record of decisions taken during the build.
- Handover includes a review of the exit path, so the data can be exported again if your residency requirements change.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers can cover patching, release upgrades, backup verification and periodic review of hosting and transfer conditions.
- Changes to the scope, such as adding a new integration or moving hosting location, are agreed in writing before work begins.
- Ask any provider, DeployOpen included, to confirm in writing where support staff access data from and under which terms.
