Self-hosted Wrike alternative for EU data residency

Wrike keeps European-registered accounts in a Paris data center, but moving location runs through Wrike. Self-hosting OpenProject in your own or an EU provider's data center puts control of the data, and the transfer and vendor-access questions, back with you.

Book a callTalk to us
On this page

Why a self-hosted Wrike alternative for EU data residency starts with transfers, not features

If your organization is established in the EU and must keep project data in the EU under its own control, the decision turns on GDPR Chapter V transfers and third-country access before it turns on features. Self-hosted OpenProject in an EU data center meets that residency need, because the data never leaves infrastructure you or an EU provider you contract control. Plane and Redmine are the alternatives to shortlist if OpenProject does not fit your workflows, and each should be tested against the same residency questions below.

Wrike has a stated hosting location for accounts registered in Europe, a Paris data center. That is a useful fact, but changing the location of an existing account runs through Wrike, so your residency position depends on a vendor process rather than on your own configuration. Under Article 44 of the GDPR, any transfer of personal data to a third country, including onward transfers, must meet Chapter V conditions. The EDPB's Guidelines 05/2021 also treat remote access from a third country, even just displaying data on a screen for support, as a transfer. Map every support path, subprocessor and administrative access route in your current contract before you compare hosting options.

Start by asking the vendor in writing which entities can access tenant data, from which countries, and under what legal process, then compare the answers with your own record of processing. A self-hosted deployment moves that question into your hands: you decide who holds administrator access, where backups are stored and which support engineers can see data in the clear. Confirm with your data protection officer whether an EU processor subject to third-country law creates exposure under EDPB Recommendations 01/2020, since that assessment is required before you engage such a provider.

What GDPR and the EU data rules require of project tools

Moving project data out of a US-operated cloud is not only a hosting decision. The GDPR transfer rules, the EDPB's view of remote access and the EU Data Act each shape who can reach project records and how you can leave. The cards below set out what to check before you choose where OpenProject runs.

Transfer conditions and onward transfers

Article 44 of the GDPR applies to every transfer of personal data to a third country, and that includes onward transfers made by a provider or its sub-processors. Project tools hold names, assignees, comments and time records, so the question is where each copy and each support session sits. Ask your current vendor for a list of sub-processors and the locations where personal data is processed or accessed. Infringements of Articles 44 to 49 can carry fines of up to EUR 20 million or 4% of worldwide annual turnover under Article 83(5)(c).

Remote access counts as a transfer

EDPB Guidelines 05/2021 treat remote access from a third country as a transfer, even when the person only views data on a screen for support or administration. Storage in a cloud outside the EEA is also a transfer. For a project tool, this means a vendor engineer viewing a Gantt plan from abroad during a ticket can bring the data within Chapter V. Ask for the support access model, including where staff sit and how sessions are logged.

Limits on third-country disclosure orders

Article 48 of the GDPR says a third-country court judgment or administrative decision requiring disclosure of personal data is recognized or enforced only if it rests on an international agreement in force with the Union or a Member State, such as a mutual legal assistance treaty. The US CLOUD Act at 18 U.S.C. 2713 requires providers in scope to preserve or disclose data they control, wherever it is stored. Ask whether your vendor is subject to such orders and how it would respond to one. Hosting in your own data center or an EU provider's facility reduces this exposure, but it does not remove it for providers with US parent companies.

Data Act duty on non-personal data

Article 32 of the EU Data Act requires providers of data processing services to take technical, organisational and legal measures that prevent third-country governmental access to non-personal data held in the Union where that access would conflict with EU or national law. Project plans without personal data, such as budget and schedule summaries, fall under this rule. Ask your vendor for the measures it has in place and the legal basis it relies on, and check them against your own risk assessment.

Switching rights and exit terms

Under the Data Act, applicable since 12 September 2025, customers may switch from a data processing service to another provider or to on-premises infrastructure. The regime sets a maximum two-month notice period and a 30-day transition, drawn from Articles 25 and 29, and bans switching charges from 12 January 2027 under Article 50. Use these dates to test your contract: confirm that you can export all project data, including attachments and configuration, and that notice and transition terms match the statute.

Where the Wrike setup meets these rules and where it leaves questions open

Wrike's Paris data center placement for European-registered accounts answers where data is stored, but it does not settle who can compel access to it. Changing that location means contacting Wrike, so the hosting region is a vendor-controlled setting that your team cannot change directly. Location is only one part of the question. The US CLOUD Act provision at 18 U.S.C. 2713, added on 23 March 2018, requires electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control, whether that data sits inside or outside the United States. A Paris address therefore does not by itself show that a US-linked provider cannot be compelled to produce your data.

The transfer analysis has two further layers. Commission Implementing Decision (EU) 2023/1795 finds adequate protection only for US organizations on the Data Privacy Framework List, so confirm whether the Wrike entity you contract with is on that list. An appeal against the General Court's September 2025 judgment upholding the decision is pending as Case C-703/25 P. EDPB Recommendations 01/2020 add a harder constraint: where a provider needs data in the clear and the destination's public authority powers go beyond what is necessary and proportionate, the EDPB cannot envision an effective technical supplementary measure. Encryption that the provider can reverse for support work may not close that gap.

Before you decide, request the following in writing from Wrike: the current sub-processor list, the countries and entities from which support staff and administrators can access account data, the transfer mechanism and clauses in the contract, and its process for handling government access requests. None of these answers are established in this page, so file each one as a contractual statement and do not rely on a verbal assurance. Then compare the answers with a self-hosted deployment of OpenProject on your own servers or an EU provider's data center, where your team or implementation partner controls administrator access and backup locations. That moves the exposure to your own access controls and to the legal position of any hosting provider you choose, which you should review with the same rigor. Ask your data protection officer and counsel to map these answers to your transfer assessment.

Which open-source platforms fit an EU residency requirement

OpenProject is the option with the most documented self-hosting paths and the closest match to Wrike's Gantt-based planning. It is licensed under GPL-3.0 and developed by OpenProject GmbH, so the Community edition can run in an EU data center you operate without a hosting contract with the vendor. Docker is the recommended installation method, and Kubernetes with Helm charts covers horizontal scaling.

  • Installation paths: Docker (recommended), .deb and .rpm packages for 64-bit Linux, or Kubernetes with Helm charts.
  • Packaged operating systems: Ubuntu 22.04, Debian 12, CentOS or RHEL 9.x and SUSE Linux Enterprise Server 15.
  • Database: PostgreSQL 16 or later, with the pg_trgm, btree_gist and unaccent extensions enabled.
  • Sizing: the vendor's guide suggests 4 cores and 4 GB RAM for up to 200 users, and 8 cores and 8 GB for about 500 users.
  • Paid-only features: SSO (SAML, OIDC, CAS, Kerberos, Okta), LDAP group synchronization and the Jira Migrator sit in Enterprise plans from Basic upward. The Jira Migrator is in beta and supports only Jira Data Center 10.x and 11.x.

Confirm the current Enterprise price per named user per month with the vendor, and confirm where any vendor-hosted Enterprise cloud would store data if you consider it.

How to deploy OpenProject in an EU data center under residency rules

This sequence takes an organization from choosing an EU facility to a tested, documented OpenProject instance in which data, support access and backups stay inside the EEA or behind assessed transfers.

  1. Choose the EU facility and contract

    Decide whether OpenProject will run in your own EU data center or with an EU hosting provider. If you use a provider, confirm in writing that it signs a data processing agreement and the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, and ask where its staff and subcontractors can reach the environment. Done when the signed contract names the facility location and lists every subprocessor with access. Ask the provider which third-country laws could reach its operations, because EDPB Guidelines 05/2021 treat a request from a third-country authority as a transfer that needs assessment.

  2. Map support, backup and admin access paths

    List every route by which a person or system outside the EEA could see personal data: vendor support sessions, remote administration, offsite backup replication, log shipping and monitoring SaaS. EDPB Guidelines 05/2021 state that remote viewing of data from a third country is a transfer, so each route must either stay inside the EEA or be covered by an assessed transfer tool. Done when the register names each route, its location, and the legal basis or technical control that applies.

  3. Select Docker or a packaged installation

    Check the OpenProject system requirements for your target operating system and choose the deployment method. Docker is the recommended route. Packaged .deb or .rpm installs are supported on Ubuntu 22.04, Debian 12, CentOS or RHEL 9.x and SUSE Linux Enterprise Server 15, and Kubernetes with Helm charts is available for horizontal scaling. Done when your operations team has written down the chosen method, the base image or OS version, and the patching responsibility for it.

  4. Provision PostgreSQL 16 with required extensions

    Deploy PostgreSQL 16 or later, which OpenProject has officially supported since version 16.0.0. Enable the pg_trgm, btree_gist and unaccent extensions in the OpenProject database, as the system requirements require. Keep the database on EU-located storage with encryption at rest and restricted network access. Done when the database accepts connections only from the OpenProject hosts and a query confirms each extension is installed.

  5. Size the instance to the user count

    Use the sizing guide in the system requirements as a starting point. It suggests 4 cores and 4 GB RAM for up to 200 users, 8 cores and 8 GB for about 500 users, and 16 cores and 16 GB for about 1,500 users. Ask your infrastructure team to validate these figures against your own load tests, storage and high-availability needs. Done when a sizing note records the chosen tier, the measured response times under expected load, and the planned growth.

  6. Enable SSO and LDAP where your plan requires it

    Single sign-on (SAML, OIDC, CAS, Kerberos, Okta), LDAP group synchronization and custom branding are listed among OpenProject's Enterprise features, so confirm the edition you need before configuring them. Connect the instance to your identity provider, restrict login to approved identities, and confirm that administrator accounts require strong authentication. Done when a test user signs in through SSO, group membership maps to the intended roles, and an unlisted account is refused.

  7. Configure encrypted backups and run restore tests

    Schedule database and file backups to storage in the same EU jurisdiction, encrypt them, and keep copies separate from the production environment. Restore a backup into an isolated environment on a schedule you set, and record the time and result. Done when a restore has been completed, the application opens with the restored data, and the restore evidence is stored with the residency register.

  8. Document remote access rules and evidence

    Write a remote access procedure that states who may connect, from which networks, under which approval, and how sessions are logged, following the transfer analysis in EDPB Guidelines 05/2021. Keep the Records of Processing Activities, the transfer assessment and the subprocessor list current. DeployOpen prepares these systems and documents for your assessors, while independent auditors decide conformity. Done when the procedure is approved by the data protection officer and the access logs can be reviewed against it.

Evidence a DPO or regulator will ask for

A DPO or supervisory authority will expect documents that show where personal data sits, who can reach it, and on what legal basis any transfer rests. The four items below connect the GDPR records, the transfer analysis, the access trail and the supplier contracts into one body of evidence. DeployOpen prepares this material with you, but auditors, certification bodies and your legal counsel reach the conclusions.

Records and transfer assessments

Keep the Article 30 record of processing for the task and project data held in OpenProject, and attach a written transfer assessment for every location or person outside the EEA that can reach it. Under EDPB Guidelines 05/2021, remote viewing of data from a third country for support counts as a transfer, so the assessment must cover support staff as well as storage. Ask counsel to confirm whether any US-linked provider in the chain requires a documented assessment under Chapter V.

Data location map

Draw one map that lists every place project data lives: the primary server, database, attachment storage, backup targets, log stores and any support or monitoring tool. Mark each location with its country and operator, and note who holds administrative credentials. A regulator will test the map against the data flows, so reconcile it with the backup schedule and any disaster recovery copy before you sign it off.

Access logs and remote-access procedures

Document how administrators reach the OpenProject server, which accounts exist, and how each remote session is approved, logged and closed. Keep application audit logs and infrastructure access logs for a period your retention policy sets, and confirm the retention with your DPO. Procedures should state that vendor engineers receive access only through a named, time-limited process, because a screen view from a third country is itself a transfer.

Contracts and processor terms

Collect the data processing agreement with the EU hosting or support provider, the sub-processor list, and the standard contractual clauses for any non-EEA entity in the chain. Check that the processor terms address government access requests, notification duties and deletion at exit. Where a provider is subject to third-country law with extraterritorial effect, the contract should set out how it will challenge disclosure orders, so review those clauses with counsel before signature.

Questions buyers ask before choosing a self-hosted Wrike alternative

How much does a self-hosted Wrike alternative cost to run?

The cost has five parts: software licences, hosting, implementation, data migration and ongoing administration. OpenProject's Community edition is free to download and run, with community support. Its Enterprise on-premises plans are priced per named user per month: Basic at 5.95 euros, Professional at 10.95 euros with a 25-user minimum, Premium at 15.95 euros with a 100-user minimum, and Corporate on request for 250 or more users, according to the OpenProject pricing page. Licences and hosting recur every month or year. Implementation and the rebuild of projects, custom fields and workflows are mostly one-time costs. Ask each provider to price these lines separately in the written scope.

Which OpenProject features require a paid Enterprise plan?

Single sign-on, LDAP group synchronization, custom branding, SCIM provisioning and portfolio and resource management sit in paid Enterprise plans. OpenProject lists single sign-on through SAML, OIDC, CAS, Kerberos and Okta, and LDAP group synchronization among its Enterprise features on its pricing page. The Community edition still includes work packages, Gantt charts, agile boards, time tracking and dashboards. If your Wrike users depend on directory-based login or portfolio views, these are the features that determine which tier you need. Vendors change plan contents over time, so confirm the current feature list in writing before you compare per-user totals.

Can our IT team run OpenProject without outside help?

A team with Linux, container and PostgreSQL experience can run OpenProject alone, but the skills must be present for upgrades and backups, not only the first install. OpenProject recommends Docker-based installation and also provides packages for Ubuntu 22.04, Debian 12, CentOS or RHEL 9.x and SUSE Linux Enterprise Server 15. It officially supports PostgreSQL 16 or later and requires the pg_trgm, btree_gist and unaccent extensions. Releases arrive frequently, with 17.7.0 on August 5, 2026, 17.8.0 on September 2 and 17.9.0 on September 30, so someone must own the upgrade cycle. DeployOpen plans, implements, hardens, backs up and upgrades self-hosted platforms, and ongoing support is available as a retainer.

How long does a Wrike to OpenProject migration take?

The duration depends on what you move, how it is exported and how much must be rebuilt, not on the platform alone. The main drivers are the number of projects and tasks, the volume of attachments and comments, how many custom fields, workflows and approval steps need recreating, the number of integrations, and whether hosting is ready before data arrives. Your Wrike plan determines which export routes you can use, so check that first. DeployOpen works on fixed scope, with deliverables and timelines agreed in writing before work starts. Ask any provider for a timeline tied to a named inventory of projects, users and integrations, and for the testing and cutover steps it includes.

Does Wrike's Paris hosting already satisfy GDPR?

Storage in Paris helps with data location, but it does not settle GDPR compliance on its own. Under the EDPB Guidelines 05/2021, remote access from a third country is a transfer, even when a support engineer only views data on a screen, and so is storage in a cloud outside the EEA. A provider whose parent company is subject to US law can also face the CLOUD Act, which applies to data in a provider's possession, custody or control regardless of where it sits. Ask Wrike which sub-processors touch your data, from which countries staff can access it, and how it handles government access requests. Self-hosting inside your own or an EU provider's data center removes most of this vendor-side access question, although your own support contracts still need review.

What are the GDPR penalties for unlawful transfers to third countries?

Infringements of the transfer rules in Articles 44 to 49 carry fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, under Article 83(5)(c). Article 44 requires every transfer of personal data to a third country, including onward transfers, to meet Chapter V conditions. Article 48 says a third-country court judgment or administrative decision demanding disclosure is recognized or enforced only if it rests on an international agreement, such as a mutual legal assistance treaty. The EDPB Recommendations 01/2020 also state that where a provider must access data in the clear and third-country powers go beyond what is necessary and proportionate, no effective technical supplementary measure is likely to exist. Your legal team should record this assessment before signing with any provider.

What should we ask a provider for in a quote?

Ask for a written scope that lists each deliverable, the timeline, the hosting location and the staff access locations. The quote should also state what is excluded, such as automation rules, third-party integrations or attachments that a Wrike export cannot carry. Request the backup and restore approach, the upgrade process, the support terms and the exit terms. Check the data processing agreement and the sub-processor list, and confirm which parties can view production data. DeployOpen does not publish a price list. A quote follows from the written scope, so the more precisely you describe your projects, users and integrations, the more comparable the quotes will be.

Can we leave a hosting provider later without paying switching fees?

The EU Data Act gives customers of data processing services the right to switch to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition, under Articles 25, 29 and 50 of Regulation (EU) 2023/2854. It applies since 12 September 2025, and switching charges are banned from 12 January 2027. Those rights attach to the service provider, so check whether your hosting contract falls within them and how they apply to a managed OpenProject deployment. Write exit terms into the contract, including data export formats, the timeline for returning data and the handling of backups. Confirm these points with your legal counsel and the provider before you sign.

What changes for the organization after the move

The main change is that your organization takes on the operating cost of the platform, and that cost has one-time and recurring parts. One-time work covers hosting design, installation, data migration and cutover. Recurring work covers the servers or cluster, the PostgreSQL 16 database with the pg_trgm, btree_gist and unaccent extensions, backups, monitoring, and the staff or partner who applies OpenProject releases. The Community edition has no license fee, but Enterprise on-premises is billed per named user per month, with Basic at 5.95 euros and Professional at 10.95 euros, each with a minimum user count (per the OpenProject pricing page). Ask any implementation partner to price upgrades, monitoring and restore testing as separate line items, so you can see which costs recur every year.

Patching, backups and upgrades move from Wrike's operations team to your own team or your chosen provider, so write the split of responsibilities into a RACI before cutover. The release cadence is steady: 17.7.0 shipped on August 5, 2026, 17.8.0 on September 2, 17.9.0 on September 30 and 17.9.2 on October 15, 2026. Plan a recurring window to test each release in staging, read the release notes for database or extension changes, and restore a backup to confirm it works. Set the upgrade policy in writing and record which release was applied and when, because auditors will ask for that evidence. Confirm your own staffing and on-call coverage before you commit to that policy.

The Data Act gives you leverage at renewal. Under Articles 25, 29 and 50 of Regulation (EU) 2023/2854, which applies since 12 September 2025, a customer can switch to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition. Switching charges are banned from 12 January 2027. Put these rights in your renewal request: ask Wrike in writing for its export formats, its transition timeline and the cost of each switching step. Have your legal team confirm how the Act applies to your specific contract, since that is a question for counsel and not something this page can settle.

How DeployOpen deploys OpenProject under EU residency constraints

DeployOpen plans, implements, hardens, backs up, documents and supports self-hosted open-source platforms inside the client's own infrastructure, including their cloud accounts, data centers or air-gapped networks. For an EU residency project, that means the location, administrator access and backup chain are agreed in writing before any installation begins.

How we scope

  • Written scope names the data center or EU cloud account where OpenProject will run.
  • Scope lists which administrators and support staff can reach the servers, and from which countries.
  • Scope records the Enterprise features needed, such as SSO and LDAP synchronization, before licensing is confirmed.

How we build

  • Installation uses the Docker-based method or supported Linux packages, with PostgreSQL 16 or later.
  • Build confirms that the pg_trgm, btree_gist and unaccent extensions are present before go-live.
  • Sizing follows OpenProject's published guidance for the agreed user count, with testing against that load.

How we hand over

  • Handover includes configuration documentation, network and access diagrams, and a record of data locations.
  • Runbooks cover backup, restore testing, upgrades and the process for approving remote access.
  • Records set out which evidence supports a GDPR transfer assessment, to be reviewed by your counsel or auditor.

How we support

  • Ongoing support, upgrades and continuous testing are available as a retainer after handover.
  • Upgrades are planned against OpenProject's published release notes and tested before production.
  • Security testing of the deployment can be scheduled as part of the retainer or as a separate fixed-scope engagement.

Related

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.
Book a callhello@deployopen.com