Why EU data residency pushes Webex customers toward self-hosted meetings
An EU organization that needs meeting data under its own control should compare Webex with self-hosted Jitsi Meet, BigBlueButton or Matrix with Element Call running in its own European infrastructure. Webex residency settings decide where some data is stored: meeting data follows the site timezone, and messaging data is placed by the country chosen at provisioning. Those settings answer a storage question. They do not answer the question GDPR Chapter V asks, which is whether personal data reaches a third country or can be reached from one. Under GDPR Article 44, every transfer must meet Chapter V conditions, and the EDPB treats remote access from a third country, even only displaying data on a screen for support, as a transfer. A residency setting cannot settle that alone.
Residency settings also leave the provider's legal exposure open. The US CLOUD Act provision at 18 U.S.C. 2713 requires covered providers to preserve or disclose data in their possession, custody or control, wherever it is located. The EU-US Data Privacy Framework adequacy decision, Commission Implementing Decision (EU) 2023/1795, covers only US organizations on the Data Privacy Framework List, and an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. The EDPB Recommendations 01/2020 state that where a provider needs data in the clear and third-country powers exceed what is necessary and proportionate, no effective technical supplementary measure can be envisioned. Ask your data protection officer to document which operators, support staff and subprocessors could reach meeting and chat data from outside the EEA before any move.
Choosing among the three depends on how people meet. Jitsi Meet suits ad hoc meetings: a self-hosted deployment runs the web front end, Prosody, Jicofo and Jitsi Videobridge inside your network, and access can be controlled with JWT token authentication. BigBlueButton fits structured teaching and webinars where presentation, polling and breakout rooms matter, and it needs substantial capacity, with at least 16 GB of memory, 8 CPU cores and 500 GB of disk for recordings according to its install documentation. Matrix with Element Call fits organizations that want chat and calls on one platform. Self-hosting removes Webex from the data path, but the data center or cloud provider you choose still needs its own transfer and access review, so confirm its terms in writing.
What the GDPR and EDPB guidance require from meeting platforms
Meeting data is personal data whenever participants, recordings or chat identify people, so the transfer rules in Chapter V apply to it. The cards below set out the points that decide whether a hosted meeting platform can keep data inside the EEA and what a self-hosted deployment changes.
Remote access counts as a transfer
EDPB Guidelines 05/2021 treat remote access from a third country as a transfer, even when the data is only displayed on a screen for support or administration. Storage in a cloud outside the EEA is also a transfer. For a Webex deployment, check where support engineers can view meeting content, where recordings and chat are stored, and whether any administrative console shows participant data to staff outside the EEA. Ask the vendor for each of these locations in writing.
Fines for Chapter V breaches
Infringements of Articles 44 to 49 carry fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher under Article 83(5)(c). Any transfer that lacks a valid mechanism falls under this tier, so a meeting platform that moves data outside the EEA without one exposes the controller to the top penalty band. Confirm with your data protection officer which transfers your current contract already covers.
Third-country authority requests
EDPB Guidelines 05/2021 (Example 12) say that using an EU processor subject to third-country law with extraterritorial effect is not in itself a transfer. Complying with a request from a third-country authority would be one, so controllers should assess that exposure before engaging the processor. EDPB Recommendations 01/2020 add that where a provider needs data in the clear and foreign public authority powers exceed what is necessary and proportionate, no effective technical supplementary measure can be envisioned. Document this assessment for each meeting provider.
CLOUD Act reach beyond location
The US CLOUD Act provision at 18 U.S.C. 2713, added on 23 March 2018, requires electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control. This applies whether the data sits inside or outside the United States. Holding meeting recordings or chat in an EU region therefore does not by itself remove the provider's obligation, so ask whether the vendor's control of the data extends to its own staff and systems.
Article 48 limits on foreign orders
GDPR Article 48 allows a third-country court judgment or administrative decision requiring disclosure of personal data to be recognized or enforced only when it rests on an international agreement in force with the Union or a Member State, such as a mutual legal assistance treaty. A foreign order that lacks such a basis does not become enforceable in the EU through that route. This limits what a foreign order can compel in practice, but it does not remove the transfer question, so keep it as one input to the assessment rather than a full answer.
Data Act switching rights
The Data Act has applied since 12 September 2025 and gives customers the right to switch from a data processing service to another provider or to on-premises ICT infrastructure, with a maximum two-month notice period and a 30-day transition. Switching charges are banned from 12 January 2027 under Articles 25, 29 and 50. Use these rights in the contract discussion with Webex, and check which export formats and timelines the provider commits to in writing.
Where Webex meets the residency constraint and where it leaves gaps
Webex residency controls answer a narrow question: where the vendor stores certain data at rest. Under the settings described for this topic, meeting data follows the timezone of the site, and messaging data is placed by the country chosen when the organization is provisioned. For an EU controller, this is a useful starting point, but it describes storage placement only. It does not by itself settle who can reach that data or from where.
- Meeting data follows site timezone. Confirm which site timezone your meeting data is tied to, because a site configured for one region may host meetings held by people in other regions.
- Messaging placed by provisioning country. Messaging placement is fixed when the organization is provisioned, so a country chosen years ago still governs stored messages. Ask whether that choice can change and what migration it would require.
- Stored location is not processing location. A storage location does not list every place where support, logs or analytics are processed. Ask Cisco for processing locations by data class.
- Recordings and transcripts. Confirm where recordings, transcripts and chat attachments are stored, since they may follow different rules from live meeting media.
Check these points against your contract and the residency documentation Cisco provides, because the settings and the data classes they cover are defined by the vendor.
Webex Video Mesh keeps media on premises, but it is software installed on an on-premises Cisco UCS server, registered to the Webex cloud and managed in Control Hub. Meetings stay local while on-premises capacity is available and overflow to the cloud when it runs out. The residency question therefore covers the control plane and the overflow path, not only the server in your data center.
- Registration to the cloud. The node must stay registered to the Webex cloud, so the service depends on that connection being available and permitted.
- Administration in Control Hub. Configuration, policy and administrator actions run in Control Hub, so administrative metadata is held in the vendor's environment. Confirm what that metadata contains.
- Overflow to the cloud. When local capacity runs out, meetings move to the cloud. Ask which regions handle overflow traffic for your tenant.
- Local hardware, vendor-operated service. Your servers sit in your facility, but Cisco operates the service they connect to. Confirm who holds logs and diagnostics generated by the node.
Ask Cisco to map each Control Hub and Video Mesh data flow to its processing location and to confirm the overflow path in writing.
Under GDPR Article 44, every transfer of personal data to a third country must meet Chapter V conditions. The EDPB's Guidelines 05/2021 state that remote access from a third country counts as a transfer, even when the data is only displayed on a screen for support or administration. A residency setting that keeps stored data in the EU does not prevent an engineer in another country from viewing it, so this is a separate question.
- Vendor support access. Ask Cisco where the support engineers and administrators who can view tenant data are located, and whether that access is logged.
- Follow-the-sun operations. Support models that pass work across time zones can move access into third countries. Ask for the rota model in writing.
- Partner and subprocessor access. Resellers, integrators and subprocessors may also reach tenant data. Request the subprocessor list and the locations where each one operates.
- Transfer mechanism. Where access does occur outside the EEA, confirm which Chapter V mechanism applies and whether the vendor has supplied a transfer impact assessment.
Record each access path and its legal basis in your records of processing, because the placement setting does not show who looks at the data.
Placement does not decide whether a provider must hand over data. The US CLOUD Act provision at 18 U.S.C. 2713 requires covered providers to preserve or disclose data in their possession, custody or control, whether that data sits inside or outside the United States. The EDPB's Recommendations 01/2020 also state that where a provider needs data in the clear and the destination's public authority powers go beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned. These questions remain open even with EU storage.
- Legal reach follows control. CLOUD Act reach depends on the provider's control of the data, so EU storage alone does not remove it. Ask Cisco how it handles government requests for EU tenant data.
- Article 48 limits. GDPR Article 48 allows a third-country order to be enforced in the EU only under an international agreement, such as a mutual legal assistance treaty. Ask how the vendor applies that test to incoming requests.
- Transfer frameworks. The EU-US Data Privacy Framework decision covers only US organizations on the Data Privacy Framework List, and an appeal in Case C-703/25 P is pending. Confirm the vendor's status and how the appeal could affect your transfers.
- Transparency and challenge policy. Ask for the vendor's transparency reporting and its published process for challenging overbroad requests.
Record the legal basis for each transfer and review it when the Court of Justice or the Commission changes the framework.
Residency and exit are linked. If a placement setting or a transfer basis stops working, the organization must move its data and services, so the exit terms belong in the same review. The EU Data Act, applicable since 12 September 2025, gives customers the right to switch from a data processing service to another provider or to on-premises ICT infrastructure. The Act sets a maximum two-month notice period and a 30-day transition, and it bans switching charges from 12 January 2027.
- Notice and transition. Compare the notice and transition terms in your contract with the limits set by the Act.
- Switching charges. Charges are banned from 12 January 2027, so identify any fees that would apply before that date and ask how they are calculated.
- Export formats. Recordings, transcripts and messages must be exported in a form a new platform can read. This depends on the export process and not only on the contract.
- Non-personal data protection. Article 32 of the Data Act asks providers to prevent unlawful third-country governmental access to non-personal data held in the Union.
Ask Cisco for its export procedures and written switching terms before you decide how long the Webex contract must run.
Which open-source option fits which EU meeting use
This table compares Jitsi Meet, BigBlueButton and Matrix with Element Call on how each supports hosting in your own European infrastructure and what each asks of your team. Read each row against your meeting type, such as ad hoc calls, teaching sessions or chat-linked meetings, and confirm the trade-offs in your own environment before choosing.
| Option | How it supports EU hosting in your own infrastructure | Trade-offs |
|---|---|---|
| Jitsi Meet | Apache-2.0 licensed and deployable with Docker or Debian and Ubuntu packages on servers you choose in an EU location. Supports JWT token and LDAP authentication, and videobridges can be added horizontally. | HTTPS with a proper domain certificate is required, so certificate management becomes your job. Room device integration relies on Jigasi for SIP, which needs its own planning. |
| BigBlueButton | LGPL-3.0 licensed and installed on your own servers with bbb-install.sh. Greenlight provides a room manager front end that can sign users in through OpenID Connect. | Heavier server requirements, including at least 16 GB memory, 8 CPU cores and 500 GB disk for recordings, plus 250 Mbit/s symmetrical bandwidth. Built with a teaching focus, so ad hoc enterprise calls need more configuration. |
| Matrix with Element Call | Synapse is AGPL-3.0 licensed and can run on EU infrastructure you control. Federation can be restricted with federation_domain_whitelist, and SSO works through OpenID Connect, SAML2 or CAS. | Federation and server name decisions are hard to reverse, and Element Call adds components to operate. Element Server Suite Community includes Element Call, while Pro adds commercial support and features; confirm the split with Element before you buy. |
| Jitsi as a Service and meet.jit.si | Not an EU self-hosting option for this constraint, because 8x8 operates the service rather than your infrastructure. | Hosted by 8x8, Inc. and the public instance is operated by others, so data location and operator access are outside your control. |
How to deploy Jitsi Meet in European infrastructure under this constraint
This sequence takes a Jitsi Meet deployment from an EU site choice to a working, HTTPS-protected service whose media, authentication and recordings stay under your control. Each step ends with a check you can run before moving on.
Choose the EU region and data centers
The infrastructure or platform lead selects an EU region and one or more data centers, either your own facilities or a cloud region you contract for, and confirms with the provider where the central server, videobridges and backup copies will physically run. Ask the provider in writing which sub-processors can access the hosts and where their support staff operate, because remote access from a third country counts as a transfer under EDPB Guidelines 05/2021. The step is done when you hold a written list of every location and operator with access to the environment.
Prepare Ubuntu or Debian hosts with OpenJDK 17
The systems team provisions the central server and each videobridge on Debian 12 (Bookworm) or newer, or Ubuntu 24.04 or newer, the operating systems the Jitsi Debian and Ubuntu quick start supports, and installs OpenJDK 17. Confirm the chosen distribution and Java version against the current quick start before you build, since the requirements are set by the Jitsi project. The step is done when each host reports the supported OS release and the required Java runtime, and it is patched and time-synchronized.
Set a domain name and a trusted certificate
The network team registers a domain under your organization's control, points DNS to the central server, and obtains a certificate from a publicly trusted or internal CA that your users' devices already trust. Jitsi's handbook states that HTTPS is necessary for audio and video to work, and warns that self-signed certificates cause problems, especially on mobile clients. The step is done when the site loads over HTTPS from an external test client and the browser shows no certificate warning.
Open the required network ports
The network team opens 80/TCP and 443/TCP to the web front end and 10000/UDP for media to the videobridges, and adds 5349/TCP for TCP fallback and 3478/UDP for STUN if you choose to use them, as the quick start lists. Restrict every other inbound port at the firewall and keep administrative access on a separate management path. The step is done when a scan from outside your network shows only the intended ports open, and a test call connects media through the videobridge.
Choose JWT authentication and a separate guest domain
The identity and platform owners configure token-based authentication with JWT, which the Jitsi handbook recommends, and keep the older secure domain method out of the new installation because the handbook marks it as deprecated. Configure a separate anonymous domain for guests so that external participants join without holding your organization's credentials. Options such as LDAP and Matrix user verification are available through the
.envfile if your identity source requires them. The step is done when an authenticated user can create a room, a guest can join through the anonymous domain, and an unsigned request to the authenticated domain is refused.Size the central server and videobridges
The platform team sizes the central server and the videobridges against expected concurrent participants, using the scalable setup guide as the starting reference. The guide suggests a 4 CPU, 8 GB machine for the central server and 4 or 8 CPU with 8 GB RAM for each videobridge, and notes that videobridges scale horizontally by adding more. Load test with realistic meeting sizes in your own environment before go-live, and confirm that the bridges sit in the same EU locations as the rest of the stack. The step is done when a load test at your planned peak completes without media degradation and you have documented the bridge count to add.
Place recording storage under your control
If you enable Jibri for recording, the platform team creates storage in the same EU location and under your account, with access restricted to named administrators and encryption at rest if your policy requires it. Recordings written to a cloud bucket outside the EEA would be a transfer under the GDPR, and the same applies to backups of them, so check where each copy is replicated. Document the retention period and deletion process in your records of processing. The step is done when a test recording lands in the approved store, the storage location is recorded, and a deletion test removes the file.
What auditors and regulators ask for when meetings stay in the EU
Keeping meetings in the EU is a claim that has to be shown, not asserted. The cards below cover the records, contracts and configuration an auditor or data protection authority will expect to see, and they connect because each one answers a question about where data sits, who can reach it and how long it stays. DeployOpen prepares this evidence for your environment, but it does not issue audit reports or certifications; independent auditors and certification bodies do.
Data map of every data store
List where meeting metadata, recordings, chat, transcripts and logs are stored and processed, including backups, object storage buckets and any monitoring pipeline that copies logs out of the network. For each location, record the country, the operator and the legal entity that controls it. Webex data placement follows the site and the country chosen at provisioning, so the map is the document that proves the self-hosted position. Confirm that no component, such as a hosted TURN relay, email service or analytics tool, sends data outside the EEA without being in this map.
Transfer assessment for remote access
Under EDPB Guidelines 05/2021, remote access from a third country counts as a transfer even when a support engineer only views a screen. Record where administrators and vendor support staff sit, which accounts they use and whether any of them can reach the Jitsi, Matrix or BigBlueButton hosts from outside the EEA. Restrict administrative access by location and by role, and log it. An assessment that ignores support staff is the most common gap auditors find.
Hosting contracts and third-country exposure
Keep the data processing agreement with every hosting provider, colocation operator and managed service, along with the list of sub-processors. Note whether any processor is subject to third-country law with extraterritorial reach, such as the US CLOUD Act at 18 U.S.C. 2713. The EDPB treats compliance with a foreign authority's request as a potential transfer, so the record should state how the controller assessed that exposure before signing. Ask each provider to confirm in writing how it would respond to a foreign disclosure demand.
Access control and authentication evidence
Export the configuration that decides who can create rooms and join meetings. For Jitsi, this means the authentication mode in the .env file and whether JWT tokens are required for moderators, with the deprecated secure domain method documented as retired. For Matrix, it means the identity provider settings, such as oidc_providers or saml2_config, and the federation whitelist. Keep the change history and the review date for each setting, since these files are the first thing an assessor asks to see.
Retention and deletion settings for recordings
Define how long recordings, transcripts, chat exports and server logs are kept, and show the setting that enforces each period. Recording storage in a self-hosted stack is a local decision, so a retention schedule that exists only in a policy document will not satisfy a reviewer. Test deletion on a sample recording, confirm that backups follow the same schedule, and record the result. Ask your records team to confirm which period applies to meeting content from the business and legal side.
Exit and switching plan under the Data Act
Regulation (EU) 2023/2854 gives customers of data processing services the right to switch to another provider or to on-premises infrastructure, and bans switching charges from 12 January 2027. Document how you would export recordings, user accounts and room data from the current service, and how you would move them to your own servers if the provider changed terms. Keep the export procedure tested rather than assumed. Confirm with counsel which Data Act obligations apply to your contract, since the notice and transition periods are set in the regulation's articles.
Questions EU buyers ask before hiring an implementation partner
How much does it cost to self-host instead of staying on Webex?
The software is free to download, so the cost is what you pay to run it. Hardware or cloud capacity recurs every month, and bandwidth is a second recurring line. BigBlueButton 4.0 lists a minimum of 16 GB of memory, 8 CPU cores, 500 GB of disk for recordings and 250 Mbit/s symmetrical bandwidth, which is a useful starting point for sizing. One-time costs include implementation, hardening, certificates and integration with your identity source. Ongoing costs include the staff who patch, back up and support the platform, plus any support retainer. Webex costs are subscription-based, so compare recurring totals over several years rather than the first invoice. Ask any implementation partner for a quote built from a written scope that separates one-time work from retainers, and ask which costs are yours to carry in your own environment.
How long does a self-hosted video conferencing migration take?
The timeline depends on scope, so there is no fixed answer before the requirements are written down. The main variables are how many sites and users are involved, whether you need SIP room systems, whether recordings must be archived, which identity provider you use, and how many environments such as test and production you need. Fixed-scope engagements agree deliverables and timelines in writing before work starts, so ask for a written timeline that lists each milestone, the approvals you must give and the testing windows. Pilot use with a small group is a common way to shorten the risk of a later cutover, and that pilot should appear in the plan.
What does our organization need to provide for a self-hosted deployment?
You need to provide the infrastructure and the decisions. Expect to supply a domain you control, TLS certificates from a publicly trusted authority, firewall rules for the ports the platform uses, and a place to run the servers, whether that is your data center, an EU cloud account or an air-gapped network. Jitsi requires HTTPS with a proper domain certificate for audio and video to work, and self-signed certificates cause problems, especially with mobile clients. You also need to name an identity source, such as your directory or an OpenID Connect provider, and decide who signs in as a guest. Finally, you need staff who will operate the platform after handover, including on-call coverage for incidents.
Can our own IT team deploy Jitsi or BigBlueButton without a partner?
Yes, a capable team can deploy them. Jitsi offers Docker containers and Debian and Ubuntu packages, and BigBlueButton installs with its install script on Ubuntu 24.04. The harder parts are not the first install. They are HTTPS and certificate renewal, correct sizing and horizontal scaling of videobridges, firewall rules for UDP media, authentication through JWT tokens or your directory, backups, and upgrades. A transfer assessment under GDPR also needs legal input and documented decisions about where operators, support staff and backups sit. Ask whether your team has done these tasks before, and whether a fixed-scope engagement would cover only the parts you cannot staff.
Does moving our data out of Webex resolve the GDPR transfer question?
No. Moving data out of Webex changes where your meetings and recordings are stored, but GDPR Article 44 applies to every transfer of personal data to a third country, including onward transfers. The EDPB guidelines also treat remote access from a third country, even only displaying data on a screen for support, as a transfer. That means your new setup needs its own transfer analysis, covering who can access the servers, which support staff are located outside the EEA, and where backups and logs are kept. A self-hosted deployment reduces some exposure, but the analysis must be done on the deployment you actually run. Involve your data protection officer and counsel before cutover.
Does self-hosting remove all third-country exposure?
Only if the rest of the chain is also in the EU. Self-hosting in your own European infrastructure removes the vendor cloud from the media path, but exposure can return through the operator, support access, backups, monitoring tools and any hosting provider. If a provider with a non-EU parent may be compelled by a foreign authority, the EDPB guidance says to assess that exposure before engaging the processor. Confirm with counsel who can reach the data, which personnel can access systems from outside the EEA, and where every copy is stored. Ask any implementation partner to document those answers as part of the scope.
How DeployOpen deploys meetings in your EU infrastructure
DeployOpen plans, implements, hardens and documents self-hosted meeting platforms inside your own infrastructure, including European cloud accounts, data centers or private networks. The work starts with a written scope that fixes where meeting media, recordings and chat data sit, and what evidence your compliance team will need.
How we scope
- We map which meeting types, recordings and chat data your organization runs on Webex today.
- We confirm the EU hosting locations, operators and administrators who would touch each system.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
How we build
- We deploy Jitsi Meet, BigBlueButton or Matrix with Element Call in your chosen European environment.
- We configure HTTPS with a proper domain certificate and sign-in through your existing identity provider.
- We size media servers for your peak concurrency and test cross-border access paths for unintended transfers.
How we hand over
- We document the architecture, data flows, hosting locations and access controls for your records.
- We deliver runbooks for backups, upgrades, recording retention and incident response.
- We train your administrators to operate the platform and to answer data protection questions from auditors.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers.
- We keep platform versions current and review configuration changes against your written scope.
- Independent auditors and certification bodies issue any attestations, while we prepare the systems and evidence.
