Self-hosted Zoom alternative for EU data sovereignty

Why EU data sovereignty changes the Zoom decision

Region controls answer one question: where Zoom processes meeting data. For an EU organization, that is useful, but it does not settle the GDPR position. Zoom's data center region settings cover meeting data in transit, and they do not extend to Zoom Phone, so a team that assumed all voice traffic followed the same region setting should check that before relying on it. Self-hosting Jitsi Meet or BigBlueButton in your own datacenter removes the third-country hosting question for meeting media and chat, but it does not remove transfer questions for any external service you keep, such as a hosted TURN relay, a managed email provider for invitations, or a support vendor with remote access.

GDPR Article 44 applies to every transfer of personal data to a third country, including onward transfers. The EDPB's Guidelines 05/2021 treat remote access from a third country as a transfer, even when the person only views data on a screen for support or administration, and storage in a cloud outside the EEA is also a transfer. An administrator in another country who connects to your meeting server to troubleshoot a call is therefore part of the analysis. Before choosing a platform, map every system that touches meeting content, participant identities, recordings and logs, and record who can reach each one from outside the EEA.

The short answer for most EU organizations is self-hosting with a written scope for what stays local. Confirm with your data protection officer which data categories are in scope, whether recordings and transcripts are stored in the same location, and which vendors have access to the servers. Ask any implementation partner to document where administrative access originates and how it is logged. That scope, not the choice of open-source software alone, is what determines whether the transfer analysis is short or long.

What GDPR Chapter V requires of meeting data

Chapter V of the GDPR applies to meeting data whenever it leaves the EEA, whether by storage, onward transfer or remote viewing from a third country. The cards below set out the rules and the open questions an EU organization should settle before choosing where meeting data lives.

Onward transfers and remote access count

Article 44 applies to every transfer of personal data to a third country, including onward transfers made by a provider or its subprocessors. A support engineer in a third country who can view a meeting or recording on screen can trigger the same obligation as a copy stored there. Ask any vendor for a list of locations from which staff or subprocessors can access meeting content, and check whether those locations are covered by a Chapter V mechanism.

Displaying data counts as a transfer

EDPB Guidelines 05/2021 state that remote access from a third country is a transfer even when the data is only displayed on a screen for support or administration. For meetings, this means administrator consoles, moderation tools and support sessions can each create a transfer. Map who can open meeting rooms, recordings and logs, and where those people sit.

Cloud storage outside the EEA

Storing meeting recordings, chat logs or transcripts in a cloud region outside the EEA is a transfer under the same guidelines, even if the meeting itself was hosted in the EU. Recordings are often the most sensitive meeting data because they persist long after the call. Confirm the storage region for each artifact, including backups and replicas, not only the region of the media servers.

Fine levels under Article 83

Infringements of Articles 44 to 49 fall in the higher fine tier of Article 83(5)(c), up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Using a meeting platform without a valid transfer basis is therefore a board-level risk, not only a technical one. Document the transfer assessment before rollout, and keep it current when the provider or hosting location changes.

Schrems II and the Data Privacy Framework

The Court of Justice invalidated the Privacy Shield in Case C-311/18 (Schrems II) while holding that standard contractual clauses remained valid. Commission Implementing Decision (EU) 2023/1795 covers only US organizations on the Data Privacy Framework List, and an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. Check whether a US-headquartered vendor is on that list today and plan a fallback basis in case the decision is set aside.

Foreign authority requests

The US CLOUD Act provision at 18 U.S.C. 2713 requires providers to preserve or disclose data in their possession, custody or control, wherever it is stored. EDPB Recommendations 01/2020 state that where a provider needs access to data in the clear and the destination's authority powers exceed what is necessary and proportionate, no effective technical supplementary measure can be envisioned. Self-hosting within your own datacenter removes the provider from that chain, but any vendor-managed component still needs this assessment.

Where Zoom's region controls stop short

Zoom's region controls govern where meeting data in transit is handled, but they do not cover Zoom Phone, so an organization that assumes one region setting covers all of its voice and video may be wrong. Before relying on those controls for a GDPR position, ask Zoom to confirm in writing the current regional scope, which data categories each control covers, and which features fall outside it. Request the current sub-processor list at the same time, with the countries where each sub-processor processes or stores data. Record the answers as the baseline for your record of processing and your transfer assessment, since a region setting does not answer who can compel access to the data.

Zoom Node keeps meeting media on your premises, but it is on-premises hardware that remains managed from the Zoom cloud, hosting modules such as Zoom Meetings Hybrid and Recording Hybrid. Local hosting therefore does not remove the cloud management plane, so confirm which telemetry, configuration data and support sessions reach Zoom and from which countries. Remote access from a third country, even only displaying data on a screen for support, counts as a transfer under EDPB Guidelines 05/2021, so Zoom staff access during support must be assessed too. The U.S. provision at 18 U.S.C. 2713 requires providers of electronic communication and remote computing services to preserve or disclose data in their possession, custody or control whether it sits inside or outside the United States, so keeping data in an EU region does not by itself settle that exposure.

Two legal questions remain after the region is chosen. The EU-US Data Privacy Framework adequacy decision, Commission Implementing Decision (EU) 2023/1795, applies only to US organizations on the Data Privacy Framework List, and its upholding is under appeal as Case C-703/25 P, so ask Zoom whether the contracting entity is on that list and what its contract provides if the decision falls. Where a provider needs data in the clear and third-country powers go beyond what is necessary and proportionate, EDPB Recommendations 01/2020 state that no effective technical supplementary measure can be envisioned, so the assessment must rest on contractual and legal terms. Article 48 of the GDPR limits recognition of foreign disclosure orders to those based on an international agreement, which counsel should map against Zoom's contract terms.

Jitsi Meet or BigBlueButton in your own datacenter

Jitsi Meet is licensed under Apache-2.0, so you can run it in your own datacenter without a license fee. A self-hosted deployment is several components that you size, patch and monitor separately: the web front end, the Prosody XMPP server, Jicofo, one or more Jitsi Videobridge media routers, and optionally Jibri for recording and streaming and Jigasi for SIP. Each role adds operational work, and the data stays where you place these hosts.

Component set: the web server (nginx or Apache), Prosody, Jicofo and Videobridge form the core. Jibri and Jigasi are optional add-ons, each with its own host capacity to plan.
Packaging: the Docker setup runs separate web, prosody, jicofo, jvb, jigasi and jibri containers. The Debian and Ubuntu quick start supports Debian 12 or newer and Ubuntu 24.04 or newer, and requires OpenJDK 17.
HTTPS: the handbook states that HTTPS with a proper domain certificate is necessary for audio and video. Self-signed certificates cause problems, especially on mobile clients, so plan an internal or public certificate before rollout.
Authentication: the older secure domain method is deprecated for new installations. JWT token authentication is recommended, with a separate anonymous domain for guests. The Docker setup also offers LDAP, Matrix verification and a hybrid mode, configured in the .env file.
Ports: 80/TCP, 443/TCP and 10000/UDP are required, with 5349/TCP for TCP fallback and 3478/UDP for STUN as optional.

Confirm your firewall policy allows the UDP media path, and check the release tags before you pin a version.

Which GDPR transfer questions remain after self-hosting

Self-hosting takes Zoom's cloud out of the meeting path, but it does not take every transfer question off the table. The first step is to map each external dependency that can still touch personal data and confirm, in writing, where it is located and who can access it. Under GDPR Article 44, every transfer to a third country, including onward transfers, must meet Chapter V conditions. Start with vendor support access: under the EDPB Guidelines 05/2021, remote access from a third country counts as a transfer, even when a support engineer only views a screen during troubleshooting. Ask each vendor whether support staff, or a contracted subprocessor, can reach your servers or logs from outside the EEA, and under what approval process.

Next, list the services that sit beside your own servers. A hosted Jitsi as a Service (JaaS) tenant, a BigBlueButton Inc. hosting arrangement, a TURN relay or CDN, a SIP trunk provider used by Jigasi, and email or calendar connectors for invitations all process meeting metadata or participant details. Each one needs a known server location, a data processing agreement, and a clear statement of any non-EEA storage or access. TURN relays matter in particular, because media for users behind restrictive firewalls may pass through them. Confirm whether your provider runs relays in your region and whether the relay logs are kept.

Finally, consider government access. Article 48 of the GDPR means that a third-country court order or administrative demand for disclosure is enforceable in the EU only if it rests on an international agreement, such as a mutual legal assistance treaty. Where a provider with third-country exposure holds data in the clear, the EDPB Recommendations 01/2020 state that it cannot envision an effective technical supplementary measure if the foreign authority's powers exceed what is necessary and proportionate. Document this assessment before you engage any such processor, and keep your data-protection officer involved in the decision.

How to deploy Jitsi or BigBlueButton under EU residency rules

This sequence takes an EU organization from choosing a datacenter it controls to a documented, reachable meeting service whose data flows are mapped for its GDPR assessment. It produces a deployment that keeps media and recordings inside infrastructure the organization runs, with the open items recorded for legal review.

Choose an EU datacenter or cloud region you control
Your infrastructure or security lead selects a facility or EU cloud region where the organization holds administrative control over servers, storage and network paths. Confirm with the provider, in writing, where backups, snapshots, logs and support tickets are stored, because each of these can create a copy outside the intended location. The step is done when you have a written location map covering compute, storage, backups and logging. Ask the provider whether any administrative or support access can originate from outside the EEA, since remote access from a third country is treated as a transfer under EDPB Guidelines 05/2021.
Confirm hostname and certificate plan
Your network team picks a fully qualified domain name for the meeting service and decides how certificates will be issued and renewed. Jitsi's handbook states that HTTPS with a proper domain certificate is necessary for working audio and video and warns that self-signed certificates cause problems, especially on mobile clients. BigBlueButton also requires a valid hostname for SSL. The step is done when the hostname resolves internally and externally, and a renewal process with a named owner is documented.
Size and build the server on a clean install
Your platform engineers provision the host to match the chosen product. For BigBlueButton 4.0, the install documentation lists at least 16 GB of RAM with swap, 8 CPU cores with high single-thread performance, 500 GB of disk for recordings (50 GB without recording) and 250 Mbit/s symmetrical bandwidth on Ubuntu 24.04 64-bit. Direct upgrades from 2.6, 2.7 or 3.0 are not supported, so start from a clean server. For Jitsi, the handbook requires Debian 12 or newer or Ubuntu 24.04 or newer with OpenJDK 17. The step is done when the host meets the stated specification and the install completes with bbb-install.sh or the Jitsi package or Docker setup.
Open the required network ports
Your network and security team opens only the ports each product needs. For BigBlueButton, TCP 80 and 443 and UDP 16384 to 32768 must be reachable. For Jitsi, the quick start needs 80/TCP, 443/TCP and 10000/UDP, with 5349/TCP for TCP fallback and 3478/UDP for STUN as optional. Restrict all other inbound access at the firewall and document the rule set. The step is done when an external scan shows only these ports open and a test call succeeds from a network outside your office.
Deploy a TURN server for restrictive networks
Your network engineers install a TURN relay inside the same EU infrastructure so participants behind strict corporate or public firewalls can still reach media. BigBlueButton's install documentation recommends a TURN server for users behind restrictive firewalls, and Jitsi's quick start lists 5349/TCP for TCP fallback. Keep the TURN service on infrastructure you control so relayed media does not leave the EU. The step is done when a test call from a network that blocks UDP connects through the relay and the relay logs stay in your environment.
Configure authentication and guest access
Your identity team sets how users join. Jitsi's handbook marks the older secure domain method as deprecated for new installations and recommends JWT token authentication, with a separate anonymous domain for guests. The Docker guide lists internal XMPP accounts, JWT, LDAP and Matrix verification options set in the .env file. For BigBlueButton, Greenlight v3 supports OpenID Connect through environment variables, and Keycloak can add other login methods. The step is done when staff sign in through the directory, guests cannot create rooms, and the shared secret or JWT key is stored outside any web page.
Restrict remote support and administrative access
Your security team limits who can administer the servers and from where. Under EDPB Guidelines 05/2021, displaying personal data on a screen for support from a third country is a transfer, so support staff and vendors outside the EEA should not get interactive access to production hosts without a documented assessment. Record which vendor personnel can reach the systems, under what approval, and through which bastion. The step is done when administrative access is limited to named EU-based accounts, and the access log is retained inside your environment.
Document the data flows and open legal questions
Your data protection officer and architects produce a data flow map covering media, signaling, chat, recordings, logs, backups and any identity provider. Mark every point where data could leave the EU or come under third-country law, including provider support access and any US-based identity or monitoring service. Record the open questions for counsel, such as the status of the Data Privacy Framework appeal (Case C-703/25 P) if a US processor is involved. The step is done when the map and open items are approved by the controller, and independent auditors or legal counsel have the evidence they need for their own assessment.

Evidence a data protection officer or regulator will ask for

A data protection officer or supervisory authority will test whether the written record matches the running system. The cards below cover the documents and settings that connect a self-hosted meeting platform to GDPR accountability. DeployOpen prepares this evidence, but auditors and regulators decide whether it is sufficient.

Record of processing and data flow map

Start with the record of processing activities for meetings, recordings and chat, then draw where each stream goes: browser to web front end, media to the videobridge or BigBlueButton server, recordings to storage, and any SIP gateway or transcription service. Mark every point where a person outside the EU can see or store data, including support access. Confirm that the map matches the actual deployment rather than the original design.

Transfer assessment for each external service

Every external service in the meeting path needs its own assessment: a hosted TURN relay, an email provider for invitations, a managed transcription API, or a vendor support channel with remote access. Under EDPB Guidelines 05/2021, remote viewing from a third country and storage outside the EEA both count as transfers. Record the outcome for each service, not one summary for the whole platform.

Contracts and sub-processor lists

Keep the signed data processing agreement for each provider that touches personal data, including DeployOpen if it runs operations for you, and the sub-processor list each one maintains. Check whether standard contractual clauses under Commission Implementing Decision (EU) 2021/914 are in place where a transfer exists. For any US-based provider, confirm whether it appears on the Data Privacy Framework List, and note that the adequacy finding is under appeal as Case C-703/25 P.

Server location and access logs

Document the physical location of every meeting, recording and database server, the cloud account and region, and who holds administrative credentials. Access logs for SSH, the database, the object store and the BigBlueButton or Jitsi admin interfaces should be retained and reviewed. These records show whether any operator outside the EU can reach personal data in the clear, which is the condition the EDPB Recommendations 01/2020 treat as hard to supplement technically.

Recording retention and deletion settings

Recordings, chat logs and transcripts are the data most likely to be kept longer than needed. Write down the retention period for each type, where Jibri or BigBlueButton stores files, and how deletion runs, including backups and replicas. A BigBlueButton 4.0 server needs 500 GB of disk for recordings, so ask who sizes and clears that storage. Test a deletion request end to end and keep the result as evidence.

Authentication configuration

Show how hosts are identified and how guest access is limited. For Jitsi, the handbook recommends JWT token authentication over the deprecated secure domain method, with a separate anonymous domain for guests. For BigBlueButton, every API call must carry a checksum made with a secret that must never be embedded in a web page. Export the configuration files and variables, such as the .env file for Jitsi Docker, and store them under version control with change records.

Questions EU buyers ask before self-hosting Zoom

Does self-hosting Jitsi or BigBlueButton remove all GDPR transfer obligations?

No. Running the platform in your own datacenter removes the vendor's cloud as a processing location, but it does not remove every transfer question. Under GDPR Article 44, any transfer of personal data to a third country, including onward transfers, must meet Chapter V conditions. Check where any external components sit, such as hosted TURN relays, email providers, SIP trunks, cloud backups, or a vendor's support staff who view data from outside the EEA. EDPB Guidelines 05/2021 treat remote access from a third country, even just displaying data on a screen, as a transfer. Map every data flow and record the answers in your Article 30 records before you claim the deployment is sovereign.

What does the internal team need to run a self-hosted meeting platform?

Plan for a named owner who can handle Linux administration, TLS certificates, firewall rules and upgrades. Jitsi's self-hosting guide states that HTTPS is necessary for multimedia to work, and self-signed certificates cause problems, especially on mobile clients, so certificate lifecycle needs an owner. BigBlueButton 4.0 requires a clean Ubuntu 24.04 install, and direct upgrades from 2.6, 2.7 or 3.0 are not supported. Staff also need to handle identity integration, recording storage and capacity planning, and to respond when a meeting fails. Confirm these skills in your own team before you commit to a platform.

How does the cost split between servers, bandwidth, TURN, recording storage and staff?

There is no license fee, so the cost sits in components. The main ones are:

Servers: BigBlueButton 4.0 needs at least 16 GB of RAM with swap, 8 CPU cores and 250 Mbit/s symmetrical bandwidth per the install documentation. Jitsi scales by adding videobridges, and the scalable setup guide suggests a 4 CPU, 8 GB machine for the central server.
Bandwidth: symmetrical links drive recurring cost.
TURN: a TURN server is recommended for users behind restrictive firewalls.
Recording storage: BigBlueButton 4.0 needs 500 GB of disk for recordings, or 50 GB without recording.
Staff: setup is one-time, while upgrades, monitoring and support recur.

Request a quote that prices each component separately, with recurring and one-time items marked.

Can DeployOpen implement a self-hosted meeting platform on a fixed scope?

Yes. DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, datacenters or air-gapped networks. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen does not publish a price list, so a quote follows from the written scope. Ongoing support, upgrades and continuous testing are available as retainers. DeployOpen prepares systems, controls and evidence for compliance assessments, but independent auditors and certification bodies issue any audit reports or certifications. Ask for a written scope that names the platform, the integrations, the recording design and the handover documents.

How long does a migration from Zoom usually take, and what drives it?

No duration is fixed in this guide, so treat any number you hear with caution and ask for it in writing. The main drivers are the number of users and rooms, the number of integrations with calendars, LMSs or identity providers, whether recordings must be archived from Zoom first, the sizing and testing of media servers, and how much user training is needed. Jitsi migrations also depend on whether you need Jibri recording or Jigasi SIP, and BigBlueButton migrations depend on LMS embedding and Greenlight room design. Ask for a timeline tied to a written scope with milestones.

Do the EU Data Act switching rights apply to Zoom?

The Data Act has been applicable since 12 September 2025, and Articles 25, 29 and 50 give customers the right to switch from a data processing service to another provider or to on-premises ICT infrastructure. The regulation sets a maximum two-month notice period and a 30-day transition, and it bans switching charges from 12 January 2027. Whether a specific Zoom contract, product or service falls within that definition is a legal question. Ask your counsel to confirm the scope against the contract and Regulation (EU) 2023/2854, and do not assume the rights apply to every Zoom service line.

Which parts of the migration does a team usually underestimate?

Most teams underestimate the recordings and the integrations, not the video itself. Zoom saves recordings as MP4, M4A, TXT chat, VTT transcript and CC.VTT files, and these need to be exported and stored under your own retention rules before the account closes. Calendar plug-ins, single sign-on, LMS links and webinar registration tools also need to be rebuilt by hand. Test each of these in a pilot group so that a recording or login failure does not surface during a live session.

What changes for users and for Zoom data you already hold

The Data Act gives you a lever before you move a single meeting: under Articles 25, 29 and 50 of Regulation (EU) 2023/2854, customers of a data processing service can switch to another provider or to on-premises ICT infrastructure, and the switching charges ban applies from 12 January 2027. Use that right to put a written export request to Zoom early, covering cloud recordings, chat, transcripts and captions. Confirm with Zoom and with your counsel which notice period and transition window apply to your contract, since the Act sets maximums and a 30-day transition, and ask for the export in formats your new platform can import. The Data Act text is the natural next read for your legal team.

Existing Zoom files are the data you most need to plan for. Cloud recordings arrive as MP4 video, M4A audio, TXT chat, VTT transcript and CC.VTT caption files, and each one is personal data if participants can be identified. Move them into your EU environment, record where each copy lives, and restrict who can open them. Then review retention per category: a recording you no longer need for its original purpose is a candidate for deletion, not for archiving by default. Document the decision for each batch so the record of processing matches what you actually hold.

Users will notice the change. Meeting links will point to your own domain instead of zoom.us, and sign-in will follow your identity provider or the authentication mode you configure, such as JWT tokens for Jitsi or OpenID Connect through Greenlight for BigBlueButton. Publish new join instructions, retire old calendar invitations, and test HTTPS with a valid certificate on every client type, because the Jitsi handbook warns that self-signed certificates cause trouble on mobile. Zoom Phone is not covered by meeting-only replacements. Decide separately whether it is replaced, kept under its own transfer assessment, or moved to a SIP path.

How DeployOpen deploys Jitsi or BigBlueButton under EU residency

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For EU residency, that means the meeting servers, recordings and logs are placed where the client's data protection and transfer analysis says they belong, and we document what that placement does and does not settle.

How we scope

Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
The written scope lists which meeting, recording and chat data stays in your EU datacenter and which flows leave it.
Scope also records the GDPR transfer questions you own, such as remote access from outside the EEA and third-country support access.

How we build

We deploy Jitsi or BigBlueButton in your cloud account, EU datacenter or network, with HTTPS on a valid domain certificate.
We size media servers and TURN for your expected concurrency, and confirm the required UDP and TCP ports with your network team.
We configure authentication, recording storage and retention settings, then test them against the controls in the written scope.

How we hand over

You receive architecture, data flow and hosting location documentation that your privacy and legal teams can review.
Runbooks cover updates, backups, certificate renewal and scaling so your operators can run the platform without us.
We prepare evidence of configuration and testing for your compliance assessment, while auditors and certification bodies issue any opinions.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, agreed separately from the initial scope.
Upgrades are planned against the release notes of your chosen platform, with a test environment before production changes.
Your quote follows from the written scope. Ask for the cost components, what recurs and what changes the price.