Self-hosted CRM for EU data sovereignty

Why a self-hosted CRM on EU infrastructure is a self-hosted CRM for EU data sovereignty decision

A self-hosted CRM on EU infrastructure can meet the location and access goals of an EU data sovereignty program, but only when remote access, support staff and the software vendor's jurisdiction are controlled. The function itself is the same as any CRM: accounts, contacts, pipelines, activities and reporting. What changes is how the data moves, who can see it from outside the EU, how access, erasure and portability requests are served, how long records are kept, and how the organization leaves the system later. Under GDPR Article 44, every transfer of personal data to a third country, including onward transfers, must meet Chapter V conditions, and the EDPB's Guidelines 05/2021 treat remote viewing from a third country for support as a transfer, not only storage. A CRM hosted in an EU cloud region can still be exposed through a support engineer in another country or an administrator logging in from abroad.

The legal team's three questions map to concrete decisions. For where data is stored, the team should confirm the hosting provider, the region, backup locations and any replicas, and whether the database, file storage and mail logs all sit in the same jurisdiction. For who can see it, the team should list every administrator, developer, integrator and vendor support path, then decide which of them may view personal data and from which countries. For who can compel access, the team needs to assess the law that applies to each provider in the chain. The EDPB's Recommendations 01/2020 state that where a provider needs data in the clear and a third-country authority's powers go beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned, so contractual and organizational controls alone may not close the gap.

Platforms such as SuiteCRM, EspoCRM and Twenty all run on infrastructure the organization controls, so each can support this goal, and the differences between them lie in how their access, authentication and data export features are configured and operated, which the rest of this page examines. Before choosing one, the organization should write down its transfer map, its support model and its exit plan. Those three documents decide whether a self-hosted deployment actually keeps customer data inside the EU, and they are the first items a sovereignty review or a partner will ask for.

Which transfer, access and portability rules shape the CRM build

This table maps each transfer, access and portability rule to the source that sets it and the decision it forces on the CRM build. Read it as a checklist: hosting location, administrator access and vendor selection are the three places where these rules most often change the design.

Requirement	Source	What it means for the build
Every transfer to a third country, including onward transfers, must meet Chapter V	GDPR Article 44; fines of up to EUR 20 million or 4% of worldwide annual turnover under Article 83(5)(c)	Map every location where CRM data is stored, backed up or viewed, including subprocessors. Any copy outside the EEA needs a documented transfer basis before go-live.
Remote access from a third country and storage in a cloud outside the EEA both count as transfers	EDPB Guidelines 05/2021 (version 2.0)	Support staff or vendors viewing records from outside the EEA is a transfer, even without a download. Restrict administrator and support sessions to approved locations and log them.
Standard contractual clauses remain valid, but Privacy Shield is void	CJEU Case C-311/18 (Schrems II), 16 July 2020	Transfers that rely on contractual clauses still need a transfer impact assessment and supplementary measures. Keep the assessment with the CRM records of processing.
Transfers to the US are adequate only for organizations on the Data Privacy Framework List	Commission Implementing Decision (EU) 2023/1795; appeal pending as Case C-703/25 P	Confirm the hosting provider's status on the list if US entities can access data. Plan a fallback basis in case the adequacy finding is challenged successfully.
US providers must preserve or disclose data they control, wherever it sits	18 U.S.C. 2713 (CLOUD Act), added 23 March 2018	A US-parented hosting or support provider may be compelled to produce EU-hosted CRM data. Ask vendors for their process on government requests and weigh this in vendor selection.
Third-country court orders are enforceable in the EU only under an international agreement	GDPR Article 48	Define in contracts how requests are challenged and notified. Keep the CRM hosted on infrastructure where you control keys and access logs.
Providers must take measures against third-country governmental access to non-personal data held in the EU	EU Data Act Article 32; Regulation (EU) 2023/2854	CRM activity metadata, usage logs and exports that are not personal data still fall under this duty. Ask providers for their documented safeguards and conflict-of-law analysis.
Customers may switch to another provider or on-premises infrastructure with a limited notice and transition period	EU Data Act Articles 25, 29 and 50; switching charges banned from 12 January 2027	Keep CRM exports in open formats and document the data model. This preserves the option to leave a US-hosted CRM without losing history.

How US legal reach still applies to a self-hosted CRM

Self-hosting in the EU does not remove every foreign-law exposure. The EDPB's Guidelines 05/2021 treat remote access from a third country, even only displaying data on a screen for support, as a transfer. They also state that complying with a third-country authority's request would itself be a transfer. An EU-based processor can still fall within reach of third-country law with extraterritorial effect, so the EDPB advises controllers to assess that exposure before engaging such a processor. For a CRM, this means the review does not stop at the software license. It covers the vendor whose code you deploy, any support contractor who logs into the instance, a managed hosting provider, and any remote session where a person in another country can see customer records on screen.

Where a provider must read data in the clear, technical controls may not be enough. EDPB Recommendations 01/2020 state that where a cloud provider needs access to data in the clear and the destination's public authority powers go beyond what is necessary and proportionate, the EDPB cannot envision an effective technical supplementary measure. The US CLOUD Act, under 18 U.S.C. 2713, reaches data in a provider's possession, custody or control regardless of where it is stored. Your CRM team should therefore list every party with administrative or support access to the database, file store, backups and email integration, record each party's jurisdiction and the access route it uses, and decide which parties must be removed from the access path or replaced.

Document the assessment and confirm Data Privacy Framework status with counsel. Record the jurisdiction review, the access model for each contractor, the decisions taken and the date of review, so the file can be shown to a supervisory authority. Adequacy under Commission Implementing Decision (EU) 2023/1795 applies only to US organizations on the Data Privacy Framework List, and an appeal in Case C-703/25 P is pending, so the status of any US-linked party should be checked by counsel at the time of each assessment rather than assumed. Ask your legal team to confirm whether standard contractual clauses or other transfer tools are needed for each party, and to review the position again whenever a vendor, contractor or support route changes.

Which open-source CRM fits an EU sovereignty requirement

SuiteCRM, EspoCRM and Twenty are the three open-source CRMs in this group that can run on infrastructure you control. Each carries a different license position, upgrade path and hosting risk, and those differences matter more for an EU sovereignty requirement than feature lists do.

SuiteCRM: migration planning first

SuiteCRM is licensed under AGPL-3.0, and its SuiteCRM 8 core repository is also under AGPL-3.0, so self-hosting in EU infrastructure is free software use. The main risk is the version path. SuiteCRM 7 is an extended support release with security fixes until January 2028, and no SuiteCRM 8 extended support release has been nominated yet. Moving from 7 to 8 is a migration, not an upgrade, so budget a new environment, a staging test and a review of customizations under the public/legacy folder.

EspoCRM: self-hosting and install tooling

EspoCRM is licensed under AGPL-3.0 and the open-source edition can be self-hosted for free. Its installation script deploys a Docker-based stack with Nginx and MariaDB, and a command.sh utility handles backups, restores and upgrades. Confirm that your PHP, database and web server choices match the supported matrix, which lists PHP 8.3 to 8.5 and MySQL 8.0 or newer, MariaDB 10.6 or newer, or PostgreSQL 15. Cron or a scheduled task must run background jobs.

EspoCRM Cloud: confirm hosting location

EspoCRM Cloud is the vendor's hosted option, and it should not be chosen for data that must stay in the EU unless the provider confirms where the data is hosted and who can access it. Under the EDPB's view, storage in a cloud outside the EEA and remote access from a third country are both transfers. Ask the vendor for the hosting region, subprocessors and any third-country access, and document the answers before signing.

Twenty: check which features are open

Twenty is mostly licensed under AGPL-3.0, but files marked as Enterprise sit under a commercial license. Before you commit, list the features your sales team needs and confirm, file by file where necessary, that each one is in the open-licensed code. The latest tagged version is v2.9.0. Ask whether any feature you depend on for pipelines, permissions or integrations is Enterprise-only, because that changes the cost and the license obligations.

Choosing by exit plan and admin tooling

The right CRM depends less on the feature list than on how you will leave it and who will run it. Check whether each product lets you export full records, activities and attachments in a form you can move elsewhere, and whether its admin tools cover backups, upgrades and access logs. A platform with a clear exit path and tooling your administrators already know reduces sovereignty risk more than one with a longer feature list.

How login and admin access keep support staff inside the EU boundary

SuiteCRM 8 can delegate sign-in to a directory or an identity provider instead of local passwords. LDAP is enabled with AUTH_TYPE=ldap and is built on the Symfony Security LDAP authenticators. SAML is enabled with AUTH_TYPE=saml and is built on the nbgrp onelogin-saml-bundle. Either choice decides who can authenticate, so the directory group design is the main control over who can reach customer records from outside the EU.

Restrict by directory group: Admit only groups for named EU staff. Keep vendor or third-country support accounts out of the group that the CRM accepts, and create them only for time-limited work.
Plan for the logout gap: The 8.7.0+ SAML implementation does not support IdP-initiated logout or POST binding to the logout service, so ending a session at the identity provider does not end the SuiteCRM session. Set session lifetimes and document the manual step.
Keep the local admin path separate: Confirm how the local administrator account is protected and who holds it, since it can bypass the identity provider.
Log authentication events: Keep sign-in successes, failures, role changes and account creation from both the CRM and the identity provider, with time sources aligned.
Record admin actions: Retain logs of configuration and user administration changes, since those are the actions that can expand access.

Confirm with your implementer which directory attributes SAML or LDAP passes into the CRM and how long each log source is retained in your environment.

Setting retention limits and leaving a US-hosted CRM without losing history

Retention in a CRM is a process plus configuration, not a single setting. Before any field or workflow is changed, the business needs written retention periods for prospects, lapsed customers and closed opportunities, with a stated reason for each (for example, a contract or legal basis for keeping closed deals). The CRM then has to enforce those periods: custom fields that record last contact and status dates, scheduled workflows or Formula Script rules in EspoCRM, or equivalent scheduled jobs in SuiteCRM, that flag or anonymize records past their limit, and a named owner who reviews the exception list each cycle. Confirm with your platform team how each candidate CRM schedules background jobs, since EspoCRM requires cron or a scheduled task for them. Keep deletion logs outside the CRM so you can show what was removed and when.

Leaving a US-hosted CRM is a controlled export, not a file download. Export accounts, contacts, opportunities, activities and attachments as separate sets, and confirm the export includes the relationships between them (contact to account, activity to opportunity, owner and team assignments). Check record counts and a sample of fields against the source before any deletion is scheduled, and keep a signed transfer record that lists the source system, export date, counts, checks run and the person who approved them. Your contract should be read for switching rights. The EU Data Act gives customers the right to switch to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition, and bans switching charges from 12 January 2027 (Articles 25, 29 and 50). These rights apply to the provider relationship, so confirm with legal how your agreement's notice, transition and data return terms match them.

A self-hosted SuiteCRM 7 instance needs a planned migration, not an upgrade. SuiteCRM 8 is set up as a new environment and the 7 data is moved into it, with the 7 instance first brought to the latest 7.14.x or later. The Migrating from SuiteCRM 7 guide and the pre-migration checklist advise testing on a staging instance, backing up files and database, and reviewing customizations, because the migration may remove non-core files under the public/legacy folder. Inventory every custom file before migration and re-test retention workflows and export checks on the SuiteCRM 8 staging copy, so history and deletion logic survive the move.

How a sovereign CRM rollout runs from transfer assessment to cutover

This sequence moves customer data from a US-hosted CRM to self-hosted infrastructure on EU soil, with each phase closing on a written output that a privacy lead, security team and auditor can check. The order matters: the transfer map shapes the platform and hosting decisions, and those decisions shape the configuration and the migration.

Map every data flow and transfer
Start by listing every system, vendor, support path and location that touches customer and prospect data, including the US-hosted CRM, its backups, email and calendar sync, telephony, analytics, and any vendor staff who can view records remotely. The output is a data flow map and a transfer list that marks each point where data leaves the EU or where a non-EU party can see it, including remote display for support. Confirm each item with the vendor in writing, because hosting regions and support access are often not visible in the admin console.
Assess foreign-law exposure in each vendor
For each processor and sub-processor on the transfer list, review the legal exposure from third-country law, including government access powers that may reach data held in the EU by a provider under that jurisdiction. Record whether standard contractual clauses or another transfer mechanism applies, what the supplementary measures are, and whether the controller can rely on an EU-hosted processor without a third-country access path. The output is a documented assessment signed by the privacy owner, with open risks listed and a decision on each vendor.
Choose the platform and design EU hosting
Select the open-source CRM and the hosting model based on the data flow map and the assessment, then document a reference design covering identity, backups, logs and encryption. Identity usually means connecting SuiteCRM via LDAP or SAML, or EspoCRM via OpenID Connect or LDAP, to the corporate directory, with the logout behavior of each confirmed. Backups and logs should stay in EU locations under the same control, and encryption keys should be held by the client. The output is a reference design and a written hosting decision that names the data centers, operators and access paths.
Configure retention, requests and integrations
Build the data model, retention rules, request workflows for access, erasure and portability, and the integrations with email, ERP, billing and telephony. Test each request type end to end on a staging instance, including what happens to linked activities, attachments and backups, and confirm that API users use role-based permissions with strong authentication. The output is a tested configuration with test scripts, results and a list of fields that are deliberately excluded from sync to external services.
Migrate and reconcile against the source
Move accounts, contacts, opportunities, activities and attachments from the US-hosted CRM through trial imports into the new environment. Reconcile record counts, owners, permissions and sample records against the source, and keep the source export under the same EU-controlled storage rules during the work. Where the source is SuiteCRM 7, the move is a migration into a new SuiteCRM 8 environment, not an in-place upgrade, and the migration documentation calls for staging tests and file backups first. The output is a reconciled dataset and a signed sign-off from the business owner.
Cut over and record decommissioning evidence
Switch users and integrations to the EU-hosted system, freeze the old instance for read-only review, and then decommission it with a deletion request to the vendor covering the production data, backups and exports, as your contract and the vendor's terms allow. Collect the vendor's written confirmation and your own deletion logs, and update the records of processing and transfer register. The output is a closure record that lists what was deleted, where, by whom and when, and which open items remain. Confirm with the vendor how long backups persist after deletion, since this is a question to settle before cutover.

Which records a regulator or auditor will ask for and which component produces them

This table maps the records a regulator or assessor is likely to request for a self-hosted CRM holding EU personal data to the CRM feature, identity provider setting or process that produces each one. Read each row as a question to answer before an assessment, and confirm acceptance criteria with the assessor, since no evidence type is guaranteed to be accepted. The main takeaway is that most of the evidence sits outside the CRM itself, in hosting records, identity configuration and written transfer decisions.

Evidence	What it shows	Component or process that produces it
Register of processing locations and transfers	Where customer and prospect records are stored, administered and viewed, including remote support access from outside the EEA	Hosting inventory covering the CRM database, file storage, backups and support tooling, maintained by the operator and reviewed against each vendor or support access path
Transfer assessment documentation	Whether any transfer to a third country was assessed, including exposure to third-country authority requests under the EDPB guidance	Written transfer impact assessment prepared by the controller, with input from the hosting provider and any US-linked support or plugin vendor
Contractual transfer clauses in place	That processors and sub-processors are bound by the standard contractual clauses in Commission Implementing Decision (EU) 2021/914 where a transfer occurs	Signed data processing agreements and clause annexes held by legal or procurement, cross-checked against the sub-processor list
Hosting and admin access logs from the CRM and identity provider	Who logged in, from where, which administrative changes were made and whether remote access occurred	CRM audit and login logs, web server and database logs, and identity provider sign-in logs, forwarded to a central store with a defined retention period
Identity provider configuration showing who can log in	Which users and groups can authenticate, how sign-in is enforced and how leavers are removed	OIDC, SAML or LDAP configuration exports, group-to-team mappings and joiner, mover and leaver records from the directory, reviewed on a schedule
Retention schedule and deletion logs	How long each record type is kept and evidence that expired records were removed or anonymized	Retention rules written per entity and record type, scheduled deletion jobs in the CRM, and logs or reports showing what was removed and when
Records of access, erasure and portability requests handled in the CRM	How each data subject request was received, searched, actioned and answered, with dates and the systems touched	Request register kept by the privacy team, CRM search and export reports, and deletion or anonymization records linked to each request
Export and migration reconciliation reports	That record counts, owners and attachments moved between systems or out of a US-hosted CRM without loss	Pre and post migration counts, field mapping sign-off, and reconciliation reports produced during the data migration and cutover
Backup and restore test results	That backups are encrypted, stored inside the agreed location and can be restored within the recovery targets the organization set	Documented restore tests run on a staging instance, with dated results, the backup location and the person who signed off each test

What to ask an implementation partner about EU hosting and data requests

Start with where the data lives and who can reach it. Ask the partner to name the regions and data centers for production, staging, backups and log stores, and to confirm in writing whether any of them sit outside the EEA. Ask which of their engineers and subcontractors can access production, through which accounts, and whether any support is delivered from a third country. The EDPB treats remote access from a third country, even read-only screen display for support, as a transfer, so the answer to the support question changes the transfer analysis. Ask who holds the hypervisor, database and backup encryption keys, and whether the partner can run the stack without access to them. Also ask how they document the transfer assessment for each supplier in the chain, and which clauses they will sign, including the standard contractual clauses under Commission Implementing Decision (EU) 2021/914 and their processor terms.

Next, test the request workflow against your own CRM. Ask the partner to show how an access, erasure or portability request is served in SuiteCRM or EspoCRM, including which entities, custom fields, activities, attachments and email threads are included, and how the export is produced and delivered. Ask how deletion reaches backups, how long copies persist before they expire, and whether restores re-create records that were erased. Ask how retention rules are configured and tested, for example by seeding test records with known dates and confirming that the scheduled purge removes them. Finally, ask how the migration is handled. Confirm how records are reconciled between the source system and the target, with counts and sampled field checks, and whether a SuiteCRM 7 to 8 move is treated as a migration to a new environment, not an in-place upgrade. Ask for a written exit plan covering a full data export, the format, and the steps to move to another platform or on-premises infrastructure.

What buyers ask before they hire help with an EU sovereign CRM

How much does an EU sovereign CRM cost and what drives the price?

No single figure applies, because the cost follows from the written scope. The main components are hosting in your own cloud account or data center, legal review of any transfers and processors, configuration of objects and permissions, identity integration with your directory, data migration from the current system, training, and support after go-live. Hosting and support recur every year or month, while scoping, configuration, migration and the legal review are usually one-time work. Costs rise with the number of source systems, the volume of records and attachments, and the number of integrations. Ask any partner for a quote that separates one-time work from recurring items and states who pays for each licence or cloud resource. Note that the open-source edition of EspoCRM is free to download and self-host, while its cloud plans are priced per user, so compare hosted and self-hosted totals on the same basis.

How long does a self-hosted CRM migration to EU infrastructure take?

The duration depends on the written scope, not on a standard timeline. The factors that set it are the volume of accounts, contacts, activities and attachments, the number of source systems, the number of custom fields and workflows to rebuild, and the size of the legal review on transfers and access. A single-team instance with clear requirements and one source system will take far less time than a multi-entity rollout with several legacy tools. Ask a partner to show the phases, the decisions each phase depends on, and which tasks are blocked until your data owner and legal reviewer respond. Timelines are agreed in writing before work starts.

What does my organization need to provide for a CRM project?

The project needs a named data owner who can decide field meanings, record ownership and access rules, and legal input on which transfers, processors and third-country access routes are acceptable. You also need access to the current CRM for a full export, including attachments and activity history, and written decisions on retention periods for leads, customers, support contacts and marketing consent. Without retention decisions, the system cannot be configured for deletion. Expect to provide a staging environment, a list of integrations with email, telephony and ERP, and a person who can test imported data against business records before cutover.

Can our internal IT team run a self-hosted CRM without a partner?

Yes, for a small instance with clear requirements, a single data location and few integrations, an internal team with Linux, database and web server skills can install and operate SuiteCRM, EspoCRM or Twenty. The supported stack for each product is documented, and EspoCRM provides an installation script for Ubuntu, Debian and Linux Mint with backup, restore and upgrade commands. Bring in a partner when you need a migration from a legacy CRM, a SuiteCRM 7 to 8 move, SAML or OIDC integration with your identity provider, a documented transfer assessment, or evidence prepared for an audit. Keep in mind that SuiteCRM 8 requires a migration rather than an upgrade from version 7, and that the migration may remove non-core files under the public/legacy folder, so test on staging first.

Does hosting a CRM in the EU make it GDPR compliant?

No. EU hosting reduces one exposure, but it does not settle compliance by itself. The EDPB Guidelines 05/2021 treat remote access from a third country, including viewing data on a screen for support, as a transfer, so a US support engineer or a US-based vendor with administrative access can still trigger Chapter V obligations. Using an EU processor that is subject to third-country law with extraterritorial effect is not itself a transfer, but complying with a third-country authority request would be, so the exposure must be assessed. Processes for access control, retention, erasure, portability and records of processing also remain your responsibility. Confirm each sub-processor and support path with counsel and the vendor.

How do we move off a US-hosted CRM without losing history?

Plan the exit as a controlled export, reconciliation and cutover rather than a single download. Export accounts, contacts, opportunities, activities, notes and attachments, and keep the original export as evidence. Map each owner to a user in the new system, and decide how inactive users and territories are handled. Reconcile record counts and sample activity timelines against the source before go-live, and run a trial import first. Attachments need their own mapping because they may not carry over with the same links. Keep the old system read-only for a defined period so staff can check historical records. Ask any partner how they handle duplicate rules, import modes and post-migration checks, and confirm which exports your current vendor provides.

Will DeployOpen issue a compliance certificate for our CRM?

No. DeployOpen plans, implements, hardens and documents self-hosted platforms inside your own infrastructure, and prepares systems, controls and evidence for compliance assessments. It does not issue audit reports, attestations or certifications. Independent auditors and certification bodies make those determinations. In practice, the work covers configuration records, access and authentication settings, retention rules, transfer documentation and test results that your assessor can review. Ask any partner to state in writing which evidence they will produce and which decisions remain with you and your assessor.

How DeployOpen scopes and runs a sovereign CRM for an EU organization

DeployOpen plans, implements, customizes, integrates, hardens, documents and supports self-hosted CRM platforms inside the client's own infrastructure, including EU cloud accounts, data centers or air-gapped networks. For EU data sovereignty work, we start by mapping where customer data flows, who can reach it from outside the EEA, and which records each request type must touch.

How we scope

Map every place customer and prospect data is stored, replicated, backed up or viewed, including support access.
Document data subject request workflows for access, erasure and portability across contacts, activities, attachments and email.
Agree retention rules per object type in writing, with named owners for each deletion or export decision.
Confirm the hosting location, administrator access model and any third-country exposure before the build begins.

How we build

Deploy the chosen CRM, such as SuiteCRM or EspoCRM, in the client's EU infrastructure with encryption in transit and at rest.
Configure SSO through LDAP, SAML or OpenID Connect and set role-based access so administrators are limited to their duties.
Build scheduled retention jobs, export routines and deletion procedures, then test them on a staging instance first.
Run security testing against the CRM and its integrations, and record findings and fixes in a remediation log.

How we hand over

Deliver runbooks for access requests, erasure, portability and retention reviews, written for the client's own staff.
Provide configuration records, network diagrams, data flow maps and access logs that the client's auditors can review.
Train administrators on backups, restores, upgrades and the process for handling a request from start to finish.
Confirm with the client's counsel and assessors which evidence supports their own compliance conclusions.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
Upgrade plans cover vendor release cycles, including any migration path when a major version changes.
Review access rights, retention jobs and third-country exposure whenever the vendor, hosting or staffing model changes.
Ask any implementation partner to confirm the support hours, response process and scope in the written agreement.