Why a citizen participation platform for EU data sovereignty needs a different build
An EU public body that wants participant identities, signatures and votes to stay under EU jurisdiction should self-host Decidim in EU infrastructure and map every service that could move personal data abroad. The platform itself is the right tool for the participation workflow, since Decidim provides processes, assemblies, initiatives, proposals, surveys and participatory budgets in one framework. Strapi, Drupal and similar content tools can publish pages, but they do not provide the participation components, so they are not substitutes for it. The data sovereignty question is therefore about the hosting and the surrounding services, not about choosing a different application.
The defaults that need the closest examination are the ones that quietly contact outside providers. Decidim's social login providers for Facebook, Twitter and Google are available out of the box, configurable globally or per organization, so they should be disabled unless a sovereign identity source replaces them. Maps, geocoding, SMTP relays and file storage are configured in production setups, and each one can send participant data to a provider outside the EU. Under EDPB Guidelines 05/2021, even remote access from a third country for support counts as a transfer, so the vendors your own administrators and the hosting provider use also belong in the map. Confirm with the host where backups, logs and monitoring data are stored, because a cloud location outside the EEA is also a transfer under those guidelines.
Which legal requirements shape the build, and what each one means for the platform
This table maps each legal requirement that affects where a participation platform can run and who can touch it to the concrete build decision it forces. Read each row as a question to answer before hosting, vendor and support choices are locked. The main takeaway is that transfers include remote access and backups, not only the primary database.
| Requirement | What it asks for | Build consequence |
|---|---|---|
| GDPR Article 44 and Chapter V | Every transfer of personal data to a third country, including onward transfers, must meet Chapter V conditions. | Map every location where participant data is stored, processed or viewed, including subprocessors, logs, backups and email relays, before choosing hosts. |
| Article 83(5)(c) exposure | Infringements of Articles 44 to 49 can carry fines up to EUR 20 million or 4% of worldwide annual turnover. | Treat transfer mapping as a board-level risk item, and record who signed off each non-EEA data flow and why it was accepted. |
| EDPB Guidelines 05/2021 on what counts as a transfer | Remote access from a third country, even only displaying data for support, and storage in a cloud outside the EEA are transfers. | Restrict vendor and support access by location, use EU-based administrators, and log remote sessions so access can be shown to be inside the EEA. |
| EDPB Guidelines 05/2021, Example 12 on EU processors | An EU processor subject to third-country law with extraterritorial effect is not itself a transfer, but complying with a third-country authority request would be. | Ask each EU hosting provider whether a non-EU parent company can compel access, and assess that exposure before signing a processing agreement. |
| GDPR Article 48 on third-country disclosure orders | A foreign court or agency order to disclose personal data is enforceable only if based on an international agreement in force with the Union or a Member State. | Write a contract clause requiring the host to challenge foreign orders, notify the controller where lawful, and disclose only the minimum data. |
| US CLOUD Act reach (18 U.S.C. 2713) | US electronic communication and remote computing service providers must preserve or disclose data in their possession, custody or control, wherever it is located. | A US-headquartered provider can be obliged to produce EU-hosted data, so vendor control and corporate ownership must be assessed, not just server location. |
| EDPB Recommendations 01/2020 on supplementary measures | Where a provider needs data in the clear and the destination's public authority powers go beyond what is necessary and proportionate, no effective technical supplementary measure is expected. | Where the host needs clear-text access, a US-controlled host is hard to justify. Consider keeping keys and administration inside the EU with the public body or an EU operator. |
| Data Privacy Framework status | Implementing Decision (EU) 2023/1795 covers only US organizations on the Data Privacy Framework List, and an appeal in Case C-703/25 P is pending. | Do not rely on a US host's DPF listing as a settled transfer basis. Run a fresh transfer assessment, and confirm the appeal outcome with counsel before go-live. |
| Data Act Article 32 safeguards | Providers of data processing services must prevent third-country governmental access to non-personal data held in the EU where this would conflict with EU or national law. | Ask providers for written measures covering non-personal data such as audit logs, configuration and usage metrics, which often sit outside personal data scope. |
| Data Act switching rights (from 12 September 2025 and 12 January 2027) | Customers may switch to another provider or on-premises infrastructure with a maximum two-month notice and a 30-day transition; switching charges are banned from 12 January 2027. | Build the platform on open-source components with exportable data and documented restore steps, so the public body can move hosts or bring the service on-premises without paying switching fees. |
Which participant data and systems leave the country by default
A self-hosted Decidim site keeps most of its data on your servers, but a default installation can still send participant data to services outside the EU. The first step is to inventory what the platform holds: registration profiles, authorization and census records, verification records, proposals, votes and their supporting metadata, comments, uploaded files, email delivery logs and database backups. Each of these stores personal data, and each needs a known physical location and a named operator. Backups deserve particular attention, because a copy taken by a cloud snapshot service or an offsite replication target can sit outside your intended jurisdiction even when the primary database does not.
The services most likely to move data abroad are the ones that run in the participant's browser or receive requests from your servers. Decidim supports Facebook, Twitter, Google and Decidim-to-Decidim OAuth 2.0 login out of the box, so a sign-in button can send a participant's session to a provider headquartered outside the EU. Map tiles and geocoding calls can reveal addresses or neighborhoods, SMTP relays may receive message content and recipient addresses, and error tracking, CDN and analytics scripts can transmit IP addresses and page activity. Decidim's own configuration covers maps, geocoding, SMTP and social providers, so each of these must be checked in your deployment rather than assumed to be off. Confirm with the Decidim social providers documentation and your version's settings exactly which fields each provider receives.
Which platforms fit an EU-sovereign participation build and why
Decidim is the only platform in this set that covers voting, proposals and initiatives, so it anchors the build. Adjacent CMS, newsletter and form tools handle the surrounding public website and outreach, and each one that touches participant data needs the same transfer review as the core platform.
Decidim as the participation core
Decidim is a free, open-source participatory democracy framework built on Ruby on Rails and PostgreSQL, licensed under AGPL-3.0. It provides processes, assemblies, initiatives, participatory budgets, proposals, surveys and meetings, which are the workflows that hold participant identities and votes. More than 500 organizations use it, including the European Commission's Citizens' Engagement Platform, so the platform can be hosted in EU infrastructure under your control. Confirm which components your legal process needs before you commit.
Security support covers two minor versions
Until version 1.0, Decidim patches only the last two minor versions, currently 0.32.x and 0.31.x. Versions 0.30.x and earlier receive no security updates, so an EU build that starts on an older line carries known exposure. Version 0.32.1 followed 0.32.0 on July 30, 2026. Ask your implementer which branch they will deploy, how they will move between minor versions, and how they will apply patches within the grace period Decidim gives implementers.
Drupal for the public website
Drupal is a strong fit for a large public website that sits alongside the participation platform, with governance and accessibility tooling suited to multi-site estates. It does not run votes, proposals or initiative signatures, so it stays outside the participation data path. Keep participant accounts, signatures and comments out of the CMS database, and set the same transfer and processor review for any hosted or plugin service it calls. Drupal 11.4.10 was released on October 14, 2026.
WordPress and headless CMS options
WordPress, Strapi, Payload and Directus can serve news, guides and explainers around a consultation. Only the newest WordPress 7.1 release is maintained, so plan upgrades rather than pinning an old minor version. Directus uses a source-available license that permits internal use and professional services, which you should confirm with counsel before deployment. None of these tools replaces Decidim's voting, proposal or initiative workflows, and their plugins and hosted media services need separate review.
Mautic for participant newsletters
Mautic handles email campaigns and subscriber lists, which means it stores names, addresses and engagement history tied to participation topics. If a newsletter reveals a participant's interests or political views, that record becomes sensitive personal data. Host Mautic in EU infrastructure, keep it separate from the voting database, and confirm that the mail relay and tracking services do not transfer data outside the EEA. Mautic 7.2.1 was published on September 23, 2026.
Transfer review for every adjacent tool
Each CMS, form, mailing or analytics tool that touches participants needs the same transfer review as Decidim. Map every tool's hosting location, sub-processors and remote support access, including staff in third countries who can view screens. Where a tool sends data to a US provider, assess whether the provider is covered by the Data Privacy Framework list before relying on it. Record the outcome in the same register as the core platform so the transfer file is complete.
How hosting and identity options change the transfer picture
When the body runs Decidim in its own data centre or in a national government cloud, personal data stays under the body's direct control and within the territory it chooses. The main question shifts from the hosting contract to the people who administer the system. Any remote session from a third country, including a vendor engineer viewing a screen during troubleshooting, counts as a transfer under the EDPB's guidance, so support access needs the same scrutiny as storage.
- Storage location: Databases, uploaded files and backups sit on hardware the body controls, so no third-country storage occurs by default.
- Administrator access: Staff and contractors who log in from outside the EEA create transfers, so access paths must be listed and restricted.
- Managed components: Hosted mail relays, object storage or CDN services used by the installation can still send data abroad, so each must be checked separately.
- Vendor support: Any implementation partner who opens remote sessions must work from inside the EEA or under a documented transfer mechanism.
Ask your team to map every administrative path and every external service the installation calls, then record which ones leave the EU.
An EU-headquartered provider hosting in EU-only regions removes the storage transfer and avoids the most direct exposure to foreign jurisdiction. However, the provider's headquarters and staff still matter. Under the EDPB's Example 12, using an EU processor subject to third-country law with extraterritorial effect is not itself a transfer, but complying with a third-country authority request would be. The controller must therefore assess that exposure before engaging the provider.
- Corporate control: Check whether a non-EU parent company can compel the EU subsidiary to disclose data, since parent ownership can carry the same legal reach.
- Support staff location: Engineers in other countries who open sessions on participant data create transfers even when the servers sit in the EU.
- Legal process handling: Ask how the provider responds to foreign warrants, whether it notifies the body, and whether it commits to challenging overbroad requests.
- Sub-processors: Each hosting, backup or monitoring sub-processor may run in another jurisdiction, so the full chain needs to be listed.
- Written answer: Obtain the provider's written position on support access and legal process before signing, and keep it on file for the transfer documentation.
Confirm these points with the provider in writing, since contract language alone does not show where support sessions originate.
When the hosting provider is headquartered outside the EU, the exposure is highest. Under Article 44 of the GDPR, every transfer to a third country, including onward transfers, must meet Chapter V conditions. Storage in a cloud outside the EEA is a transfer, and so is remote access from abroad. The provider may also fall within the reach of the US CLOUD Act, which requires covered providers to preserve or disclose data in their possession, custody or control regardless of location.
- Storage and backups: Any region outside the EEA, including backup replicas, requires a Chapter V mechanism and documented safeguards.
- CLOUD Act reach: Providers within the scope of 18 U.S.C. 2713 can be compelled to disclose data they control, even if it is stored in Europe.
- Recognition limits: Under Article 48, a foreign court order is only recognized in the EU when based on an international agreement, so the body should understand which requests would fall outside that protection.
- Adequacy status: The Data Privacy Framework covers only organizations on its list, and its appeal is pending, so reliance on it carries open risk.
- Supplementary measures: Where the provider needs data in the clear, the EDPB has said it cannot envision an effective technical measure if foreign powers go beyond what is necessary and proportionate.
Before committing, obtain the provider's written answer on support access, legal process and whether it can be compelled to disclose EU-stored data, and have counsel review it.
How an EU sovereignty rollout moves from transfer mapping to go-live
The sequence turns an unmapped set of cross-border data flows into a Decidim platform where participant identities and votes stay under EU jurisdiction, with each step leaving evidence the controller can show an assessor. Each phase has a named output that gates the next one.
Map transfers and inventory vendors
Start by listing every component that touches participant data: the Decidim application, hosting, database backups, mail relay, map tiles, geocoding, analytics, CDN, and each social login provider. For each one, record where data is stored, where it is accessed from (including remote support sessions), and which legal entity operates it. Run the list against the transfer tests in EDPB Guidelines 05/2021 so that remote access and out-of-EEA storage are flagged as transfers. The output is a transfer register with one row per flow and a named owner for each vendor decision.
Decide hosting and identity providers
Choose the hosting location and operating entity, then decide which identity sources are acceptable for verification and login. Where a processor is an EU company subject to non-EU law with extraterritorial reach, assess the exposure to third-country authority requests before signing, since the EDPB guidance treats compliance with such a request as a transfer. Confirm with each provider where its support staff sit and whether its sub-processors are outside the EEA. The output is a signed-off hosting and identity decision record that names the excluded providers.
Select the Decidim version and install
Select a Decidim release that receives security updates at the time of go-live. Based on the supplied facts, the maintained branches are 0.32.x and 0.31.x, and v0.32 requires Ruby 3.4.7 and Node 22.14.x. Install either manually as a Rails application or with Docker, and configure background jobs, file storage, SMTP, and maps. Record the exact version, the operating system, and the PostgreSQL version in the runbook. The output is a staging environment with a documented install and a written update path that states upgrades go one minor version at a time, with a database backup taken before each one.
Configure EU-only providers and remove defaults
Replace every non-EU default with a provider that meets the decision from the second step. Decidim's social login providers for Facebook, Twitter, Google and Decidim-to-Decidim OAuth are configurable globally or per organization, so disable any that send participant data to a non-EU operator and use a custom OmniAuth strategy only where the provider's location has been confirmed. Check the same for maps, geocoding, error tracking, and email. The output is a configuration baseline in version control and a test log showing that no outbound request in a sample session goes to an unapproved host.
Document transfers and retention records
Turn the transfer register into the evidence pack: processing agreements with each EU provider, documented transfer impact assessments for any remaining third-country flow, and a record of the Article 44 analysis for each. Add the retention schedule for identities, verification data, proposals, and votes, which is the part most often missing. Ask counsel to confirm the lawful basis and the handling of political opinions as special category data. The output is an approved transfer and records file that the controller can hand to an auditor or supervisory authority.
Test login and voting flows
Run scripted test scenarios on staging for each path a participant can take: registration, identity verification, login through each enabled provider, proposal submission, voting in a participatory budget, and account deletion. Confirm that each scenario produces only the expected records and network calls, and that votes are stored in the EU environment. Repeat the outbound-request check after every configuration change. The output is a signed test report with pass or fail results and linked defects, and no open item that sends data outside the approved list.
Go live with a patch plan
Before launch, assign an owner for security monitoring and write a patch plan that follows Decidim's disclosure window: implementers have 2 months to apply patches for standard vulnerabilities and 4 months for critical ones before details are disclosed. Subscribe to the security contact and release feed, schedule minor-version upgrades in order, and rehearse a restore from backup. Confirm the support model with the partner in writing. The output is a go-live checklist signed by the controller and a dated patch calendar.
Which evidence a data protection authority or auditor will ask for
This table lists each evidence item an assessor is likely to request for a Decidim deployment that keeps participant data under EU jurisdiction, and the component that produces it. Read each row as a question to answer before launch, with the owner named. DeployOpen prepares this evidence but does not issue audit reports or certifications, which remain the work of independent auditors and certification bodies.
| Evidence item | What it shows | Component that produces it |
|---|---|---|
| Records of processing | Each purpose, data category, recipient and retention period for participation, votes and signatures | Controller's processing register, mapped to each Decidim space and component |
| Transfer impact assessment per service | Whether any external service (maps, geocoding, social login, email) sends personal data to a third country | Service inventory with a written assessment for each non-EU endpoint |
| Sub-processor list and locations | Every provider that touches participant data, with country of storage and access | Hosting contract annex and the integrations register kept by the controller |
| Signed data processing agreements with EU hosts | Contractual terms covering instructions, security, sub-processing and deletion | Contract file held by the controller and the EU hosting provider |
| Configuration exports showing disabled non-EU providers | Social login and map or geocoding providers outside the EU are switched off in production | Decidim organization and social provider settings, exported and dated at each release |
| Network and hosting location records | Data centers, regions and network paths used for application, database and file storage | Infrastructure-as-code state and cloud or data center asset records |
| Access logs for support staff | Who viewed or changed participant data, when, and from which location | Decidim admin and audit records, server access logs and the support provider's access log |
| Backup location records | Where backups of database and uploaded files are stored, encrypted and retained | Backup job configuration and the backup catalog kept by the operator |
| Decidim version and patch record | Installed version, applied security patches and the date each was deployed against the supported minor versions | Deployment change log, Git tags and the upgrade record for each minor version |
What EU bodies ask before self-hosting Decidim for sovereignty
What drives the cost of a sovereign Decidim deployment?
The cost is driven by how many external services you must replace, how much identity integration is needed, the hosting model, and how much compliance evidence you must produce. Each external service that sends data abroad, such as a map tile provider, a geocoding API, an email relay or a social login, needs a European or self-hosted replacement, a configuration change and testing. Identity integration with a government eID, census or SSO system adds analysis and testing time. The hosting model matters too: a body's own data center, a national cloud or a contracted EU provider each carries different operations work. Evidence volume, including transfer assessments, records of processing and data processing agreements, scales with the number of processors and sub-processors. One-time costs include the initial build, migration and assessment. Recurring costs include hosting, security patching, upgrades and staff time. Ask any implementation partner for a quote that lists each replacement service, each integration and each evidence deliverable separately.
How long does a self-hosted Decidim rollout take for an EU public body?
The timeline depends on the agreed scope and on how long internal approvals take, so confirm the duration in a written scope before planning around it. Work typically includes hosting setup, installation, replacement of external services, identity integration, data protection review, accessibility testing and staff training. Approvals from data protection officers, procurement, legal teams and IT security often take longer than the technical build, particularly when a transfer assessment or a processor review is needed. Decidim's own installation and update guidance also requires a database backup and careful version selection before go-live, which adds planning steps. DeployOpen delivers most engagements as fixed-scope work, so scope, deliverables and timelines are agreed in writing before work starts. Ask for a milestone plan that shows which dependencies belong to your body and which belong to the partner.
Can our own staff run a self-hosted Decidim platform without a partner?
Yes, if your team has the operations skills to run a Ruby on Rails application backed by PostgreSQL. Decidim is built on Ruby on Rails and PostgreSQL, and production setups configure background jobs, file storage, SMTP, maps, geocoding and social login. Your staff need to handle installation, secrets, backups, upgrades and security patches. Upgrades must move one minor version at a time and follow each release's instructions, because some releases change database structures. Decidim supports only the last two minor versions with security updates, so the team must plan regular upgrades. Security reports go to the Decidim security contact, and implementers have a grace period to apply patches before details are disclosed, so someone must monitor and act on them. Assess whether you have these skills on call, not only during business hours, before deciding to run the platform internally.
Can we keep social login on a sovereign Decidim site?
You can keep social login only after a documented assessment shows that the data transfers it causes are acceptable, and only with a configured alternative in place. Decidim supports Facebook, Twitter, Google and Decidim-to-Decidim OAuth 2.0 login out of the box, and other OmniAuth strategies can be added as custom providers. Each of these providers receives personal data from participants and sits outside EU control, so each login path can constitute a transfer under Chapter V of the GDPR. The EDPB guidance treats remote access and storage outside the EEA as transfers, so the assessment must cover where the provider processes and stores login data. Most EU bodies disable third-party social login and offer an EU-hosted identity provider, a government eID or an email-based login instead. Confirm the chosen alternative with your data protection officer before launch.
What happens if our body must switch hosting or platform providers later?
Under the EU Data Act, customers have the right to switch from a data processing service to another provider or to on-premises infrastructure, and this right applies to services covered by the Act. The Data Act has applied since 12 September 2025 and sets a maximum two-month notice period and a 30-day transition period. From 12 January 2027, providers may no longer charge switching fees. Those provisions are set out in Articles 25, 29 and 50 of Regulation (EU) 2023/2854. Because you self-host Decidim, the practical switching risk sits mainly in your own contracts, exported data and documentation. Ask any hosting or implementation provider to confirm in writing how they will export databases, uploaded files, configuration and logs, and how they will support a move to another provider or to your own data center. Check with legal counsel whether the Data Act applies to each specific contract.
Which parts of the platform does a sovereignty review usually cover?
A sovereignty review covers every service that receives personal data from the platform, not only the core application. Typical items include the hosting location and any remote administrative access, email delivery, map and geocoding providers, analytics, error monitoring, content delivery, backups, identity providers and file storage. For each item, you need to know where data is stored, where it can be viewed, which legal entity controls the processor and whether any third-country authority could demand access. GDPR Article 44 applies to onward transfers as well as direct ones, so subcontractors must be included. The EDPB has noted that using an EU processor subject to third-country law with extraterritorial effect is not itself a transfer, but complying with a third-country request would be, so that exposure must be assessed before you engage the processor. Ask your partner for a service inventory with data flows as the first deliverable.
What transfer documentation should we expect from a self-hosting engagement?
You should expect a set of documents that show your body understood each transfer, chose safeguards and can prove it later. These usually include a register of processing activities, a data flow inventory, transfer impact assessments for any third-country service, data processing agreements with each processor and sub-processor, and records of the technical and organizational measures applied. The Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 are one transfer tool, and the EDPB Recommendations 01/2020 explain how supplementary measures are assessed. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications, and independent auditors or certification bodies make those determinations. Ask partners to list each document they will produce and who signs it off.
What to ask an implementation partner before signing
Ask first which Decidim minor version the partner will deploy and how long they commit to patching it. Decidim supports only the last two minor versions with security updates until version 1.0, which currently means 0.32.x and 0.31.x, so a partner who installs 0.30 or older is handing you an unpatched platform. Ask for the upgrade plan too: Decidim's update guide requires moving one minor version at a time and backing up the database first, so the partner should name who runs those steps, in which environment, and how the EU-hosted backups are tested. Ask them to show how they track the security disclosure windows in Decidim's SECURITY.md, including the grace periods for standard and critical vulnerabilities, and who in their team receives reports from security@decidim.org.
Ask where every component physically sits, in writing, by service: the Rails application, the PostgreSQL database, ActiveStorage files, background job workers, SMTP relay, map tiles, geocoding, and every backup copy and log store. Each line should name the provider, the legal entity, the region and the country of the data centre. Then ask how remote support access works. Under EDPB Guidelines 05/2021, remote access from a third country, even only displaying data on a screen, is a transfer, so a partner whose engineers sit outside the EU and log in to view participant records is creating a transfer you must document. Require named access controls, a justification process for each session, session recording, and a commitment to use EU-based engineers for production access. Ask whether the partner's own parent company or cloud provider is subject to third-country access laws, such as the US CLOUD Act at 18 U.S.C. 2713, and what they will do if a foreign authority requests data.
What must be kept current after go-live
This sequence keeps the platform patched, the transfer position documented and the exit route open for as long as participant identities and votes sit under EU jurisdiction. Each step produces a dated record that an auditor or data protection authority can check.
Track Decidim security releases and advisories
The platform owner watches the Decidim releases page and the security advisories for the branches in use, currently 0.32.x and 0.31.x, since older branches receive no security updates. Your team subscribes to the reporting channel listed in the project's security policy and records each advisory against your running version. Done means every advisory affecting your version has a ticket with an assigned owner and a target date set inside the grace period that applies to its severity.
Apply patches inside the disclosure grace periods
The implementer applies security patches in a staging copy first, runs the regression tests for participation flows such as voting, signature collection and authorization, and then promotes the change to production. Decidim's security policy gives implementers 2 months for standard vulnerabilities and 4 months for critical ones before details are disclosed, so these windows set the deadline. Done means a signed-off change record shows the patch version, the test results and the production date for each advisory.
Plan minor version upgrades one step at a time
Before a new minor release is adopted, the platform team reads its upgrade instructions and confirms the path, because Decidim's update guidance requires moving one minor version at a time and says some releases change database structures. The team takes a verified database backup, rehearses the upgrade on a copy of production and checks custom themes and integrations. Done means a rehearsal log exists and the production runbook names the backup and rollback point.
Review the Data Privacy Framework status and vendor exposure
The data protection lead checks the status of the EU-US Data Privacy Framework and the pending appeal in Case C-703/25 P at least as often as the transfer register is reviewed, and records any change. The lead also re-reads each provider's contract and sub-processor list for changes in its legal exposure to third-country authorities, such as a change of parent company or new hosting regions. Done means the transfer register carries a dated review entry for each provider, with a decision to keep, change or replace it.
Reassess transfer risk on every new integration
Before any new integration goes live, such as a new map tile provider, geocoding service, SMS gateway, social login or analytics script, the data protection lead completes a transfer assessment covering what data leaves the EU, whether remote access from outside the EEA occurs, and whether the provider is subject to third-country access laws. The assessment follows the EDPB guidance on transfers and supplementary measures. Done means the integration is blocked in configuration until the assessment is signed and filed.
Maintain the Data Act switching plan
The platform owner keeps a written switching plan current, covering the export formats for proposals, votes, census data and attachments, the target on-premises or alternative provider, and the named contacts on both sides. The Data Act gives customers the right to switch to another provider or on-premises infrastructure, with a maximum two-month notice period and a 30-day transition, so the plan should state how those periods would be met. Done means the plan is reviewed on a set schedule and a test export has been restored to a separate environment.
Confirm the switching plan against the hosting contract
The procurement and legal lead checks that the hosting and support contracts allow data export on request, do not impose switching charges that conflict with the Data Act's ban effective from 12 January 2027, and name the notice and transition terms in writing. Where a provider is an EU processor, the lead confirms it can refuse or challenge third-country disclosure requests as the contract requires. Done means the contract review is filed with the switching plan and any gaps have an agreed remediation.
Record the evidence for each review cycle
The compliance lead gathers the patch log, upgrade rehearsals, transfer register entries, integration assessments and switching plan reviews into one evidence pack for each cycle. The pack is shared with the data protection officer and any independent auditor on request, and it shows gaps and how they were closed. Done means the pack is complete for the cycle and its open items have owners, which is the input for the next governance meeting.
How DeployOpen scopes and runs an EU-sovereign Decidim build
DeployOpen is a Chainscore Labs company that plans, implements, hardens, backs up, upgrades and documents self-hosted open-source platforms inside the client's own infrastructure, whether that is an EU cloud account, a national data center or an air-gapped network. For a Decidim build where participant identities and votes must stay under EU jurisdiction, the work starts with a transfer and service inventory that lists every component that touches personal data: the Decidim application, PostgreSQL, ActiveStorage file storage, SMTP relay, map tiles, geocoding, error tracking, backups and each OmniAuth login provider. For each one, the inventory records where data is stored, where remote access happens, which legal entity operates it and whether a third-country support path exists. That inventory is delivered first because the scope, hosting choice and contract terms all depend on it.
Scope is agreed in writing before work starts. Most engagements are fixed-scope, so the written scope should name the environment, the services to be replaced or self-hosted, the custom integrations, the test and acceptance criteria, and the handover items such as runbooks and restore tests. Ask for each deliverable to be tied to a named component in the inventory. DeployOpen prepares systems, configuration, records and evidence for compliance assessments, including data flow diagrams, transfer assessments and the technical settings behind them. It does not issue audit reports, certifications or attestations. Those come from independent auditors, certification bodies or your data protection officer and legal team, so confirm early who signs each document.
Ongoing support, Decidim upgrades and security testing are available as retainers rather than bundled into the build. Decidim supports only its last two minor versions with security updates before version 1.0, so plan for a recurring upgrade cycle, and confirm with the implementation partner who applies patches inside the grace periods set in Decidim's security policy. Retainers should also cover periodic restore tests and review of any new third-party login or map provider added after launch, since each new service can change the transfer inventory. DeployOpen does not publish a price list, so ask for a quote built from the written scope and separate the one-time build from recurring support in it.
