Why marketing automation for EU data sovereignty needs its own build
Self-hosted Mautic in EU hosting can keep marketing data under EU control, but only if hosting, tracking, sending and vendor access are designed together. Many European organizations hold their contact database, consent history and web tracking with US SaaS vendors, and moving those records is rarely a single switch. The transfer rules under GDPR Article 44 turn on where personal data is stored and who can reach it remotely, not only on where the company is headquartered. EDPB Guidelines 05/2021 state that remote access from a third country, even just displaying data on a screen for support, counts as a transfer, and so does storage in a cloud outside the EEA. A database hosted in Frankfurt but administered from a support desk abroad can therefore still create a transfer that needs a legal basis.
The platform answer is short. Mautic is the open source marketing automation option covered on this page, licensed under GPL-3.0, with no paid edition of the software itself. What you pay for is the hosting, the sending service, the implementation and the administration, so the sovereignty question moves from a vendor contract into your own architecture. Each component needs a named owner: the hosting location and admin access, the tracking domain and scripts on your sites, the mail sending path and its bounce handling, and the contract and access terms of every subprocessor. Confirm with your counsel which of these you control directly and which a third party can reach, because that map decides where the EU boundary really sits.
The first decision is an inventory of every place marketing data flows today, including tracking scripts, form plugins, CRM connectors and email relays that may be installed by someone outside the marketing team. Then ask who in each vendor chain can read data in the clear, and under which foreign legal powers. EDPB Recommendations 01/2020 note that where a provider needs data in the clear and foreign authority powers exceed what is necessary and proportionate, no effective technical supplementary measure may exist, so that exposure has to be assessed before you engage the processor. Treat this assessment as a deliverable with a written owner, not a footnote in the migration plan.
Which transfer and consent rules shape the marketing stack
This table maps each transfer, access and consent rule to its source and to what it means for where Mautic, its database, tracking and sending services can run. Read it as a checklist of questions to settle before hosting decisions are made, because a single US-controlled sub-processor can bring several rows into play at once. The main takeaway is that EU hosting alone does not settle the question: access by non-EU parties and the legal reach of each provider need to be assessed.
| Requirement | Source | What it means for the build |
|---|---|---|
| Transfers to third countries, including onward transfers | GDPR Article 44 | Every hop of contact, event and log data to a non-EEA party must meet Chapter V conditions. Map sub-processors, not only the primary host. Infringements of Articles 44 to 49 carry fines of up to EUR 20 million or 4% of worldwide annual turnover (Article 83(5)(c)). |
| Remote access and storage outside the EEA | EDPB Guidelines 05/2021 (version 2.0) | Support staff in a third country viewing a contact database counts as a transfer, even without download. Cloud storage outside the EEA also counts. Restrict admin and support access paths in the design. |
| Processors subject to third-country law | EDPB Guidelines 05/2021, Example 12 | Using an EU processor that is subject to extraterritorial third-country law is not itself a transfer, but complying with a third-country request would be. Assess this exposure before engaging the processor. |
| Data Privacy Framework and Schrems II | CJEU Case C-311/18; Decision (EU) 2023/1795; Case C-703/25 P | Privacy Shield was invalidated in 2020 while standard contractual clauses survived. The DPF adequacy finding covers only US organizations on the DPF List and is under appeal (C-703/25 P). Confirm each US vendor's DPF status and keep a clause-based fallback. |
| CLOUD Act exposure | 18 U.S.C. 2713 | US providers must preserve or disclose data in their possession, custody or control, wherever it sits. Hosting in the EU does not remove this exposure for a US-controlled provider. Ask vendors how they respond to such requests. |
| Government access requests and international agreements | GDPR Article 48 | A third-country court or agency order to disclose personal data is enforceable in the EU only under an international agreement such as a mutual legal assistance treaty. Record which vendor contracts address this and how requests are handled. |
| Technical measures against cloud access in the clear | EDPB Recommendations 01/2020 (version 2.0) | Where a provider must see data in plain text and destination powers go beyond what is necessary and proportionate, the EDPB cannot envision an effective technical supplementary measure. Prefer designs where the sending or tracking provider never holds readable data. |
| Switching and non-personal data access | Data Act Articles 25, 29, 32 and 50; Regulation (EU) 2023/2854 | Customers gain switching rights, with switching charges banned from 12 January 2027. Providers must guard against third-country access to non-personal data held in the Union. Confirm these terms in any hosting or sending contract. |
Which marketing data and tracking paths leave the EU
The controller has to map every path marketing data takes before choosing a host, because each path is a potential transfer or access event. A self-hosted Mautic instance in an EU data center does not make the stack sovereign on its own. Walk the flows in order: contacts and segments in the Mautic database, form submissions and landing page tracking, third-party scripts loaded on pages, CRM sync, email sent through an external relay, and support access by a vendor. Record for each one the data categories, the legal entity that processes or receives the data, the country where it is stored or viewed, and the lawful basis or consent record that covers it.
Two of these paths are easy to miss. Third-party scripts on landing pages send visitor data to the script provider's servers in the browser, so the transfer happens before any data reaches your database. Vendor support access is the other: EDPB Guidelines 05/2021 (version 2.0) treat remote access from a third country as a transfer even when the person only views data on a screen for support or administration. Ask every vendor, including your hosting provider and any managed Mautic operator, where their support staff sit, which subprocessors can reach the environment, and whether access is logged and approved per session.
The map is the input to the hosting decision, not a document for the file. For each row, decide whether the flow stays in the EU, moves under a documented transfer mechanism, or is removed. Replace US-hosted scripts with first-party tracking served from your own domain where your analysis allows it, and confirm the consent banner gates the scripts that remain. Confirm with the relay operator where transactional and campaign mail is processed and stored, and with the CRM vendor where synced records are held. Where a path cannot be moved or removed, the controller should document the exposure before signing, as the EDPB guidance expects for processors subject to third-country law.
Which open source platforms fit an EU-controlled marketing stack
An EU-controlled marketing stack depends on two decisions: which open-source tool runs the contacts, consent records and campaigns, and who operates the servers it runs on. The cards below cover the core platform, the adjacent sending tools handled on sibling pages, and the hosting choice that determines whether personal data stays under EU control.
Mautic as the marketing automation core
Mautic is the open-source marketing automation platform this topic assumes. It is written in PHP on the Symfony framework and licensed under GPL-3.0, so the code can be inspected and self-hosted inside infrastructure your organization controls. Version 7.2.1 was published on September 23, 2026. Version 7.3 is planned as the long-term support release with security support through December 31, 2027, which matters for a platform holding years of consent records. Check the PHP, database and cron requirements before sizing servers, and confirm which release your upgrade plan targets.
Adjacent sending tools
Some EU teams send newsletters or transactional email through other open-source tools, such as listmonk or Dittofeed, rather than through Mautic campaigns. Those choices change where sending infrastructure, bounce handling and suppression data live, so they are covered on the self-hosted email newsletters hub and its sibling pages rather than here. If you split sending from segmentation, confirm that consent status and unsubscribes sync back to the core platform in both directions.
EU hosting provider or managed Mautic
The hosting decision determines who can reach personal data at the infrastructure layer. Self-hosting on an EU cloud region or data center under your own administration keeps operators under your contracts. A managed Mautic service may reduce administration work but adds a processor, and that processor may be subject to non-EU law. Before you sign, ask the provider where backups, logs and support sessions are stored and whether remote administration can be performed from a third country. Confirm the provider's own third-country access exposure in writing, since that exposure, not the server location alone, determines the transfer risk.
Mautic licensing and vendor services
Mautic has no paid edition of the software itself, so license cost does not drive the choice. Separately promoted managed Mautic and hosting services are offered by vendors and partners who are not the same as the project. Ask any provider whether it is the Mautic project, a hosting company that deploys Mautic, or a reseller. Confirm the scope of any support contract, the version it covers and who holds administrator access to the database and mail configuration.
How hosting choices change transfer exposure
Your organization runs Mautic on a virtual private server or dedicated server in an EU region of a cloud account that you control, or in a data center you lease. Your staff, or a partner working under your direction, hold root and database access, so the list of people who can view personal data in the clear is short and known. Mautic should not run on shared hosting, so the baseline is a VPS or dedicated server sized for your contact volume and cron workload.
- Administrative access: Your own administrators hold operating system, database and application credentials. Any partner access is granted per task, logged and removed afterward.
- Provider exposure: The cloud provider still operates the physical and hypervisor layer. If its parent company is US-headquartered, assess whether it could be compelled under the CLOUD Act to produce data it controls, as described in EDPB Guidelines 05/2021, Example 12.
- Support access: Confirm whether the provider's support staff can access your instances, disks or backups, and from which countries.
- Encryption and key custody: Ask whether you can hold the encryption keys so the provider cannot read stored data without your involvement.
- Contract terms: Request data processing terms, sub-processor lists, data location commitments and a notice obligation for government access requests.
Before signing, ask the provider for its written position on government access requests and whether its parent company's jurisdiction could reach your data.
An EU-headquartered managed Mautic provider operates the platform for you in EU data centers, typically under its own tenancy model. The main question is no longer where the hardware sits but who employs the administrators, which legal entities own the infrastructure and whether any of them are subject to non-EU law with extraterritorial reach. An EU operator avoids direct CLOUD Act reach at the company level, but its own upstream providers may still be US-owned, so the sub-processor chain needs review.
- Administrative access: The provider's engineers hold privileged access. Ask for the list of roles, the countries where staff sit and whether any administrator works from outside the EEA.
- Remote access: Under EDPB Guidelines 05/2021, remote access from a third country counts as a transfer, even when staff only view a screen, so support sessions from abroad must be scoped.
- Sub-processors: Map every hosting, backup, email and monitoring provider below the operator and check each one's headquarters and access model.
- Access controls: Require named accounts, multi-factor authentication, privileged access logging and documented break-glass procedures.
- Contract terms: Ask for standard contractual clauses where any transfer occurs, a documented transfer impact assessment and a commitment to challenge overbroad government requests.
Ask the provider to show its access logs and sub-processor register before you accept its transfer position.
A US-headquartered managed provider may host Mautic in EU regions while the parent company, support organization or tooling remains in the United States. Storing data in an EU region does not by itself end the question, because the CLOUD Act reaches data in a provider's possession, custody or control regardless of location. This is the scenario where the EDPB's Example 12 analysis matters most: you must assess whether complying with a US authority request would amount to a transfer, and whether your supplementary measures can actually prevent access.
- Administrative access: Identify which administrators are in the United States or hold US citizenship, and whether follow-the-sun support reaches your environment from outside the EEA.
- Government access exposure: Under 18 U.S.C. 2713, the provider may have to preserve or disclose data it controls. Recognition of foreign judgments under GDPR Article 48 requires a qualifying international agreement, which does not cover every request.
- Frameworks: Check whether the operator is on the Data Privacy Framework List, and monitor the pending appeal in Case C-703/25 P before relying on it.
- Technical measures: Where the provider needs data in the clear, EDPB Recommendations 01/2020 state that an effective technical supplementary measure may not exist. Customer-managed keys are necessary but may not be sufficient.
- Contract terms: Ask for a commitment to challenge disclosure requests, notification where legally permitted and a documented assessment you can give your supervisory authority.
Confirm the exposure with qualified counsel before approving this model for special categories of data or regulated segments.
How a sovereign Mautic rollout runs in phases
The sequence moves from mapping what personal data flows where to a tested, supported Mautic instance whose hosting, consent records, tracking, sending and erasure handling can be shown to a regulator, an auditor or a board. Each step ends with a named output that the next step depends on.
Map data flows and transfers
Inventory every place marketing personal data goes: forms, landing pages, the CRM, analytics scripts, the email sending service, backups and support access. For each flow, record the data categories, the purpose, the legal basis, and whether any third country can reach the data, including remote access from outside the EEA. Output: a signed data and transfer map that names every processor and sub-processor, with the transfers that remain to be justified or removed.
Decide hosting and access controls
Choose the EU hosting location, the operating company behind the infrastructure, and who holds administrative and support access to servers, databases and backups. Assess whether any provider with a non-EU parent could be compelled to disclose data, because EDPB guidance treats compliance with such a request as a transfer. Output: a written hosting decision with access lists, key custody arrangements and a documented assessment of foreign legal exposure, which the controller reviews before any data is loaded.
Design the consent model and records
Define the lawful basis for each campaign type, the consent wording and opt-in method, the preference options, and what a consent record must hold: who consented, when, to what text, through which form and how it was withdrawn. Map these fields to Mautic contact fields and custom data, and decide how objections to direct marketing are honored across all channels. Output: an approved consent specification and a test showing that a record can be reproduced for a single contact.
Set up first-party tracking
Replace third-party marketing scripts with tracking served from your own domain, limited to the events the consent model allows. Confirm that no tag loads before the required consent is given, that cookies are set from your domain, and that the tracking endpoint writes only to infrastructure in your hosting decision. Confirm the exact tracking capabilities for your Mautic version with your implementation partner before you commit to a design. Output: a tag inventory with consent gating and a browser test log showing that no undeclared third-party request fires.
Build the EU sending domain and infrastructure
Configure a sending domain you control, with SPF, DKIM and DMARC records published and bounce and complaint handling connected to Mautic. Select an EU-hosted sending service or self-hosted relay consistent with the transfer map, and confirm that its logs, retention and sub-processors match the documented decision. Output: passing authentication checks for the sending domain, a verified bounce and complaint loop, and a written statement of where message content and recipient addresses are processed.
Configure cron jobs and queue workers
Install Mautic on a dedicated server or VPS as the project recommends, then schedule the cron jobs for segment updates, campaign updates and campaign triggers, staggered so they do not compete for resources. Run the broadcasts command for segment emails and start the messenger consumer whenever email is queued. Output: a documented schedule, a monitored queue with alerts for backlog and failed jobs, and a load test that shows campaigns run on time at the expected contact volume.
Migrate contacts and carry over suppression lists
Import contacts only where the data map allows it, mapping consent fields so each record keeps its original consent status and source. Load suppression and unsubscribe lists before any campaign is activated, so contacts who previously withdrew or objected are never mailed again. Reconcile record counts against the source system and keep the import log. Output: a reconciliation report showing matching totals, zero suppressed contacts in active segments, and a retained copy of the import records.
Test erasure requests end to end
Run erasure and access request scenarios across Mautic, the CRM, the sending service, analytics, logs and backups. Verify that a deleted contact is removed from active data, that suppression is kept only as far as needed to honor the objection, and that backup restore procedures do not silently reintroduce erased records. Document the request handling steps and the time each system takes to act. Output: a tested erasure runbook with evidence from each system, signed off by the controller.
Establish a supported upgrade path
Select the Mautic release line that matches your operating schedule, using the published security support dates for each version, and plan upgrades ahead of those dates. Confirm the PHP and database versions required by the chosen release and test upgrades in a staging copy before production. Output: a written upgrade calendar tied to Mautic's published support dates, a tested rollback procedure, and a named owner for each upgrade, so the instance does not run on an unsupported release.
What a data protection review will ask to see
This table lists the evidence a data protection authority, internal privacy team or independent assessor is likely to request for a self-hosted Mautic instance, what each item proves and which component produces it. Use it to check whether your setup can answer the questions before a review starts. DeployOpen prepares this evidence, but independent auditors and regulators assess it.
| Evidence item | What it proves | Which component produces it |
|---|---|---|
| Transfer map and records of processing | Where contact and tracking data is stored and processed, and whether any transfer to a third country occurs, including remote administrator access | Data flow documentation, hosting and sub-processor inventory, and administrator access records maintained by the implementation team |
| Hosting location and access log for the Mautic instance | The servers, backups and sending infrastructure sit in the agreed EU locations, and who accessed them and when | Cloud or data center account configuration, Mautic and operating system audit logs, and infrastructure access logs |
| Consent records with timestamp and source | Each contact's consent or opt-in, when it was given and through which form, landing page or import | Mautic contact timeline and form submission records, plus the source field and import files kept for each list |
| Withdrawal and objection handling logs | Unsubscribes, withdrawals of consent and objections to direct marketing were recorded and honored across all segments and campaigns | Mautic contact history and suppression entries, with campaign send logs showing no later sends to suppressed contacts |
| Erasure request log | Erasure requests were received, verified, carried out in Mautic and connected systems, and confirmed to the requester | Ticket records from the request process, Mautic contact deletion or anonymization records, and backup retention rules |
| Processor contracts and standard contractual clauses under Decision 2021/914 | Each processor and sub-processor is bound by written terms, and any third-country transfer relies on the correct transfer tool | Signed data processing agreements, the module of the clauses used, and the sub-processor list kept with the contract file |
| DPIA inputs | The risks to individuals were identified and the controls that reduce them are documented for the data protection impact assessment | Data inventory, tracking and cookie inventory, retention settings and the list of safeguards configured in the instance |
| Upgrade records | The instance runs a supported Mautic release and PHP version, and changes were tested and approved before deployment | Change tickets, staging test results, release notes applied and the version history of the production instance |
What buyers ask before moving marketing data to EU hosting
Does self-hosting Mautic in the EU remove the transfer question entirely?
No. Hosting Mautic in the EU does not by itself end the transfer question. EDPB Guidelines 05/2021 (version 2.0) state that remote access from a third country, even only displaying data on a screen for support or administration, is a transfer, and so is storage in a cloud outside the EEA. If your vendors, support staff or backup providers can reach the data from outside the EEA, or store copies there, you still need a Chapter V basis. Map every place the data is stored, administered and accessed, including sending services and CRM connectors. Article 44 of the GDPR applies to onward transfers as well, so the sub-processor chain matters.
What drives the cost and effort of moving marketing data to EU hosting?
Cost comes from several separate components, and only some of them are one-time. Recurring items include EU servers or a managed hosting contract, an email sending service that keeps sending infrastructure in the EU, and internal or contracted administration. One-time items include migration of contacts and history, CRM integration, consent model redesign and legal review. Mautic itself has no paid edition, so the software line is zero, but the other components are not. Ask any partner for a written scope that lists each component, who pays for it, which items recur and which assumptions drive the number, such as contact volume, number of CRM connections and campaign complexity.
How long does a migration to EU-hosted Mautic take, and what depends on contact volume?
The duration depends mostly on the state of the existing data and the number of integrations, not on the software alone. Contact volume matters because imports, deduplication, consent field mapping and segment rebuilds all scale with the number of records. Cron throughput also matters: Mautic depends on cron jobs for segment updates, campaign updates and campaign triggers, and the docs say these should be staggered, so a larger database needs more capacity to process them on schedule. Ask for a timeline tied to a written data inventory, a test migration and a cutover plan, and confirm which parts are fixed-scope before work starts.
Can our internal marketing and IT team run EU-hosted Mautic on their own?
Some teams can, but the question is less about the software and more about operating capacity. Running Mautic requires a VPS or dedicated server, because the project states it should not be installed on shared hosting, plus a database, a web server, PHP within the supported range, and a working cron and messenger setup for email queues. Someone must also apply patch releases, plan minor and major upgrades, and track security support dates for each version. Assess your team against those tasks. Where capacity is thin, a fixed-scope implementation followed by a support retainer can cover setup and upgrades while your staff keep control of campaigns.
What does the work need from legal, privacy and IT teams?
Legal and privacy teams own the lawful basis, consent wording, transfer assessments and the records of processing and consent. IT and security teams own hosting location, access control, network paths, backups, logging and vendor access. Both need to agree on the data map before the build starts. Legal should review every processor and sub-processor, including any support access from outside the EEA, and should assess the exposure described in EDPB Guidelines 05/2021 (Example 12) for any EU processor subject to third-country law. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports or certifications, so independent assessors remain necessary.
Does the EU-US Data Privacy Framework make the decision simpler?
It may help, but the position is uncertain and should not be the only basis for the decision. Commission Implementing Decision (EU) 2023/1795 finds adequate protection only for US organizations on the Data Privacy Framework List, and an appeal against the General Court's September 2025 judgment upholding it is pending as Case C-703/25 P. If that appeal succeeds, the basis could change. Standard contractual clauses under Commission Implementing Decision (EU) 2021/914 are a separate tool, and US providers may also be subject to the CLOUD Act under 18 U.S.C. 2713. Ask your counsel to document a fallback position and to review the status of the appeal before relying on any single transfer mechanism.
How are erasure requests handled across the CRM, sending service and backups?
An erasure request must reach every copy of the contact, which usually means the Mautic database, any CRM connected through sync, the sending service's suppression and log data, analytics tools and exports. Backups are the hardest part: most teams document that deleted records remain in backups until those backups expire, and they restrict restoration so erased contacts are not reinstated. Confirm with your privacy team how long backups are retained and how restores are handled. Ask a partner to show the deletion procedure for each system, the test you run to confirm erasure and the log that records each request.
Questions to put to an implementation partner on EU hosting
Start with access, because it decides whether the hosting is EU-controlled in practice. Ask the partner to list every person and service account that can reach the Mautic servers, the database, the object storage and the mail relay, with the country each person works from and the legal entity that employs them. Remote access from a third country counts as a transfer under the EDPB guidance, even when someone only views data on a screen for support, so the answer should cover administration and emergency support as well as day-to-day operations. Ask who holds the cloud root or hypervisor credentials, how those are stored, and whether any vendor support tooling sends telemetry or logs outside the EU. Ask for the transfer map in writing, covering every system and every sub-processor, before any quote is issued.
Next, ask where backups, logs and replicas live and who can restore them. Backups often sit in a different region or with a different provider than the primary database, and a restore from a non-EU bucket is a transfer in its own right. Ask which region each backup target uses, how encryption keys are held and by whom, how long web server, PHP and cron logs are kept, and whether tracking events that reach the server are written to any log in plain text. On sending, ask how the partner will set SPF, DKIM and DMARC for your sending domain, which EU-based relay or sending service they will use, and where the bounce and complaint data is stored. Ask the partner to show the DNS records and the sending service's processing location before go-live, not after.
Finally, ask how consent and erasure are proven across Mautic and every connected system, such as the CRM, the ad platform and the data warehouse. A good answer names the contact fields and consent history Mautic records, how a withdrawal or erasure request propagates to each connected system, and who checks that it did. Ask how cron jobs and the messenger worker are sized and staggered for your volume, since segment, campaign and broadcast jobs that run late can send a message after a contact has withdrawn. On upgrades, ask how the partner maps Mautic's monthly patches, quarterly minor releases and two-year major releases against the security support dates in the release table, and which version the platform will run when the current support window closes. Request the written scope, the transfer map and the upgrade plan together before comparing quotes.
