EU data sovereignty for document management

Why EU data sovereignty changes open source document management

Self-hosting Paperless-ngx or Alfresco Community Edition in an EU data center settles where the scanned contracts, HR files and case documents sit and who can reach the servers day to day, but it does not settle every legal exposure. An EU organization still has to ask whether a foreign authority could compel the company, or a provider it depends on, to hand over that content. That question is about who can compel access, not only where the disks are located. A server in Frankfurt operated by a company or administrator subject to a non-EU legal order can carry the same exposure as a US-hosted repository.

The GDPR treats a transfer as more than a copy across a border. The EDPB Guidelines 05/2021 (version 2.0) state that remote access from a third country, even only displaying data on a screen for support or administration, is a transfer, and so is storage in a cloud outside the EEA. Support engineers, vendors with remote maintenance sessions and backup providers therefore belong in the sovereignty scope alongside the hosting location. Under the same guidelines, using an EU processor subject to third-country law with extraterritorial effect is not itself a transfer, but complying with a third-country authority request would be, so the controller should assess that exposure before engaging the processor. Confirm with your counsel which of your administrators, support contracts and backup services fall into that category.

The platform choice follows from that analysis. Paperless-ngx and Alfresco Community Edition both run on infrastructure you control, which gives you the decisions on storage, keys, access roles and logging. DeployOpen plans, implements, hardens and documents that deployment inside your EU environment, and prepares the controls and evidence an assessor will ask for. DeployOpen does not issue audit reports, attestations or certifications; independent auditors and certification bodies do.

Which GDPR and sovereignty requirements shape the document build

This table maps each GDPR or sovereignty requirement to the design decision it forces on a self-hosted document archive. Read each row as a question to answer in your architecture before choosing hosting, key management and support access. The main takeaway is that EU hosting alone does not settle sovereignty: remote viewing, support access, key custody and exit terms all count as transfers or dependencies.

Requirement	What it means for the build	Evidence an assessor will ask for
Article 44 transfer conditions	Map every location where archive data is stored, replicated, backed up or displayed, including vendor support tools and monitoring. Any third-country step needs a Chapter V basis.	Data flow diagram, list of storage and backup locations, transfer assessment per destination
Remote access from third countries	EDPB Guidelines 05/2021 treat even screen viewing for support or administration from a third country as a transfer. Restrict administrator and vendor sessions to approved locations and log them.	Access matrix by location, jump host configuration, session logs for vendor access
Cloud storage outside the EEA	EDPB Guidelines 05/2021 treat storage in a cloud outside the EEA as a transfer. Object storage, backup targets and disaster recovery sites must all sit inside the EEA or be covered by a transfer basis.	Region settings for storage and backup, provider contract with data location clauses
Article 48 limits on foreign disclosure orders	A third-country court or agency order to disclose personal data is enforceable in the EU only under an international agreement such as a mutual legal assistance treaty. Design so the operator cannot quietly hand over plaintext.	Documented response procedure, legal review of processor terms, records of any government request
US CLOUD Act reach	18 U.S.C. 2713 applies to US providers regardless of where data sits. Assess whether a hosting provider, support vendor or SaaS parent is US-controlled before giving it access or keys.	Ownership and jurisdiction review of each processor and subprocessor, exposure assessment recorded before engagement
Key custody and encryption	Keys held by a provider under foreign control weaken the sovereignty position. Keep key generation and storage under your control, and confirm that Paperless-ngx or Alfresco data at rest is encrypted with keys you hold.	Key management policy, key location and custodian list, encryption configuration evidence
Support access controls	Vendor and implementation partner access should be time-limited, approved per ticket, performed from inside the EEA, and recorded. Confirm whether any support tooling sends archive content or metadata outside the EEA.	Support access procedure, approval records, audit logs showing who viewed which documents
Data Act Article 32 and switching rights	Article 32 of Regulation (EU) 2023/2854 asks providers to prevent unlawful third-country access to non-personal data in the EU. The Data Act gives customers switching rights, so keep export formats, metadata and retention records portable.	Provider switching terms, export test results, exit plan with named data formats
Exit planning and retention	Plan how archives leave the platform with content, metadata, audit history and retention status intact, and how erasure requests are carried out across backups within agreed periods.	Tested export and restore runbook, erasure procedure covering backups, retention schedule mapped to records

Where US jurisdiction reaches an EU-hosted archive

Hosting a document archive in an EU data center does not, on its own, take it outside the reach of US law. The question that matters is who can access the data and under which legal authority. The US CLOUD Act, added as 18 U.S.C. 2713 on 23 March 2018, requires electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control, whether that data sits inside or outside the United States. If a US-headquartered vendor, a US parent company or a support engineer with US-law obligations can reach your Paperless-ngx or Alfresco data, the location of the server alone does not settle the exposure. Remote access counts too: the EDPB Guidelines 05/2021 treat remote access from a third country, even display-only support access, as a transfer under Chapter V of the GDPR.

The legal basis for transfers to the United States is also less settled than it looks. On 16 July 2020, in Case C-311/18 (Schrems II), the Court of Justice invalidated the EU-US Privacy Shield adequacy decision while holding that standard contractual clauses remained valid. The current adequacy finding, Commission Implementing Decision (EU) 2023/1795, covers only US organizations on the Data Privacy Framework List, and an appeal against the General Court's September 2025 judgment upholding it is pending as Case C-703/25 P. Confirm with your counsel whether your hosting provider is on that list and how the pending appeal affects your transfer assessment. Do not treat the framework as a permanent answer. Also note that GDPR Article 48 limits when a third-country disclosure order is recognized in the EU, which matters when a US authority requests your data directly from a vendor.

Where the provider must access data in the clear and the destination's public authority powers go beyond what is necessary and proportionate, the EDPB Recommendations 01/2020 state that it cannot envision an effective technical supplementary measure. In practice, encryption with keys held only by you may not resolve the problem if the provider operates the service and can read the data. Ask your hosting or support partner to document who holds administrative and key access, where support sessions originate, and what contractual commitments exist on challenging government requests. Put that analysis to counsel and your data protection officer before you choose a platform or a support model, and record their conclusion in your transfer impact assessment. This section does not provide a legal conclusion on your exposure.

Which self-hosted platforms fit an EU sovereignty brief

The archive platform choice comes first, because it holds the personal data and retention records that a sovereignty brief is about. The office, collaboration and mail components around it only keep the archive under EU jurisdiction if they run in the same jurisdiction and under the same operator controls.

Paperless-ngx for scanned intake

Paperless-ngx fits when the core need is scanned intake, OCR, tagging and search over incoming post, invoices, contracts and forms. It is a focused archive rather than a content repository, so retention and erasure rules must be designed around its tags, correspondents and document types. Check how deletion propagates to backups, thumbnails and OCR text, and confirm the licence and current release with the project before you commit.

Alfresco Community Edition for repositories

Alfresco Community Edition fits when the need is a broader content repository with workflows, folder hierarchies and metadata models across several departments. Retention schedules and erasure steps have to be modelled in the platform and tested against your records policy. Confirm with the vendor which capabilities are included in the Community Edition and which need a commercial edition, because the features your records and retention design depends on may differ between them.

Choosing between scanned intake and repository

The decision turns on who creates records and how they are found. A capture-first team with mostly scanned or emailed inputs usually needs less workflow machinery than a team managing controlled content through approvals. Map your top ten document flows to one platform before selecting, and record which flows need erasure on request under GDPR Article 17 and which need preservation for a fixed period.

Nextcloud and Seafile around the archive

Nextcloud Server is licensed under AGPL-3.0 and Seafile under GPLv2 with an additional OpenSSL linking permission. Either can serve as a file layer beside the archive, but files synced to laptops and shared externally create copies outside the archive's retention and erasure controls. Keep sync clients and share links inside the same EU hosting boundary and define which copy is the record.

ONLYOFFICE Docs and Collabora Online

ONLYOFFICE Docs is licensed under AGPL-3.0 and Collabora Online under the Mozilla Public License 2.0. Both edit documents in the browser, so the editing service receives file contents. Deploy the editing server in the same EU jurisdiction as the archive, because a document opened in a service hosted elsewhere is processed there. Check whether the editor caches content and where logs are written.

Processor terms for each hosted component

Every component that stores or processes archive content for you is a processor, even when it is open source and self-hosted. Your contract with the hosting provider or implementation partner should cover where data and support access sit, subprocessors, deletion at end of term and breach notice. Confirm with each provider whether any support access, telemetry or update channel reaches outside the EU.

How to host the archive so access stays inside the EU

Running Paperless-ngx or Alfresco on hardware in a data center your organization or an EU provider owns gives the clearest answer to where data sits and who touches the hosts. The archive, its database, search index and file storage stay on premises or in facilities under EU control, and the organization decides the operating model. The main risk is not location but administrator access: vendor engineers, remote hands or out-of-hours support can still open a session from outside the EEA, and under EDPB Guidelines 05/2021 that kind of remote access can itself be a transfer.

Encryption keys: Hold the keys in an internal or EU-hosted key management service, or in hardware security modules inside the facility, so the operator cannot decrypt volumes alone.
Host administration: Restrict root and database access to named staff in the EU, and log every privileged session with its source location.
Logs and backups: Keep application logs, audit trails and backup copies in the same jurisdiction, including any offsite replica.
Support access: Confirm whether the software vendor or a partner accesses systems remotely and from where, and document any such session as a transfer question.
Hardware and sourcing: Confirm who maintains firmware and who holds spare parts, since those contracts can carry third-country support.

Ask the facility operator for the list of staff with physical and logical access and where that staff is based.

How the sovereignty rollout runs from data mapping to exit test

The sequence turns a general wish for EU-only document storage into a documented, tested boundary: what data sits where, which processors may touch it, how retention and erasure work, and whether the archive can be restored or moved out again.

Map personal data and document classes
The controller's privacy or records owner, with the DeployOpen team, inventories the document classes that will enter the archive, such as HR files, customer correspondence, contracts and scanned identity documents. For each class the team records the personal data it contains, the lawful basis, the business owner, the systems that feed it and the people who read it. The output is a classification register that every later decision refers to. The step is done when each class has an owner and a documented purpose, and when any class that falls outside the archive is explicitly excluded.
Decide jurisdiction and hosting boundaries
The client sets the legal location of the archive, including the data center region, the cloud account or private facility, and the networks from which administrators may connect. DeployOpen maps where each component runs, including backups, logs, OCR workers, scanners and any monitoring service that might receive document metadata. The team then records which parties can reach the platform from outside the EEA, including support staff, remote administrators and vendors. The output is a boundary diagram with each location and access path labeled. The step is complete when the client signs off that no component or log stream crosses the boundary without an approved exception.
Write processor and sub-processor requirements
Counsel for the client drafts the processor terms that DeployOpen, the hosting provider and any other supplier must accept, covering processing instructions, security measures, sub-processor approval, breach notice and deletion at the end of service. The team checks which Chapter V transfer tools apply to any non-EEA access, and assesses whether a provider subject to third-country law with extraterritorial reach could be asked to disclose data. The output is a requirements schedule and a sub-processor register. The step is done when each supplier in the boundary diagram either accepts the schedule or is removed from the design. Confirm the exact clauses with your own legal team.
Build and harden the self-hosted stack
DeployOpen installs Paperless-ngx or Alfresco Community Edition inside the approved location, configures identity integration, permissions, encryption in transit, and disk or volume encryption, and removes any default service that sends data outside the boundary. The team sets up the import folders, OCR workers and mail ingestion paths so that they only read from inside the network. Configuration is recorded as code or as a controlled runbook. The output is a hardened build with a configuration baseline. The step is complete when a scan of the running system shows no outbound connections to unapproved destinations and the baseline is stored under change control.
Configure retention and erasure
The records owner and DeployOpen translate the classification register into retention rules, legal holds and disposal jobs. For each class the team defines the retention period supplied by the business or legal owner, the trigger event, the disposal method and the evidence written when a record is erased. Erasure is tested against copies that exist in search indexes, thumbnails, OCR text, backups and logs, so that a single deletion request is handled everywhere the data lives. The output is a retention schedule and a tested erasure procedure. The step is done when a sample erasure is traced through every copy and the trace is recorded.
Validate access from outside the EEA is blocked
DeployOpen runs a documented access test from networks located outside the EEA, including attempts to log in, view a document in a browser, use the API, reach the admin console and download a backup. The test also checks that support and vendor access paths require approval and are logged. Results are compared with the boundary diagram from the second step. The output is a test report with pass or fail evidence for each path. The step is complete when every failed path is either closed or formally accepted as an exception by the client, and the retest is recorded. Note that EDPB guidance treats even remote viewing of data from a third country as a transfer.
Test backup restore and exit
DeployOpen restores a full backup into a separate environment inside the same boundary, checks document integrity, search, permissions and audit logs, and confirms that restored copies follow the same retention and erasure rules. The team also runs an exit test that exports documents, metadata and audit records in open formats to a target location, to show the client can move to another provider or on-premises infrastructure. Under EU Data Act Articles 25 and 29, customers of data processing services have switching rights, which makes a documented exit path useful in contract negotiations. The output is a restore report and an exit export with a checksum list. The step is done when the restored system matches the source and the export opens without the original platform.
Hand over runbooks and evidence
DeployOpen delivers the runbooks for operations, access reviews, sub-processor changes, erasure requests, backup and restore, and exit, together with the configuration baseline, the boundary diagram, the processor register and the test reports. The client's internal owners are trained on each runbook and sign the handover record. Evidence is organized so that the data protection officer or an external assessor can find the boundary, the transfer analysis and the erasure trace without a walkthrough. The output is a handover pack and a signed acceptance record. The step is complete when the client's named owners have run at least one routine task from the runbook themselves. Certification and audit conclusions remain with independent assessors.

How retention and erasure work when records must also be kept

Under GDPR, personal data should be erased when it is no longer needed, but many document archives must also keep records for statutory periods. The cards below cover where those two duties collide and what to confirm in a self-hosted Paperless-ngx or Alfresco design before go-live.

Retention schedules tied to legal basis

Each document class needs a retention period that traces to a specific legal basis, such as a tax, employment or contract obligation, and a documented end point. Without that link, deletion rules become guesses. Confirm that the platform can attach retention rules to document types or tags, trigger disposal from them, and log each disposal decision. In Paperless-ngx, retention is typically handled through tags, custom fields and external scripts or exports, so confirm exactly how your team will enforce schedules.

Erasure requests against statutory retention

An erasure request under GDPR does not automatically override a legal duty to keep a record. The controller must decide, document and communicate whether the data is kept for a stated reason, restricted, or erased. In practice, a single scanned contract may hold personal data that must be kept for one purpose and erased for another. Confirm whether your platform can redact or delete individual files, pages or metadata fields without corrupting linked records or breaking document versions.

Backup copies and deletion lag

Deleting a document from the live system does not remove copies held in snapshots, replicas or offsite backups. Those copies are still personal data processed by you or your processor, and they remain within EU jurisdiction only if the backup location and key management are also in the EU. Ask your partner for the backup rotation period, how deleted data ages out of backups, and whether restores can re-expose records that were already erased. Document this lag in your retention policy so it can be explained to a regulator.

Legal hold overriding disposal

A legal hold suspends scheduled disposal for documents tied to litigation, an investigation or a regulatory inquiry, even when their normal retention period has ended. The hold must be applied to specific records, released in a controlled way, and visible to anyone running disposal jobs. Confirm that the platform can freeze documents against deletion, that holds survive re-indexing and migration, and that holds can be listed and reported on demand. Whether your platform supports holds natively should be verified, not assumed.

Access logs holding personal data

Audit trails record who opened, changed or deleted a document, and those logs often contain names, user identifiers and sometimes document titles that are themselves personal data. Logs must be kept long enough to evidence control, yet they also need their own retention and erasure rules. Confirm which events the platform logs, where the log is stored, whether it can be exported to a separate EU store, and how log entries are purged or pseudonymized when a retention period ends.

Audit evidence of deletion

When a record is lawfully disposed of, the organization should be able to show that disposal happened, when, under which rule and who approved it, without retaining the deleted content. This evidence is what an auditor or data protection authority will ask for. Confirm whether your platform writes a disposal certificate or log entry that survives deletion of the document, whether that entry can be exported, and whether it is signed or otherwise protected from alteration. Test the process end to end with a sample before relying on it.

What evidence an EU sovereignty review asks for

This table lists the evidence a reviewer, auditor or data protection officer typically asks for when a document archive must stay under EU control, and which system component or operating process produces each item. Read it as a checklist to build before the review starts, since most gaps appear in the transfer assessment, the sub-processor list and the restore and erasure records. Nothing here is a certification; confirm the exact format each assessor expects.

Evidence	What it shows	Produced by
Data flow map	Where scans, OCR text, metadata, thumbnails, logs and backups are stored and processed, including any remote access paths	Architecture documentation maintained by the implementer and the client's privacy team
Transfer assessment	Whether any access from outside the EEA, including support sessions and cloud storage, counts as a transfer under Chapter V	Controller's privacy function, reviewed against EDPB Guidelines 05/2021
Foreign authority exposure review	Whether any EU provider or sub-processor is subject to third-country law that could compel disclosure	Controller, with input from each provider's written disclosure
Processor contract and DPA	Instructions, security measures, sub-processor approval and deletion or return at contract end	Legal team of the controller and the hosting or implementation provider
Sub-processor list	Every party that can reach hosting, backups, support tooling or logs, with location and role	Implementer and hosting provider, updated on each change
Access and audit logs	Who viewed, changed, exported or deleted documents, and from which administrative path	Paperless-ngx or Alfresco audit trail, plus identity provider and operating system logs
Key management records	Where encryption keys live, who can use them, and how rotation and recovery are performed	Key management system or HSM administrator, with change records kept by the operator
Backup restore test results	Proof that archives restore complete and intact inside the EU, with dated test records	Backup operator, run against a documented restore runbook
Erasure and retention records	Evidence that deletion requests and retention expiries removed documents from storage and backups on schedule	Retention rules in the document system, plus the backup expiry policy and deletion logs

What do buyers ask before self-hosting an EU document archive?

Does self-hosting a document archive in the EU satisfy GDPR transfer rules?

Hosting in an EU data center removes one transfer risk, but it does not settle the question by itself. The EDPB's Guidelines 05/2021 treat remote access from a third country, even only displaying data on a screen for support, as a transfer, and they treat storage in a cloud outside the EEA as one too. So the design must also control who can administer the servers, where backups are copied and which support staff can log in from abroad. The guidelines also say that using an EU processor subject to third-country law is not itself a transfer, but complying with a third-country authority request would be. Assess that exposure before you engage a host. Under GDPR Article 44, infringements of the transfer rules carry fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, so the access map deserves a written review.

How much effort does a sovereignty-scoped document archive take to build?

Effort depends mainly on the volume of back-file material, the number of retention rules, the identity integration and how many environments must be kept in the EU. No supplied figure gives a duration for this type of build, so ask any partner for a effort estimate tied to a written scope rather than a general timeline. The largest drivers are usually migration and OCR of existing archives, permission design across departments, retention and erasure rules, backup and restore testing in the chosen EU location, and documentation of the access map for the compliance file. Each of these can be sized once the document types, volumes and access groups are known.

What does the client team need to provide for a self-hosted archive?

The client team needs to own decisions that a partner cannot make for it. Expect to supply a named business owner for each document class, a retention schedule approved by legal or the data protection officer, identity provider access for single sign-on, network and storage decisions for the EU site, and staff who will approve access reviews. Someone must also own the data processing record and the list of sub-processors. If these roles are unfilled at kickoff, the build will stall at permission design and erasure rules, which are the points where legal and business input is required.

Can our internal team run a self-hosted document system after go-live?

Many teams can, provided they have Linux, container, backup and identity skills and a documented runbook. Ask whether your team can perform upgrades, restore a backup into a test environment, rotate credentials, apply security updates and respond to an access incident without outside help. Check the upgrade path of the chosen platform, since Paperless-ngx and Alfresco Community Edition are released on separate schedules and have different operational footprints. Where skills are thin, a support retainer covering upgrades, monitoring and continuous testing is an option, and its scope should be written into the same agreement as the build.

How do Data Act switching rights affect exit planning for document archives?

The EU Data Act gives customers of data processing services the right to switch to another provider or to on-premises infrastructure. Under Articles 25, 29 and 50 of Regulation (EU) 2023/2854, the notice period can be up to two months, the transition period is 30 days, and switching charges are banned from 12 January 2027. The Act applies to data processing services, so check whether your hosting or managed-service contract falls in scope and what it says about data export formats. For self-hosted open-source software the exit depends more on your own export procedures, so test a full export of documents, metadata, audit logs and retention status before go-live.

Which processor contracts are still needed when the host is an EU company?

A hosting provider that processes personal data on your behalf still needs a data processing agreement that meets Article 28 of the GDPR. In practice, the contract should cover processing instructions, confidentiality, security measures, sub-processor approval, assistance with data subject requests, deletion or return of data at exit, and audit rights. Ask the host to list every sub-processor and the country where each one can access data, including support staff and backup providers. If any of them can access data from outside the EU, the transfer analysis above applies. Standard contractual clauses under Commission Implementing Decision (EU) 2021/914 may still be needed for those links.

What should we ask a partner before signing an EU sovereignty engagement?

Ask for a written scope that names the EU data center or private cloud, the administrative access model, the backup location and every person or company with administrative access. DeployOpen plans, implements, hardens, backs up and documents self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks, and prepares evidence for compliance assessments, but it does not issue audit reports or certifications. Confirm that the engagement is fixed-scope with deliverables and timelines agreed in writing before work starts, and ask how a quote is derived from that scope. Also ask which activities would be covered by a later support retainer.

What to ask an implementation partner about EU sovereignty

Start with where people who can see your data sit. Ask the partner which countries its engineers, support staff and contractors connect from when they administer the Paperless-ngx or Alfresco stack, and whether any of that access happens from outside the EEA. The EDPB Guidelines 05/2021 treat remote access from a third country as a transfer even when the person only views data on a screen, so a support model that is EU-hosted but staffed from elsewhere changes your transfer picture. Ask for the access path in writing: bastion hosts, named roles, how sessions are recorded, and who approves break-glass access to the database or the consume and media directories. Next, ask who holds the encryption keys and where they live. Paperless-ngx does not encrypt stored documents by itself, so the partner has to say which disk, volume or application-layer encryption is in use, where the key material is generated and stored, and whether a key management service or hardware security module sits inside your jurisdiction. Ask whether the partner or any vendor can recover data without your approval, and what happens to keys when a contract ends. Also ask for the sub-processor list: every backup provider, monitoring service, mail relay and hosting company that could touch personal data, with its location, and how you will be notified before a change.

Then test erasure and exit, because both are where sovereignty promises usually fail. Ask how a deletion request under GDPR is carried through primary storage, search indexes, thumbnails, OCR text, audit logs and backups, and how the partner proves it. Ask how long a deleted record can persist in backup generations, and whether restores re-introduce erased items. For exit, ask the partner to demonstrate a full export of documents, metadata, tags, correspondents and permissions into a standard format, and to show the time and steps needed to move the workload to another EU provider or your own data center. The Data Act, applicable since 12 September 2025, gives customers switching rights with a maximum two-month notice period and a 30-day transition under Articles 25 and 29, so the contract should reflect those terms. Finally, ask how transfer assessments are documented. A competent partner can show you its data flow map, the location of each processing activity, the standard contractual clauses in force with any non-EU affiliate, and the questions it has asked of its own sub-processors. It should not hand you a legal conclusion that the deployment is lawful. Ask who in your organization owns the transfer impact assessment, which evidence the partner will provide for it, and which points you should take to counsel. Confirm the current status of the EU-US Data Privacy Framework with your legal team, since the appeal in Case C-703/25 P is pending, and ask the partner how it would respond if that outcome changed.

How DeployOpen scopes and supports a sovereignty-scoped archive

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, including EU data centers the client selects. For a document archive under EU jurisdiction, the work starts with where every copy, backup, log and support session of the data lives, and ends with a handover the client's own team can operate.

How we scope

Written scope lists every location where archive data, backups, logs and OCR output will reside, including EU data center sites.
Data flow mapping covers remote administration, support access and any third-country vendor access paths before build starts.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work begins.

How we build

Paperless-ngx or Alfresco Community Edition is deployed in the client's EU environment with network paths restricted to approved locations.
Retention and erasure rules are configured as documented schedules, with deletion tested against backups and derived copies.
Security testing of the deployed archive, including its APIs and administrative interfaces, runs before go-live and is reported in writing.

How we hand over

Handover documentation records data locations, subprocessors, access paths and the evidence each sovereignty control produces.
Administrators are trained on permissions, audit logs, backup restores and erasure procedures used in the client's environment.
Client teams receive configuration, runbooks and upgrade notes so the archive remains operable without DeployOpen present.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Patch and upgrade work is applied to the client's copy of the platform within the agreed support scope.
Confirm with your legal counsel which processor contract terms and transfer assessments apply to your hosting arrangement, since DeployOpen does not issue audit reports or certifications.

Document management for EU data sovereignty