Data sovereignty

Running software on your own server answers one question: where the data sits. It does not answer who governs the software, what it still sends outward, or who reads the traffic on its way in.

Those are three separate questions. Self-hosting only settles the first.

Who owns the software

Every stack records its licence and the entity behind it. The table is generated from those records, so it cannot fall out of step with what actually ships.

59 stacks26 EU27 non-EU51 open source

Stack	Licence	Who owns it
acme-certscore	Open sourceGPL-3.0	AustriaZeroSSL GmbH
adminerapps	Open sourceApache-2.0	Czech RepublicJakub Vrána
authentikcore	Open sourceMIT	NetherlandsAuthentik Security
beszelmonitoring	Open sourceMIT	USHenry Gd (community)
beszel-agentmonitoring	Open sourceMIT	USHenry Gd (community)
bookstackapps	Open sourceMIT	UKDan Brown (BookStack)
borgmaticbackup	Open sourceGPL-3.0-or-later	Communityborgmatic-collective (Dan Helfman)
caldiyapps	Open sourceMIT	Forkrubennati
changedetectionmonitoring	Open sourceApache-2.0	Australiadgtlmoon
collaboracore	Open sourceMPL-2.0	UKCollabora Productivity Ltd
crowdseccore	Open sourceMIT	FranceCrowdSec SAS
dashyapps	Open sourceMIT	UKAlicia Sykes (Lissy93)
dnsmasqcore	Open sourceGPL-2.0 or GPL-3.0, at your discretion	UKSimon Kelley
dockhandcore	Source-availableBSL 1.1	Finsys**no country or legal entity stated** — no imprint on fnsys.pro or dockhand.pro
documensobusiness	Open sourceAGPL-3.0	USDocumenso Inc
dolibarrbusiness	Open sourceGPL-3.0	FranceDolibarr Association
easyappointmentsapps	Open sourceGPL-3.0	GreeceAlex Tselegidis
euro-officecore	Open sourceAGPL-3.0	EUeuro-office consortium (Nextcloud, IONOS, XWiki, Proton)
gatusmonitoring	Open sourceApache-2.0	CanadaTwinProduction
ghostapps	Open sourceMIT	IrelandGhost Foundation
hawsercore	Open sourceMIT	Finsys**no country or legal entity stated** — no imprint on fnsys.pro
healthchecksmonitoring	Open sourceBSD 3-Clause	LatviaPēteris Caune
heimdallapps	Open sourceMIT	UKlinuxserver.io community
homarrapps	Open sourceMIT	Communityhomarr-labs
homepageapps	Open sourceGPL-3.0	UScommunity (gethomepage)
immichapps	Open sourceAGPL-3.0	USAlex Tran
infisicalcore	Open coreMIT	USInfisical Inc
invoiceninjabusiness	Source-availableElastic License 2.0	USInvoice Ninja LLC
it-toolsapps	Open sourceGNU GPL v3.0	FranceCorentinTh
kimaibusiness	Open sourceAGPL-3.0	GermanyKevin Papst
librephotosapps	Open sourceMIT	Communityno single company
listmonkbusiness	Open sourceAGPL-3.0	IndiaZerodha (Kailash Nadh)
lycheeorgapps	Open sourceMIT	CommunityLycheeOrg
matomobusiness	Open sourceGPL-3.0	New ZealandInnoCraft Ltd
monicahqapps	Open sourceAGPL-3.0	CanadaMonica HQ
n8napps	Source-available	Germanyn8n GmbH
nextcloudapps	Open sourceAGPL-3.0	GermanyNextcloud GmbH
nocodbapps	Open sourceAGPL-3.0	USNocoDB Inc
ntfymonitoring	Open coreApache-2.0 / GPL-2.0	GermanyPhilipp Heckel
onlyofficecore	Open sourceAGPL-3.0	LatviaAscensio System SIA
openprojectbusiness	Open coreGPL-3.0	GermanyOpenProject GmbH
opensignbusiness	Open sourceAGPL-3.0	IndiaOpenSign Inc
opnformapps	Open sourceAGPL-3.0	FranceJulien Nahum
paperless-ngxapps	Open sourceMIT	Communityno single company
photoprismapps	Open sourceAGPL-3.0	GermanyPhotoPrism AG
photoviewapps	Open sourceGPL-3.0	Denmarkcommunity
portainercore	Open sourcezlib	New ZealandPortainer.io Ltd
portainer-agentcore	Open sourcezlib	New ZealandPortainer.io Ltd
seafileapps	Open sourceAGPL-3.0	ChinaSeafile Ltd
seafile-proapps	ProprietaryCommercial	ChinaSeafile Ltd
traefikcore	Open sourceMIT	FranceTraefik Labs
unifiapps	Open coreEULA	USUbiquiti Inc
uptime-kumamonitoring	Open sourceMIT	Hong KongLouis Lam
urbackupbackup	Open sourceAGPL-3.0-or-later	GermanyMartin Raiber (uroni)
vaultwardenapps	Open sourceGPL-3.0	Communityunofficial Bitwarden reimplementation
vikunjabusiness	Open sourceAGPL-3.0	GermanyKonrad Langenberg Software
whoamicore	Open sourceApache-2.0	FranceTraefik Labs
wordpressapps	Open sourceGPL-2.0	USAutomattic / WordPress Foundation
zammadbusiness	Open sourceAGPL-3.0	GermanyZammad GmbH

“Open source” is claimed more often than it applies. Four stacks are open core — the base is free, some features are not. Three publish their source under a licence that restricts use: Dockhand, Invoice Ninja and n8n all permit personal and internal business use but not reselling the software as a hosted service. Seafile Pro is commercial outright. None of that is a reason to avoid them; it is a reason to read the licence before building a business on reselling one.

The entity governs, not the developers. Documenso is built largely from Hamburg but the company is US-registered — a court order reaches the company, not the postcode of whoever wrote the code. Where a project states no company and no country at all, the table says so rather than guessing.

What still leaves the server

Some components talk to their vendor by design, and two do so by their own default.

CrowdSec exchanges data both ways. It receives around 15,000 blocked addresses from other installations, and sends its own detections back: the address, which attack pattern matched, a timestamp. Not the request itself — URLs, headers and bodies stay on your machine. The exchange is what makes the blocklist work, and it can be switched off, which also ends the incoming half.

Traefik’s version check is off here. Upstream it is on by default and sends your server’s public IP to the vendor, who state it is used to identify companies running Traefik and approach them about support contracts. This blueprint disables it.

Every publicly trusted certificate publishes its hostname. They are logged publicly the moment they are issued — mandatory, and no public issuer can opt out. Certificates from an internal CA are not logged this way. A hostname like backup-admin.example.com becomes searchable within minutes of getting its certificate. A wildcard certificate publishes only *.example.com, which is the reason to use one when the names themselves are worth not advertising.

A hostname absent from the certificate logs is harder to find. It is not protected by that absence — anything reachable from the internet has to survive being found.

Every service was checked, one at a time

Thirty-six applications, read against each project’s own documentation and source. What matters is not whether a service contacts its maker — many do, to see whether a newer version exists — but whether the message carries an identifier that survives restarts. Without one, the maker learns that somebody somewhere is running the software. With one, they can count installations and follow yours over time.

Seven carry such an identifier. Invoice Ninja is one of them, and it took watching the traffic to see how much: its crash reporter sends stack traces and the surrounding log lines to the vendor, tagged with the account’s own key, and over an hour it was four times busier than the version check that gets more attention. It is switched off in the shipped configuration.

The other six: Documenso, OpnForm and Homarr each report to an analytics service keyed on an ID stored in their own database. OpenProject’s security badge sends one with the version. Dolibarr posts a unique hash together with your company’s country, taken from the record inside the software — and the checkbox that enables it is ticked during installation, so it is easy to click past.

PhotoPrism cannot be stopped. It sends a permanent serial number with the version, operating system and processor count, and the project offers no setting to prevent it. The only remedy is a firewall rule on the server. If that matters to you, the other photo libraries do not do it.

WordPress reports its size. Alongside the version it sends the number of sites and the number of user accounts. There is no setting in the official image.

Two published switches do not work. Lychee and Dashy both document a way to turn their update check off, and in both cases the call still happens. This was found by reading the code; neither project’s documentation says so.

Three send information about people rather than about the installation — the easiest kind to miss:

• BookStack sends a fingerprint of every user’s e-mail address to Gravatar whenever an avatar is displayed
• LibrePhotos sends the location of every photo you scan to a mapping service to turn coordinates into place names
• Zammad looks up contacts and organisations against its own servers as you work

What was switched off here. Where a setting exists and costs nothing, telemetry is off in the shipped configuration. Where it costs a feature — Gravatar avatars, photo place names — the configuration says so on the line above, so it can be reversed in one edit. Where the setting lives inside the application and cannot be pre-set, the service’s page says where to find it after installation.

Push notifications to phones are the exception that cannot be switched off. Apple and Google will only accept push from a registered application, so any service that reaches your phone routes a small relay message through the project’s own servers. What travels is a message identifier — the content stays on your machine, and the phone comes back to fetch it.

Who sits in front of it

The biggest decision here is usually made by clicking an icon in a DNS panel. If a CDN proxies your traffic, it decrypts it — that is not a misconfiguration, it is how a CDN works.

What proxying actually changes →

What this is not

Not legal advice, and not a compliance statement. Where software comes from and where personal data is processed are related questions but not the same one: a US-owned project running entirely on your own server may be perfectly fine, and an EU-owned one that reports home may not be.

These are the inputs. The weighing depends on what you are running — a public blog and a practice’s patient records do not share a threshold.

Where these facts come from

The table is generated from per-stack records in the repository, so it cannot drift from what ships. Those records were compiled by reading each project’s own licence and company details, and they carry no external citation of the kind the security pages use — how sources are chosen and checked explains that standard, and this page does not yet meet it.

Corporate ownership, registration and licensing change, and a fork or an acquisition can move a project between jurisdictions without the software looking any different. Read anything here as of 31 July 2026 and verify the entries that matter to your decision against the project itself.

The telemetry findings come from reading each project’s own documentation and source code, and each positive was then checked a second time by someone trying to disprove it — one claim did not survive that and was dropped. They were not observed on the wire. Reading the code establishes that a call exists; it cannot establish that no other one does. Where nothing was found, this page says nothing rather than calling a service clean.