Data sovereignty

Running software on your own server answers one question: where the data sits. It does not answer who governs the software, what it still sends outward, or who reads the traffic on its way in.

Those are three separate questions. Self-hosting only settles the first.

Who owns the software

Every stack records its licence and the entity behind it. The table is generated from those records, so it cannot fall out of step with what actually ships.

121 stacks40 EU57 non-EU98 open source

Stack	Licence	Who owns it
acme-certscore	Open sourceGPL-3.0	Austriamaintained in this project
adminerapps	Open sourceApache-2.0	Czech RepublicJakub Vrána
agentgatewayapps	Open sourceApache-2.0	United StatesLinux Foundation project (contributed by Solo.io)
akauntingbusiness	Source-availableBSL	TurkeyAkaunting Inc
autheliacore	Open sourceApache-2.0	Communityno single company
authentikcore	Open sourceMIT	NetherlandsAuthentik Security
beszelmonitoring	Open sourceMIT	USHenry Gd (community)
beszel-agentmonitoring	Open sourceMIT	USHenry Gd (community)
bookstackapps	Open sourceMIT	UKDan Brown (BookStack)
borgmaticbackup	Open sourceGPL-3.0-or-later	Communityborgmatic-collective (Dan Helfman)
caldiyapps	Open sourceMIT	Forkrubennati
calnodeapps	Open sourceApache-2.0	Calnodeno country stated in its published terms
calrsapps	Open sourceAGPL-3.0	FranceOlivier Lambert
changedetectionmonitoring	Open sourceApache-2.0	Australiadgtlmoon
chatwootbusiness	Open coreMIT	United StatesChatwoot Inc
checkmatemonitoring	Open sourceAGPL-3.0	CanadaBlueWave Labs
ciaomonitoring	Open sourceMIT	Brot & Gamesno country stated
ciso-assistantapps	Open sourceAGPL-3.0	Franceintuitem
collaboraapps	Open sourceMPL-2.0	UKCollabora Productivity Ltd
crowdseccore	Open sourceMIT	FranceCrowdSec SAS
dashyapps	Open sourceMIT	UKAlicia Sykes (Lissy93)
defectdojoapps	Open sourceBSD 3-Clause	DefectDojo Incno country stated in the sources checked
dependency-trackapps	Open sourceApache-2.0	OWASP Foundation projectUnited States (OWASP Foundation)
dfir-irisapps	Open sourceLGPL-3.0	FranceAirbus CyberSecurity (SAS), confirmed via copyright headers in upstream's own source files (`docker/webApp/iris-entrypoint.sh`, the nginx entrypoint)
difyapps	Source-availableDify Open Source License	LangGeniusno country stated in its published terms
dnsmasqcore	Open sourceGPL-2.0 or GPL-3.0, at your discretion	UKSimon Kelley
docker-mailserverapps	Open sourceMIT	Communitydocker-mailserver organisation
dockhandcore	Source-availableBSL 1.1	Finsys**no country or legal entity stated** — no imprint on fnsys.pro or dockhand.pro
docling-serveapps	Open sourceMIT	LF AI & Data Foundation (US non-profit)originated at IBM Research Zurich, Switzerland
documensobusiness	Open sourceAGPL-3.0	USDocumenso Inc
dolibarrbusiness	Open sourceGPL-3.0	FranceDolibarr Association
easyappointmentsapps	Open sourceGPL-3.0	GreeceAlex Tselegidis
erpnextbusiness	Open sourceGPL-3.0	IndiaFrappe Technologies Pvt. Ltd.
euro-officeapps	Open sourceAGPL-3.0	EUeuro-office consortium (Nextcloud, IONOS, XWiki, Proton)
facturascriptsbusiness	Open sourceLGPL-3.0	SpainCarlos García Gómez (FacturaScripts)
gatusmonitoring	Open sourceApache-2.0	CanadaTwinProduction
ghostapps	Open sourceMIT	IrelandGhost Foundation
gotifymonitoring	Open sourceMIT	GermanyGotify community project
grafana-prometheusmonitoring	Open sourceAGPL-3.0	USGrafana Labs (Raintank, Inc.)
greenmailapps	Open sourceApache-2.0	CommunityMarcel May
hawsercore	Open sourceMIT	Finsys**no country or legal entity stated** — no imprint on fnsys.pro
headscalecore	Open sourceBSD-3-Clause	Communityjuanfont, Kristoffer Dalby and contributors
healthchecksmonitoring	Open sourceBSD 3-Clause	LatviaPēteris Caune
heimdallapps	Open sourceMIT	UKlinuxserver.io community
hemmeligapps	Source-availableO'Saasy License Agreement	NorwayBjarne Øverli (individual maintainer)
heyformapps	Open sourceAGPL-3.0	United StatesHeyForm
homarrapps	Open sourceApache-2.0	Communityhomarr-labs
homepageapps	Open sourceGPL-3.0	UScommunity (gethomepage)
host-watchdogcore	Open sourceApache-2.0	First-partythis repository
httpbinapps	Open sourceMIT or ISC	United StatesPython Software Foundation
immichapps	Open sourceAGPL-3.0	USAlex Tran
infisicalcore	Open coreMIT	USInfisical Inc
invoiceninjabusiness	Source-availableElastic License 2.0	USInvoice Ninja LLC
it-toolsapps	Open sourceGNU GPL v3.0	FranceCorentinTh
jumpservercore	Open coreGPL-3.0	ChinaFIT2CLOUD
keycloakcore	Open sourceApache-2.0	USRed Hat, Inc. (CNCF incubating project)
kimaibusiness	Open sourceAGPL-3.0	GermanyKevin Papst
kopiabackup	Open sourceApache-2.0	No country statedKopia community project
langfusemonitoring	Open coreMIT	United StatesClickHouse, Inc. (Langfuse has been part of it since 2026-01)
leantimebusiness	Open sourceAGPL-3.0	USLeantime, Inc.
librephotosapps	Open sourceMIT	Communityno single company
listmonkbusiness	Open sourceAGPL-3.0	IndiaZerodha (Kailash Nadh)
litellmapps	Open coreMIT	United StatesBerriAI, Inc.
lycheeorgapps	Open sourceMIT	CommunityLycheeOrg
mailpitapps	Open sourceMIT	New ZealandRalph Slooten (axllent)
mailserver-jeboehmapps	Open sourceMIT	GermanyJeffrey Boehm (individual maintainer)
matomobusiness	Open sourceGPL-3.0	New ZealandInnoCraft Ltd
monicahqapps	Open sourceAGPL-3.0	CanadaMonica HQ
n8napps	Source-available	Germanyn8n GmbH
nextcloudapps	Open sourceAGPL-3.0	GermanyNextcloud GmbH
nocodbapps	Source-availableSustainable Use License 1.0	USNocoDB Inc
ntfymonitoring	Open coreApache-2.0 / GPL-2.0	GermanyPhilipp Heckel
obotapps	Open sourceMIT	USObot AI, Inc
ollamaapps	Open sourceMIT	United StatesOllama Inc. (California)
onlyofficeapps	Open sourceAGPL-3.0	LatviaAscensio System SIA
open-webuiapps	Source-availableOpen WebUI License	Open WebUIno country stated in its published terms
opencanaryapps	Open sourceBSD 3-Clause	South AfricaThinkst Applied Research
openprojectbusiness	Open coreGPL-3.0	GermanyOpenProject GmbH
opensignbusiness	Open sourceAGPL-3.0	IndiaOpenSign Inc
opnformapps	Open sourceAGPL-3.0	FranceJulien Nahum
orion-beltcore	Source-availableApache-2.0	Individual maintainerMohamed Zrouga
paperless-gptapps	Open sourceMIT	No country statedicereed
paperless-ngxapps	Open sourceMIT	Communityno single company
photoprismapps	Open sourceAGPL-3.0	GermanyPhotoPrism AG
photoviewapps	Open sourceAGPL-3.0	Denmarkcommunity
planebusiness	Open sourceAGPL-3.0	USPlane Software, Inc.
plausiblebusiness	Open sourceAGPL-3.0	EstoniaPlausible Insights OÜ
portainercore	Open sourcezlib	New ZealandPortainer.io Ltd
portainer-agentcore	Open sourcezlib	New ZealandPortainer.io Ltd
privatebinapps	Open sourcezlib	Community project, no single company, maintained collectively on GitHubno single jurisdiction
qdrantapps	Open sourceApache-2.0	GermanyQdrant Solutions GmbH (Berlin)
rclone-webbackup	Open sourceMIT	UKNick Craig-Wood (rclone)
scrutinymonitoring	Open sourceMIT	CommunityJason Kulatunga (AnalogJ)
seafileapps	Open sourceAGPL-3.0	ChinaSeafile Ltd
seafile-proapps	ProprietaryCommercial	ChinaSeafile Ltd
shellhubcore	Open coreApache-2.0	BrazilO.S. Systems
shlinkapps	Open sourceMIT	SpainAlejandro Celaya
solidinvoicebusiness	Open sourceMIT	SolidInvoiceno country stated in its published terms
stalwartapps	Open coreAGPL-3.0	United States and United KingdomStalwart Labs LLC
step-cacore	Open sourceApache-2.0	United StatesSmallstep Labs, Inc.
teleportcore	Open coreAGPL-3.0	USAGravitational, Inc.
threat-dragonapps	Open sourceApache-2.0	United StatesOWASP Foundation (nonprofit)
traefikcore	Open sourceMIT	FranceTraefik Labs
twentybusiness	Open coreAGPL-3.0	United StatesTwenty.com PBC
tymeslotapps	Open sourceAGPL-3.0	EstoniaDiletta Luna OÜ (Tallinn)
unifiapps	Open coreEULA	USUbiquiti Inc
uptime-kumamonitoring	Open sourceMIT	Hong KongLouis Lam
urbackupbackup	Open sourceAGPL-3.0-or-later	GermanyMartin Raiber (uroni)
vaultwardenapps	Open sourceAGPL-3.0	Communityunofficial Bitwarden reimplementation
velociraptorapps	Open sourceAGPL-3.0	Originally Velocidex (Australia), acquired by Rapid7 (United States) in 2021, which maintains it todaynon-EU
vikunjabusiness	Open sourceAGPL-3.0	GermanyKonrad Langenberg Software
vllmapps	Open sourceApache-2.0	United StatesvLLM project (originated at the UC Berkeley Sky Computing Lab)
warpgatecore	Open sourceApache-2.0	GermanyEugen Pankov Softwareentwicklung
whoamiapps	Open sourceApache-2.0	FranceTraefik Labs
wikijsapps	Open sourceAGPL-3.0	CanadaRequarks
windmillapps	Open coreAGPL-3.0	Windmill Labsno country stated in its published terms
wordpressapps	Open sourceGPL-2.0	USAutomattic / WordPress Foundation
yopassapps	Open sourceApache-2.0	SwedenJonas Haals (individual maintainer, corporate-adjacent — Spotify, Doddle and Gumtree Australia are named as users, not owners)
zabbixmonitoring	Open sourceAGPL-3.0	LatviaZabbix, Riga — the project's own record adds Tokyo and New York; the site's copyright line reads "Zabbix LLC"
zammadbusiness	Open sourceAGPL-3.0	GermanyZammad GmbH
zotcore	Open sourceApache-2.0	Community project under the CNCF sandbox umbrella, no single companyno single jurisdiction

“Open source” is claimed more often than it applies. Thirteen stacks carry a mixed licence — mostly open core, where the base is free and some features are not. Nine publish their source under a licence that restricts use: Dify, Hemmelig, n8n, NocoDB, Open WebUI, Akaunting, Invoice Ninja, Dockhand and Orion-Belt. Most of them permit personal and internal use but restrict reselling the software as a hosted service, or production use beyond a limit. Seafile Pro is commercial outright. None of that is a reason to avoid them; it is a reason to read the licence before building a business on reselling one.

The entity governs, not the developers. Documenso is built largely from Hamburg but the company is US-registered — a court order reaches the company, not the postcode of whoever wrote the code. Where a project states no company and no country at all, the table says so rather than guessing.

What still leaves the server

Some components talk to their vendor by design, and two do so by their own default.

CrowdSec exchanges data both ways. It receives around 15,000 blocked addresses from other installations, and sends its own detections back: the address, which attack pattern matched, a timestamp. Not the request itself — URLs, headers and bodies stay on your machine. The exchange is what makes the blocklist work, and it can be switched off, which also ends the incoming half.

Traefik’s version check is off here. Upstream it is on by default and sends your server’s public IP to the vendor, who state it is used to identify companies running Traefik and approach them about support contracts. This blueprint disables it.

Every publicly trusted certificate publishes its hostname. They are logged publicly the moment they are issued — mandatory, and no public issuer can opt out. Certificates from an internal CA are not logged this way. A hostname like backup-admin.example.com becomes searchable within minutes of getting its certificate. A wildcard certificate publishes only *.example.com, which is the reason to use one when the names themselves are worth not advertising.

A hostname absent from the certificate logs is harder to find. It is not protected by that absence — anything reachable from the internet has to survive being found.

Every service was checked, one at a time

Twenty-nine stacks, read against each project’s own documentation and source. What matters is not whether a service contacts its maker — many do, to see whether a newer version exists — but whether the message carries an identifier that survives restarts. Without one, the maker learns that somebody somewhere is running the software. With one, they can count installations and follow yours over time.

Seven carry such an identifier. Invoice Ninja is one of them, and it took watching the traffic to see how much: its crash reporter sends stack traces and the surrounding log lines to the vendor, tagged with the account’s own key, and over an hour it was four times busier than the version check that gets more attention. It is switched off in the shipped configuration.

The other six: Documenso, OpnForm and Homarr each report to an analytics service keyed on an ID stored in their own database. OpenProject’s security badge sends one with the version. Dolibarr posts a unique hash together with your company’s country, taken from the record inside the software — and the checkbox that enables it is ticked during installation, so it is easy to click past.

PhotoPrism cannot be stopped. It sends a permanent serial number with the version, operating system and processor count, and the project offers no setting to prevent it. The only remedy is a firewall rule on the server. If that matters to you, the other photo libraries do not do it.

WordPress reports its size. Alongside the version it sends the number of sites and the number of user accounts. There is no setting in the official image.

Two published switches do not work. Lychee and Dashy both document a way to turn their update check off, and in both cases the call still happens. This was found by reading the code; neither project’s documentation says so.

Three send information about people rather than about the installation — the easiest kind to miss:

• BookStack sends a fingerprint of every user’s e-mail address to Gravatar whenever an avatar is displayed
• LibrePhotos sends the location of every photo you scan to a mapping service to turn coordinates into place names
• Zammad looks up contacts and organisations against its own servers as you work

What was switched off here. Where a setting exists and costs nothing, telemetry is off in the shipped configuration. Where it costs a feature — Gravatar avatars, photo place names — the configuration says so on the line above, so it can be reversed in one edit. Where the setting lives inside the application and cannot be pre-set, the service’s page says where to find it after installation.

Push notifications to phones are the exception that cannot be switched off. Apple and Google will only accept push from a registered application, so any service that reaches your phone routes a small relay message through the project’s own servers. What travels is a message identifier — the content stays on your machine, and the phone comes back to fetch it.

Who sits in front of it

The biggest decision here is usually made by clicking an icon in a DNS panel. If a CDN proxies your traffic, it decrypts it — that is not a misconfiguration, it is how a CDN works.

What proxying actually changes →

What this is not

Not legal advice, and not a compliance statement. Where software comes from and where personal data is processed are related questions but not the same one: a US-owned project running entirely on your own server may be perfectly fine, and an EU-owned one that reports home may not be.

These are the inputs. The weighing depends on what you are running — a public blog and a practice’s patient records do not share a threshold.

Where these facts come from

The table is generated from per-stack records in the repository, so it cannot drift from what ships. Those records were compiled by reading each project’s own licence and company details, and they carry no external citation of the kind the security pages use — how sources are chosen and checked explains that standard, and this page does not yet meet it.

Corporate ownership, registration and licensing change, and a fork or an acquisition can move a project between jurisdictions without the software looking any different. Read anything here as of 31 July 2026 and verify the entries that matter to your decision against the project itself.

The telemetry findings come from reading each project’s own documentation and source code, and each positive was then checked a second time by someone trying to disprove it — one claim did not survive that and was dropped. They were not observed on the wire. Reading the code establishes that a call exists; it cannot establish that no other one does. Where nothing was found, this page says nothing rather than calling a service clean.