GDPR-friendly newsletter software you host yourself

What does self-hosting change for the GDPR, in short?

Self-hosting decides where your subscriber data lives and who processes it. If the server sits in an EU data centre and sending stays in the EU too, there is no transfer of your list to a US newsletter vendor. That is a real advantage.

It does not take care of the obligations that come with running a newsletter:

• Consent and proof of double opt-in are needed whatever software you use.
• Your host, SMTP relay and SMS gateway are still processors. You need a data processing agreement (DPA) with each.
• Retention rules, privacy notices and technical and organisational measures stay with you. With self-hosting there is more of this than with SaaS, because updates, backups and access control are now yours too.

So no software is GDPR compliant on its own, NetSendo included. Self-hosting gives you control over where the data is stored. Whether your setup meets the GDPR depends on how you run it.

Not legal advice. This article explains the general legal position, with links to the legislation, court decisions and German supervisory-authority guidance (as of 17 October 2026). For your own case, ask your data protection officer or a lawyer.

What changes when you host newsletter software yourself?

Three things shift: where the list is stored, who your processors are, and whether data leaves the EU. The figure shows the three usual setups.

Where the subscriber list lives and who processes it. Simplified; check every provider in your own setup.

Where does the data live?

With SaaS, the list lives with the vendor. Mailchimp says its servers are located in the US (Mailchimp GDPR). Several German providers advertise EU or German locations instead (see below).

With self-hosting, the list sits in the database on your server, and you choose the location with your host. With cloud servers that can differ per project. Hetzner, for example, runs data centres in Nuremberg and Falkenstein (Germany) and Helsinki (Finland), and also offers locations in Ashburn, Hillsboro and Singapore (Hetzner data centers). Picking a US location there moves your server data to the US, which Hetzner says happens on the basis of your explicit consent when you choose the location (Hetzner privacy FAQ). Location is a decision you make, not a default to rely on.

Who is still a processor?

A processor is anyone who processes personal data on your behalf (GDPR Art. 4(8)). Each needs a contract covering the points in Article 28(3): subject matter and duration, types of data, documented instructions, confidentiality, Article 32 security, sub-processors, and deletion or return at the end.

With self-hosting the newsletter vendor drops out as a processor. These usually remain:

Hetzner, for instance, does not negotiate DPAs individually; it offers a template you accept in your customer account (Hetzner privacy FAQ). Most sending services work the same way: the agreement exists, but you have to accept it and file it.

What about transfers outside the EU?

Personal data may leave the EU/EEA only under the conditions in Articles 44 onwards: an adequacy decision by the Commission (Art. 45) or appropriate safeguards such as Standard Contractual Clauses (Art. 46).

For the US this has been a moving target:

• 16 July 2020: in Schrems II the Court of Justice declared the EU-US Privacy Shield invalid (C-311/18). Standard Contractual Clauses stayed valid, but supervisory authorities can suspend transfers based on them where the destination cannot ensure the required protection.
• 10 July 2023: the Commission adopted the adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795). It covers only US organisations on the "Data Privacy Framework List" kept by the US Department of Commerce.
• 3 September 2025: the General Court dismissed an action to annul that decision (press release 106/25, T-553/23 Latombe). It also noted that the Commission must monitor the framework continuously and may suspend, amend or repeal it if US law changes.

So transfers to certified US vendors are currently lawful. If you would rather not make the legal basis for your list depend on the next court ruling, keep the list in the EU. That is the strongest practical argument for EU hosting, whether self-hosted or with an EU vendor.

Watch the sending layer. A US company stays a US company even in an EU region. Amazon SES, for example, is available in Frankfurt (eu-central-1) and other EU regions (AWS). Your sending data then sits in the EU, but your contract partner is a US group. Check how the provider's DPA handles that.

Is Mailchimp GDPR compliant?

You can't answer that with a yes or no for Mailchimp or any other tool. Mailchimp describes its position like this (Mailchimp GDPR):

• Its servers are located in the US.
• It is certified under the EU-US Data Privacy Framework.
• Its Data Processing Addendum is part of its standard terms and includes the EU Standard Contractual Clauses as a second basis if the framework falls.

Under current law, using it is therefore not prohibited. Whether your use meets the GDPR depends, as with any tool, on your consent flow, your records and your privacy notices. The difference with self-hosting is how exposed you are to the transfer question, not a "compliant" or "non-compliant" stamp.

What does self-hosting not solve?

Almost everything that makes a newsletter lawful is independent of where it is stored.

Consent

Under Article 13 of the ePrivacy Directive, email marketing needs the recipient's prior consent, with a narrow exception for a business's existing customers and its own similar products. Member states implement this in national law. Germany is a strict example: § 7(2) no. 2 UWG treats email advertising without prior express consent as an unreasonable nuisance, and the existing-customer exception in § 7(3) applies only if all four conditions are met (address obtained in a sale, own similar products, no objection, and a clear notice of the right to object at collection and in every email).

Under GDPR Article 7 you must be able to demonstrate consent (para. 1), and withdrawing it must be as easy as giving it (para. 3).

Double opt-in and proof

The GDPR does not mention double opt-in. It is simply the most practical way to prove consent. In Germany, the supervisory authorities consider double opt-in necessary for consent given electronically (DSK guidance on direct marketing, section 3.3, in German). They refer to the proof requirements set by the Federal Court of Justice (BGH) in its judgment of 10 February 2011 (I ZR 164/09) and spell out:

• Storing an IP address alone is not enough.
• Consent must be fully provable, including its wording. Each person's declaration must be documented and printable at any time.
• Confirmation by SMS code or phone call usually has little evidential value because it is easy to fake.

Your software has to support this: a confirmation link, timestamps for signup and confirmation, and the form and consent text as they were at the time. SaaS tools usually have this built in. When you self-host, check what the tool records and how you export it.

Unsubscribing, retention and deletion

Every email needs an easy way to unsubscribe, and the German authorities recommend a notice of the right to object in every marketing message (GDPR Art. 21(4)). Storage limitation (Art. 5(1)(e)) means keeping data only as long as the purpose requires.

One trap: do not delete the proof of consent together with the subscriber. The German guidance says proof must remain possible after withdrawal, within the standard limitation periods, which it gives as three years. A retention plan for a newsletter therefore separates at least:

1. active subscriber data (while consent lasts),
2. unconfirmed signups (delete after a short period),
3. proof of consent (keep for the limitation period after withdrawal),
4. backups (with their own rotation, so deleted data does not live on in old copies forever).

Security, records and notices

Article 32 requires technical and organisational measures appropriate to the risk, naming encryption and pseudonymisation among them. When you self-host, that means concrete work: security updates for the OS, Docker and the app, TLS, encrypted backups, few admin accounts with strong authentication, a firewall and logging of admin access.

Add the record of processing activities (Art. 30) and the privacy notice at the signup form (Art. 13). No software writes those for you.

Which EU-hosted newsletter services are there?

If you don't want to run a server, an EU vendor is often the simpler route. These four come up most in the German market, which has the strictest double opt-in practice. Prices are from each vendor's site on 17 October 2026, monthly billing.

As of 16–17 October 2026. Brevo charges by emails sent; 40,000 emails equals 10,000 contacts at four sends a month. We found no explicit VAT note on the rapidmail, KlickTipp and Brevo pages we opened. Annual billing is cheaper with all of them. Prices change; check before you decide.

A note on vendor claims: phrases like "100% DSGVO-konform" (rapidmail, KlickTipp) describe the vendor's own service. Consent, proof and privacy notices for your newsletter are still your job, exactly as with self-hosting.

When an EU vendor is the better choice: small lists, nobody on the team to look after a server, or when you want double opt-in, consent logs and unsubscribe handling ready-made. That is a perfectly reasonable answer.

Which newsletter software can you host yourself?

Three options cover most needs, and the licence is a real differentiator.

As of 17 October 2026. In all three cases you pay for the server and for sending.

listmonk is the lean choice for newsletters: fast, mature and under a true open-source licence. If you only need broadcasts, it is lighter to run than the other two.

Mautic is the established open-source marketing automation suite, with campaigns and lead scoring. Expect more setup, especially for double opt-in proof.

NetSendo combines email, SMS, a CRM with pipeline, webinars, automations and an MCP server for AI assistants in one self-hosted app. What matters for the GDPR question:

• The list sits in your MySQL database on your server.
• You choose the sending path: Amazon SES, Mailgun, SendGrid, Gmail API or the built-in NMI infrastructure with your own IPs. That also decides which sending service becomes your processor.
• AI features can run on local models through Ollama instead of a cloud provider.
• The licence is an EULA, not an open-source licence. You may run a licensed instance for your own business, but not redistribute it, white-label it or sell it as SaaS. The README says an active licence is required to operate.

For a broader comparison, see the best self-hosted email marketing software and Is NetSendo open source?

With any self-hosted tool, check which outbound connections the instance makes: licence checks, update checks, AI providers, tracking domains, fonts or images loaded from third-party servers. Each one belongs in your records.

What should you check when hosting in the EU?

An EU data centre settles the transfer question for the database. To make the rest follow, check these points. Hetzner serves as the example because its terms are documented publicly; other EU hosts work the same way.

• Set the location per server. For non-cloud products Hetzner says data is processed and stored only in the EU. For cloud products, storage follows the location you pick (Hetzner privacy FAQ).
• Accept and file the DPA. At Hetzner it is done in the customer account, with an annex listing data types and groups of data subjects.
• Look at the sub-processors. Hetzner links to its own list.
• Treat certification as one building block. Hetzner states DIN ISO/IEC 27001:2022 certification for all its data centre parks (Hetzner). That covers the host's infrastructure, not your configuration on the server.
• Encryption is your job. Hetzner points out that you are responsible for the data on your server and its encryption.
• Keep backups in the EU as well. Off-site backups in a US region undo the point of an EU server.

Resources: per the quickstart, NetSendo needs Docker with Compose v2, at least 2 GB RAM and 5 GB disk (4 GB RAM and 10 GB recommended). Get current server prices from your host; Hetzner's price pages only loaded with JavaScript when we checked, so we quote no figures here.

Self-host or use an EU vendor?

Both can be run in a GDPR-friendly way. The question is who does which work.

Self-hosting pays off mostly with large lists, when you want features such as SMS, CRM or webinars in one app without add-on pricing, or when data sovereignty is a core argument for you or your customers. For the money side, see what it costs to email 10k, 50k and 100k contacts. Before your first send, read the deliverability guide for self-hosted senders.

Checklist: self-host a newsletter and run it GDPR-friendly

Infrastructure

• Server location in the EU chosen and documented, backups included.
• DPA with the host accepted and filed.
• Sending service chosen; DPA, region and company seat checked.
• SMS gateway and AI provider (if used) covered by a DPA, or a local alternative.
• Outbound connections of the instance reviewed (licence, updates, tracking, fonts).

Consent

• Signup form with clear consent wording and a link to the privacy notice (Art. 13).
• Double opt-in on; unconfirmed signups get no marketing.
• Per-person log: signup and confirmation timestamps, form, consent text as it was, exportable.
• Existing customers emailed only if your national exception applies in full.

Day-to-day

• Unsubscribe link and notice of the right to object in every email.
• Retention plan: unconfirmed signups, unsubscribers, proof of consent, backups.
• Security updates, TLS, encrypted backups, minimal admin access.
• Entry in the record of processing activities (Art. 30).
• Process for access, rectification and erasure requests.

Next steps

• To self-host: the quickstart gets a NetSendo test instance running with Docker. Licence details are on the pricing page.
• If you only need newsletters and want an open-source licence, look at listmonk.
• If nobody can look after a server, an EU vendor from the table above is the more honest choice.