Does open source make us GDPR/NIS2 compliant?

No. Open source improves auditability and exit rights; compliance still depends on lawful basis, DPAs, access control, retention, and incident processes. Self-hosting can simplify residency proofs and worsen outcomes if nobody owns patches and restores.

Should everything be self-hosted?

No. Self-host systems of record where control matters (identity, files, secrets). Keep commodity services hosted when the vendor region and DPA are acceptable and the service is not differentiating. Hybrid stacks are normal for mature teams.

What is the cheapest credible starting point?

Vaultwarden + authentik/Keycloak + Nextcloud on infrastructure you already monitor, with Umami or Plausible for site analytics. Defer Matrix until identity and backups are boring. Cost is mostly operator time; hosted FOSS tiers appear when you outsource that time.

Where do I browse options?

Use the self-hosted catalog and stack builder, then read when self-hosting is worth it before expanding scope. For analytics and chat, use the Google Analytics and Slack alternatives pages as category entry points.

An Open-Source Stack for GDPR and NIS2 Teams

GDPR and NIS2 do not require open source—but they punish vague data maps, opaque subprocessors, and identity systems you cannot audit. Teams that reach for open-source stacks usually do so because residency, logging retention, access control, and exit rights are easier to prove when you operate the control plane yourself.

The trap is collecting “compliant logos” without an operating model. A Nextcloud instance without tested restores, a Keycloak realm without MFA enforcement, or Matomo without a retention policy will fail the first serious questionnaire. Compliance is a property of process plus tooling—not of licenses alone.

This guide proposes a minimal, free-first stack for teams that need EU-friendly control: files, identity, analytics, secrets, chat, and backup discipline. Hosted open-source SaaS can still fit when the vendor’s region and DPA are acceptable; self-host when residency or audit depth is non-negotiable.

Key takeaways

Map systems of record first: identity, files, logs, backups—then pick tools.
Self-host when residency and audit trails must live in infrastructure you control.
Keycloak or authentik for SSO; avoid bolting auth onto every app separately.
Prefer privacy-first analytics (Matomo/Plausible/Umami) with explicit retention.
Vaultwarden, Matrix, and Nextcloud cover secrets, chat, and files for many SMB/public-sector teams.
NIS2-oriented ops means patch cadence, logging, and restore drills—not a PDF policy folder.

Data map clarity: where personal data lives, who can access it, and how long it is kept.
Processor transparency: subprocessors, regions, and transfer mechanisms you can name.
Access control: centralized identity, MFA, least privilege, and joiner/mover/leaver flows.
Detectability: logs and alerts that show misuse or outages—not vanity dashboards.
Resilience: backups with restore tests aligned to your RTO/RPO narrative.
Supply-chain awareness: known versions, signed releases when available, and upgrade ownership.

Reference stack (free / self-hosted first)

Capability	Primary pick	Alt	Notes
Files & collaboration	Nextcloud	Seafile / CryptPad	Self-host for residency; Nextcloud Hub cloud is paid if you skip ops
Identity / SSO	Keycloak	authentik	OIDC/SAML hub; budget realm design and MFA from day one
Web analytics	Matomo or Plausible/Umami	PostHog (product)	Cookieless/privacy posture and retention policy required
Passwords / secrets UX	Vaultwarden	Bitwarden self-host	Vaultwarden is lightweight; Bitwarden org features differ
Team chat	Matrix (Synapse/Conduit) + Element	Rocket.Chat	Federation optional; moderation and backups are real work
Backups	Restored snapshots + offsite	Borg/Restic + Object storage	Unrestored backups fail audits—schedule drills

Nextcloud — files and collaboration

Nextcloud

Open in catalog

Self-hosted content collaboration: files, sharing, calendars, and a large app ecosystem. Strengths: clear data residency when you run it, mature sharing controls, and a familiar Drive-like UX for non-engineers. Limits: collaborative editing quality depends on the apps you enable, Talk/Groupware features add operational weight, and the official Hosted Hub is a paid escape hatch if you do not want to operate it. Choose it when files are a system of record and SaaS Drive regions or DPA terms fail your review.

Best for: Teams that need EU-controlled file collaboration without Google/Microsoft Drive.
Deployment: Self-hosted; official hosted options available (paid).
Pricing: Open-source core; hosting and enterprise support are commercial.
Unique: Best default for sovereign file storage when you can staff updates and backups.

Keycloak or authentik — identity

Keycloak

Open in catalog

Central identity provider for SSO via OIDC/SAML, MFA, and realm patterns. Strengths: breadth and enterprise protocol coverage. Limits: identity is high-blast-radius infrastructure—bad realm design, missing MFA, or untested IdP backups become outages. Choose Keycloak when you need maximum protocol breadth; choose authentik when a smaller team wants faster admin UX.

Best for: Organizations consolidating login for internal FOSS apps.
Deployment: Self-hosted (managed IdP SaaS exists but changes the residency story).
Pricing: Open-source; operational cost is staff time, not licenses.
Unique: Broad enterprise IdP coverage under your control.

authentik

Open in catalog

A modern IdP with flows, MFA, and an admin experience teams often prefer for faster time-to-first-SSO. Strengths: modern admin UX for OIDC-first apps. Limits: validate obscure SAML edge cases early. Choose authentik when a lean team needs SSO without a dedicated identity guild.

Best for: SMB and mid-market teams self-hosting SSO.
Deployment: Self-hosted.
Pricing: Open-source; operational cost is staff time.
Unique: Faster path to SSO+MFA for many smaller teams.

Matomo, Plausible, or Umami — analytics

Matomo

Open in catalog

Replace third-party marketing analytics with tools you can place in-region. Matomo covers GA-like depth. Strengths: clearer controller story and retention you define. Limits: ad attribution and Google Ads integrations will hurt; self-hosting is real ops. Document lawful basis and retention before the script ships.

Best for: Marketing and public sites that need deeper measurement without defaulting to GA.
Deployment: Self-hosted and/or FOSS-vendor cloud.
Pricing: Open-source core; hosted plans often paid and fund maintainers.
Unique: Depth when analytics is a regulated data store.

Plausible

Open in catalog

Simple pageviews with lower ceremony than Matomo. Strengths: stakeholders read the charts; clearer privacy defaults. Limits: shallow reporting by design.

Best for: Sites that need essential metrics without GA complexity.
Deployment: Self-hosted and/or FOSS-vendor cloud.
Pricing: Open-source; hosted plans often paid.
Unique: Simple privacy analytics.

Umami

Open in catalog

Docker-first pageviews with a modern multi-site dashboard. Strengths: low ops for a handful of properties. Limits: no deep segmentation.

Best for: Teams already running containers for privacy-friendly metrics.
Deployment: Self-hosted.
Pricing: Open-source.
Unique: Low-ceremony FOSS pageviews.

Vaultwarden — team secrets UX

Vaultwarden

Open in catalog

A lightweight, Bitwarden-compatible server popular for self-hosted password management. Strengths: low resource use, familiar clients, and fast wins for eliminating shared spreadsheet passwords. Limits: organizational policies and some Bitwarden cloud features differ; you own backups of the vault database—lose them and you lose the company keys. Pair with SSO where possible and rehearse emergency access.

Best for: SMBs and teams replacing shared password anti-patterns.
Deployment: Self-hosted.
Pricing: Open-source; free to run (infra + backups).
Unique: Highest ROI security control for many small teams.

Matrix — chat with a residency story

Matrix (Element)

Open in catalog

Federated messaging with self-hosted homeservers. Strengths: you can keep message history in-region and integrate bridges carefully. Limits: moderation, spam, federation policy, and Synapse resource use surprise teams that expected “Slack with Docker.” For NIS2-minded orgs, start closed homeserver, enforce SSO, and define retention—federation can wait.

Best for: Teams that need chat without a US-only SaaS control plane.
Deployment: Self-hosted homeserver; Element Cloud and other hosts are paid options.
Pricing: Open protocol/stack; hosting cost varies.
Unique: Strong sovereignty story if you accept moderation and backup ownership.

Logging, backups, and NIS2-flavored operations

Tool logos do not satisfy incident reporting expectations. Minimum bar: centralized auth logs, app audit trails where available, host/container logs with retention, monitored TLS expiry, and quarterly restore drills for identity and file systems. If you cannot name the person who patches Friday CVEs, you are not ready to self-host the compliance-critical path—use a reputable EU-hosted open-source service while ops maturity catches up.

Pin versions; schedule patch windows; track CVEs for IdP and file servers first.
Separate admin SSO from break-glass accounts stored offline.
Encrypt backups and test restores into a clean environment.
Write retention schedules for logs, analytics, chat, and file versions.
Keep a living data map linked to each service’s region and subprocessors.

Frequently asked questions

Does open source make us GDPR/NIS2 compliant?: No. Open source improves auditability and exit rights; compliance still depends on lawful basis, DPAs, access control, retention, and incident processes. Self-hosting can simplify residency proofs and worsen outcomes if nobody owns patches and restores.
Should everything be self-hosted?: No. Self-host systems of record where control matters (identity, files, secrets). Keep commodity services hosted when the vendor region and DPA are acceptable and the service is not differentiating. Hybrid stacks are normal for mature teams.
Keycloak or authentik?: Choose Keycloak when you need maximum protocol breadth and existing enterprise patterns; choose authentik when a smaller team wants faster admin UX for OIDC-first apps. Either beats fragmented per-app auth. Pilot SSO on two apps before migrating the whole estate.
What is the cheapest credible starting point?: Vaultwarden + authentik/Keycloak + Nextcloud on infrastructure you already monitor, with Umami or Plausible for site analytics. Defer Matrix until identity and backups are boring. Cost is mostly operator time; hosted FOSS tiers appear when you outsource that time.
Where do I browse options?: Use the self-hosted catalog and stack builder, then read when self-hosting is worth it before expanding scope. For analytics and chat, use the Google Analytics and Slack alternatives pages as category entry points.

Conclusion

A GDPR/NIS2-oriented open-source stack is a control plane decision: one IdP (Keycloak or authentik), one file system of record (Nextcloud), deliberate analytics, vaulted secrets (Vaultwarden), and backups you have actually restored. Start narrow, make operations boring, and only then add chat bridges or ambitious collaboration suites.

If you cannot staff the ops bar yet, prefer hosted open-source with a clear EU region over a neglected Compose file. Sovereignty without restore drills is cosplay.

Official sources & further reading

Nextcloud documentation Keycloak documentation Matomo guides

Turn research into an architecture