Which CRM to choose: European, American or self-hosted?

Which CRM should you choose: a European or an American one? Or would it be simpler and better to run a self-hosted solution? In this article we go through the main options, their strengths and limitations, and offer a decision matrix to help you choose what fits your business.

Important: we do not provide legal advice (we are not a Rechtsanwalt). Everything below is based on our own experience and publicly available information.

First, let's define the core problem

The first and most important question is the transfer and storage of personal data outside the EU.

The next important question is the jurisdiction of the legal entity you are working with.

But one question often gets too little attention: who actually owns that legal entity, and who controls it? Take Pipedrive, an Estonian company with data centres in the EU. Since November 2020 its majority owner has been the US firm Vista Equity Partners — and that comes straight from the Newsroom section of Pipedrive's own website.

American CRMs

Using an American CRM is legal today. But nobody can tell you what tomorrow will bring. Data transfers to the US currently rely on the Data Privacy Framework (DPF), approved by the European Commission in 2023. Its legality has already been challenged in court: in 2025 the EU General Court dismissed the action, but that ruling has been appealed.

Today, using an American solution means meeting a number of conditions, for example:

• certification under the Data Privacy Framework (DPF) — check whether the company participates in the programme and whether its certification covers the type of data you need;
• AVV (Art. 28) — a data processing agreement (Auftragsverarbeitungsvertrag);
• an entry in your VVT (Art. 30) — the processing must be documented in your company's record of processing activities;
• Datenschutzerklärung (Art. 13/14) — your privacy notice must describe the processing: how exactly the company processes personal data, with which tools, for what purpose, and so on;
• a Löschkonzept — data lifecycle rules: how long data may be kept, and how and when it is deleted;
• a procedure for Art. 15 (and Art. 16–22) — how you handle requests when someone asks to see, correct or delete their personal data;
• TOMs (Art. 32) — the technical and organisational measures the provider uses to protect personal data;
• where a suitable mechanism like the DPF cannot be used, the transfer must be justified by other legal safeguards: SCCs (Standard Contractual Clauses) + a TIA (Transfer Impact Assessment) + additional technical or organisational safeguards.

Even so, a residual CLOUD Act risk remains, which the DPF does not cover: even after meeting every requirement and applying safeguards, there may still be some risk of US authorities accessing the data.

Not every international company supports the full list of requirements, although most large CRM systems meet the current rules without difficulty and operate on the EU market. The real question is: if the requirements change, will your provider be able to keep up?

European options

With companies under EU jurisdiction that process data exclusively inside the EU, things are somewhat simpler. As a rule they meet the necessary rules and requirements by default and need no additional checks. There are none of the complications that come with transferring data outside the EU.

Still, the list of requirements is almost identical to the American one: AVV (Art. 28), an entry in the VVT (Art. 30), Datenschutzerklärung (Art. 13/14), Löschkonzept, a procedure for Art. 15 (and Art. 16–22), TOMs (Art. 32).

There is one catch that can break the familiar assumption "European SaaS (Software as a Service) = safe SaaS".

Many European cloud services run on Amazon servers and use US sub-processors. Such setups are common, so the claim "your data is stored in the EU" can turn out to be marketing that doesn't reflect reality. Before signing an AVV (Auftragsverarbeitungsvertrag), ask the vendor for its current list of sub-processors and check where they are located and what data they receive.

Self-hosting: pros and cons

If the system runs and is maintained entirely inside your own infrastructure with no external access, far fewer questions arise around external processors and international data transfers. But self-hosting does not exempt you from the GDPR (DSGVO), because your company still processes personal data. So these remain: Datenschutzerklärung (Art. 13/14), an entry in the VVT (Art. 30), TOMs (Art. 32), a Löschkonzept and a procedure for Art. 15.

With SaaS, the provider takes care of most of the technical side. With self-hosting, that responsibility moves to your company:

• server maintenance — keeping the server running, making backups, managing access and monitoring, restoring the system after failures, and so on;
• the duty to update — installing new versions yourself, and above all security patches.

Let's illustrate why regular, timely updates matter using three popular solutions. Here is the number of CVEs (Common Vulnerabilities and Exposures — the registry of known vulnerabilities) published for each in 2025 and 2026.

By CVE ID year, OpenCVE, snapshot of 22.09.2026.

• SuiteCRM — app.opencve.io/cve/?vendor=salesagility&product=suitecrm
• EspoCRM — app.opencve.io/cve/?vendor=espocrm
• Dolibarr — app.opencve.io/cve/?vendor=dolibarr

The number of CVEs measures disclosure discipline, not security. A high count sometimes points not only to problems, but also to transparency and a mature process for finding and disclosing vulnerabilities. To judge security, look wider: how severe the CVEs are (CVSS), how quickly patches ship, and whether known vulnerabilities stay unfixed.

Vulnerabilities in the CRM itself are only a small part of the security picture for a self-hosted CRM. Picture the hierarchy: the CRM runs on PHP → uses a MySQL / PostgreSQL database → requests are served by nginx / Apache → all of it runs in a Docker container → with an operating system at the base. Each of these components has its own vulnerabilities and CVEs.

Our goal is not to scare you, but to be honest about all the possible risks. We always tell clients up front: self-hosted open-source solutions have huge advantages, but they also bring more responsibility and more infrastructure work. As a rule, only the latest 2–3 versions of a product are actively supported. In practice that means installing updates regularly — roughly every 4–5 weeks — and having at least basic technical support for the system.

Key decision factors

There is no single, obvious answer that fits everyone, and there can't be. The right choice depends on your business goals, your data requirements, the infrastructure you already use, and how much control you want to keep.

Your lawyer will help you work through the specific requirements and documents. For most popular solutions you can build the necessary legal and organisational foundation: sign the relevant agreements, verify the transfer mechanism, the sub-processors and the other processing terms.

If you work in the public sector, banking or another strictly regulated industry, this article will not be enough. Here we look at choosing a CRM primarily from the perspective of small and medium-sized businesses. Such companies are flexible enough to choose based on their own needs. If a company is already integrated into a particular big-tech ecosystem, using products from that same ecosystem is the more rational choice, even if the provider is outside the EU. If storing and processing data exclusively in the EU is a hard requirement, the choice narrows — but it is still an entirely realistic and achievable task.

If full control over your infrastructure and data matters most to you, self-hosting is the best fit.

Please note that this article deliberately does not compare the options on cost. With SaaS, the main costs are usually the subscription and the number of users; open-source self-hosted solutions have a different cost structure: hosting, backups, monitoring, updates and technical support. Depending on team size and infrastructure requirements, the total cost can end up lower than SaaS or roughly the same.

What to watch out for

It is important to understand to whom, and how, your CRM passes on your customers' data. If you are dealing with a big-tech ecosystem, built-in AI features are hard to avoid. A modern CRM may use models and services from third-party AI providers: OpenAI, Anthropic, Google, Meta, xAI and others.

On plans below Enterprise, the data processing terms may differ. The agreement may allow data to be used to improve the vendor's own products, or to be processed by third-party providers. As a result, it is no longer one company processing the data but a whole chain of providers and sub-processors. Roughly, it looks like this: a customer gives personal data to your company; your company stores and processes it with a CRM provider; that provider brings in a third-party AI provider, which in turn uses its own sub-processors. When the CRM provider changes or adds a sub-processor, you need to understand how that affects your obligations to your customers and whether you need to take any action.

Ultimately, responsibility towards the customer stays with you. That's why it matters to track changes in the processing chain — for example, sub-processors being replaced or added — and to meet any related notification obligations on time.

Decision matrix

As we said, the best solution depends on your business goals, data requirements, existing infrastructure and the level of control you need. So start by deciding what matters most to you:

• A big-tech ecosystem or AI features are critical → consider an American solution. Plan for sub-processor monitoring and check the transfer mechanism with your lawyer (for example, DPF or SCC + TIA).
• Data and the legal entity must be in the EU, and heavy customisation isn't critical → consider a European SaaS. Before signing, check who owns the company, where the data is actually processed, and the current sub-processor list.
• You need full control over infrastructure and data → go self-hosted. Decide up front who will install updates, make backups and keep an eye on new CVEs. If you don't have your own technical team, support can be handled on a retainer — a service we provide as well.
• You work in the public sector or banking → this matrix is not enough. Such organisations face additional requirements, and choosing a solution needs a separate analysis.

Need help?

We'll help you assess the options against your goals, set up the infrastructure you need, streamline your workflows and account for regulators' technical requirements.

In the next article we'll continue the CRM topic from the technical side: comparing specific solutions, their capabilities, limitations and use cases for different business needs. Follow us on social media so you don't miss it.