Self-hosted compliance software
Consent, contracts, policies, credentials, audits — the paperwork that can sink a small business. These tools keep the records straight on your own server, where compliance data belongs. Every tool below is a one-time purchase — no subscriptions, and your data lives on your own server.
Self-hosted without the assembly
The other answer to “self-hosted” is a repository: clone it, read the compose file, provision a database, wire up mail, then keep it patched yourself. That is a fair answer when running infrastructure is already your job, and we would rather say so than pretend otherwise. Everything on this page is the other kind — all 10 of them. Each is bought once, the full PHP source is in the download, and the web installer finishes on ordinary shared hosting in about two minutes. No Composer, no Node, no build step, nothing to compile, and nothing that phones home.
Privara — Self-Hosted GDPR DSAR Management Portal
Self-hosted GDPR DSAR portal that tracks every request against the one-month period Article 12(3) sets.
Confida — Whistleblowing Portal for EU Directive 2019/1937 (PHP + MySQL, Self-Hosted)
Self-hosted whistleblowing portal for organisations in the scope of EU Directive 2019/1937 (50 or more workers, Article 8(3)): the 7-day acknowledgement and 3-month feedback clocks, tracked per report.
Complia
A self-hosted complaints register with a configurable acknowledgement timer and audit export. The window is a setting — the 29-day default sits one inside the UK statutory 30.
Packora — EPR Packaging Producer Register & Report Builder
Self-hosted per-SKU packaging register for state EPR reporting — exact math, one-time price.
Safora
Replace the paper food-safety diary with auto-flagged deviations and an audit-ready PDF and CSV export.
Waiverly — Digital Waiver & E-Signature Kiosk (PHP + MySQL, Self-Hosted)
Self-hosted digital waivers with a minor/guardian gate and tamper-evident records.
Secreta
Self-hosted, zero-knowledge one-time secret links — your server can't read what it stores.
Certora — Public Certificate Verification Page (PHP + MySQL, Self-Hosted)
Self-hosted certificate verification for training providers and awarding bodies: every certificate carries a unique code an employer can check on a verify page you host yourself.
Supplia — Supplier Register & Contract-Renewal Tracker (PHP + MySQL, Self-Hosted)
Self-hosted supplier & contract register — renewal alerts, expiry warnings, committed spend by category.
Cyresora — NIS2 Incident Reporting Clocks in Hours (PHP + MySQL, Self-Hosted)
Self-hosted NIS2 reporting clocks for essential and important entities: every deadline counted in hours from the moment you found out, with a record of what you sent and to whom.
Compliance Suite
GDPR requests, whistleblowing, NIS2 and CRA reporting, complaints, and packaging EPR — five compliance duties, self-hosted. — 5 of the tools on this page are in it.
Year one, rented
- Concord — $5,988.00 in year one at $499.00/month (their own page, read 2026-09-03; replaced by Supplia)
- ContractSafe — $4,500.00 in year one at $375.00/month (their own page, read 2026-09-03; replaced by Supplia)
Every tool on this page is one payment; the figures above are the vendors' own published monthly prices multiplied by twelve, nothing else.
Replacing what you rent now
Read before you buy
The limitation-smash release: your tools now write to the people they serve — client emails through your own SMTP, calendar feeds, attachments, export presets — every one of them off until you switch it on.
Article 12(3) gives a controller one month to answer a data-subject request — three if it claims the extension — and most track them in an inbox. The rented portals run $9 a month to quote-gated enterprise. The self-hosted case has one argument the SaaS versions cannot make — and one honest limit.
Where your business data physically lives, who can be compelled to hand it over, and what "EU hosting" does and does not buy you. The questions to ask any SaaS vendor, and the case where self-hosting answers all of them at once.
You wired a self-hosted application to a model you do not own. The AI Act assigns obligations to providers and to deployers, and the two definitions do not turn on who wrote the code or where it runs. Article 3(3) and 3(4) quoted from the 27 July 2026 consolidated text, read 6 September 2026, with t
Your developers used an AI assistant to write part of the application. Does that put the application inside the EU AI Act? Here is the Article 3 definition of an AI system and the Article 2 scope provisions, quoted from the 27 July 2026 consolidated text, read 6 September 2026 — and the questions th
Article 50 of the EU AI Act sets transparency obligations — some on the provider, some on the deployer. Here is the Article quoted from the 27 July 2026 consolidated text, read 6 September 2026, with the two definitions it turns on, the dates that govern it, and the questions to put to your adviser.
More self-hosted software: