Key takeaways
- Odoo data lives in more places than the database: the filestore, backups, logs, email and every integration.
- GDPR does not require data to stay in the EU, but transfers outside it need a legal basis, and some contracts and sectors do require it.
- Every company that stores or handles the data for you is a processor, and needs a data processing agreement.
- Choose the server region and the backup location deliberately, and write both down.
This article is general information, not legal advice. Your data protection officer or legal adviser should confirm what applies to your business.
Where your Odoo data actually lives
When people ask where Odoo is hosted, they usually mean the database. In practice the same personal data can be in several places:
- The PostgreSQL database: contacts, orders, invoices, employee records, messages.
- The filestore: attachments such as signed contracts, scanned invoices and ID documents.
- Backups: full copies of both, often in a different place from the server, kept for months.
- Logs: server and application logs can contain email addresses, IP addresses and record names.
- Email: outgoing and incoming mail servers handle every message Odoo sends.
- Integrations: payment providers, shipping carriers, marketing tools and anything connected through the API.
- Staging and test copies: a copy of production holds the same personal data as production.
A data residency plan has to cover all of them, not just the server.
What GDPR asks of Odoo hosting
Controller and processor
Your company decides why personal data is processed, so it is the controller. A hosting provider, cloud provider or backup service that stores the data for you is a processor. GDPR requires a written contract with each processor, usually called a data processing agreement (DPA), covering what they may do with the data, security, sub-processors and what happens when the contract ends.
Transfers outside the EU
GDPR does not say data must stay in the EU. It says that transfers to countries outside the European Economic Area need a legal basis. The main ones are:
- An adequacy decision, where the European Commission has found a country's protection adequate. For the United States, the Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023, covering companies that take part in it (as of October 2026).
- Standard contractual clauses and other safeguards, where there is no adequacy decision.
The European Commission's adequacy decisions page lists the countries covered. The UK has its own, similar rules under the UK GDPR.
When data has to stay in a country
Even where a transfer would be lawful, many businesses choose, or are required, to keep data in one country or in the EU: public sector contracts, healthcare, finance, customer contracts that name a location, or simply a policy decision. In those cases the question is not "is this lawful?" but "can we prove where everything is?".
Choosing where Odoo is hosted
Odoo Online and Odoo.sh
With Odoo's own hosting, you choose a hosting region from those Odoo offers. Odoo's privacy policy states that it is not possible to choose or restrict where backups are stored, and that for some regions backups are kept in another region (as of October 2026). If you need every copy in one country, check Odoo's current policy against your requirements before you commit. Our article on Odoo.sh limitations covers this and the other trade-offs.
Your own server or cloud account
Hosting Odoo on a server you control lets you pick the exact provider and region, for example a data centre in Germany, France or the UK. You also choose where backups go, and you sign the provider's DPA yourself. Most large clouds and many European providers offer one; our guide to running Odoo on Hetzner shows what to check with one EU provider.
Managed hosting providers
With any managed Odoo host, ask four questions before you sign: in which country are the servers, where are backups kept, who are the sub-processors, and is a data processing agreement included? A good provider answers all four in writing, usually on a GDPR or data processing page, and tells you before it adds a new sub-processor.
Data residency checklist for Odoo
- Server region. Pick the country or region your rules require, and record it.
- Backup location. Store backups in the same jurisdiction, or one your rules allow. Offsite does not have to mean abroad.
- Email. Check where your outgoing and incoming mail providers process messages.
- Integrations and modules. List every service that receives data from Odoo, including third-party modules that call external APIs.
- Staging copies. Keep them in the same region as production, and delete them when they are no longer needed.
- Access. Know who can reach the server and the database, including support staff at your providers.
- Contracts. Sign a DPA with each processor, and add the setup to your record of processing activities.
- Retention. Decide how long backups and logs are kept, and make sure old copies are actually deleted.
Our Odoo backup strategy guide helps with the backup and retention points.
Odoo data residency with CloudPilot
Where your Odoo data lives on CloudPilot depends on the plan. CloudPilot's GDPR and data processing page has the full details and the list of sub-processors.
- Pro and Business: your cloud, your region. Odoo databases and files stay on servers in your own cloud account, in the provider and region you pick, or on machines you add over SSH. Backups can go to your own S3-compatible bucket, Azure Blob Storage, Google Cloud Storage or SFTP server, in the region you choose.
- Starter: CloudPilot's shared servers. On Starter, the Odoo database and files are on a server CloudPilot runs in the United States, kept apart from other customers with a separate system user and database role. If your data must stay in the EU or UK, choose Pro or Business instead.
- The control plane. The CloudPilot dashboard and API are hosted in the EU and hold account and configuration data, not your Odoo databases.
- A data processing agreement covering UK GDPR and EU GDPR is part of CloudPilot's terms.
See managed Odoo hosting for how the plans differ, and pricing for each plan.
Odoo, data residency and GDPR: questions
Does GDPR require Odoo to be hosted in the EU?
No. GDPR allows transfers outside the European Economic Area with a legal basis, such as an adequacy decision or standard contractual clauses. Many businesses still choose, or are required by contract, to keep data in the EU.
Do I need a data processing agreement for Odoo hosting?
Yes, with every company that stores or handles personal data for you: the hosting provider, the cloud provider, backup storage and email services. The agreement sets out what they may do with the data and how they protect it.
Are Odoo backups covered by data residency rules?
Yes. Backups are full copies of your personal data, so their location matters as much as the server's. Store them in a jurisdiction your rules allow, and delete old copies on schedule.