Data residency
Where your Ithura workspace's data lives depends entirely on how you run Ithura. There are three deployment modes and the answer is different for each.
The one-line answer
- Self-hosted, on your own hardware or your own VMs: all data stays on the hosts you operate. Ithura's binary makes no outbound calls to any Ithura-controlled endpoint.
- Self-hosted on a cloud provider you contract directly: all data stays within the region and provider you chose. Ithura has no visibility or control over that data.
- Ithura Cloud (managed offering at
ithura.com): all data is stored in the European Union on infrastructure operated by Anorph.
The full stack, by service
An Ithura deployment always has these seven services running on the same host or the same private network. All are open, self-hostable, and speak standard protocols.
| Service | What it stores | Persistent volume |
|---|---|---|
| Postgres | All relational data: users, workspaces, projects, issues, sprints, wiki pages metadata, comments, activity, audit log, sessions, tokens, integrations config, billing | pgdata |
| Valkey (Redis-protocol) | Rate-limit counters, worker queue, short-lived cache | ephemeral by default; can be persisted |
| RustFS (S3-compatible) | Uploaded files, board images, avatars, page attachments, huddle recordings, exports | rustfs |
| Ithura API (single Go binary) | No local state; reads and writes go to Postgres/Valkey/RustFS | none |
| Static SPA server | The compiled React app | none (image content only) |
| Yjs sidecar | In-memory CRDT documents (wiki, boards, pages) while clients are connected; persisted snapshots to Postgres | none |
| LiveKit | In-memory WebRTC session state; recordings written to RustFS when enabled | none |
There is no external database, no external object store, no external cache, no external queue. If you can back up Postgres and the RustFS volume, you have backed up the workspace.
What Ithura's binary calls when it is running
The Go binary makes outbound calls only when your admin has configured a matching integration. The exhaustive list is:
- SMTP relay you configured, for outbound email (invites, mentions, password reset).
- SSO Identity Provider you configured, for SAML assertions.
- SCIM caller if you configured SCIM provisioning (they call you, not the other way around).
- Slack webhooks and API endpoints for the Slack integration and Asks intake if your admin enabled it.
- GitHub, GitLab, Bitbucket API and webhook endpoints for the git integrations you enabled.
- Google Drive, Dropbox API endpoints for file-picker integrations you enabled.
- Stripe API endpoints for billing if you enabled the paid tier on a self-hosted install (most self-hosters do not; billing is not required for the self-hosted product to function).
- Zapier, Make, or a custom webhook subscriber you subscribed to workspace events.
- Optional metrics scraper (Prometheus) if you configured
METRICS_TOKENand pointed a scraper at the endpoint. Ithura does not push metrics anywhere. - Optional OpenTelemetry collector if you set the OTEL environment variables. Ithura does not have a default collector; if the variables are unset, no telemetry is emitted.
There are no Ithura-controlled analytics endpoints, no crash-reporting service, no product-analytics service, no feature-flag service, no license-check callback. A self-hosted Ithura instance with no integrations configured runs indefinitely with zero outbound traffic beyond OS-level DNS, TLS, and NTP.
The managed Ithura Cloud offering
If you use ithura.com instead of self-hosting, the data resides in the
European Union and the following sub-processors are used. This list is
authoritative and updated in the GDPR sub-processor list.
- Anorph (Netherlands) operates the underlying compute and storage.
- Stripe (Ireland) handles billing where you pay for the managed offering. Billing PII (name, billing address, card last-4) is stored by Stripe under their own DPA; Ithura holds only the Stripe customer ID.
- A transactional email provider (currently Gmail SMTP relay under a Google Workspace tenant) delivers outbound email.
No other sub-processor has access to workspace data.
How to answer common residency questions
"Is data ever transferred outside my chosen region?" On self-hosted, no: Ithura writes only to the Postgres and RustFS volumes you provide, and makes outbound calls only to endpoints your admin configured (which you choose the region of). On Ithura Cloud, no: data stays in the EU with the sub-processors listed above.
"What happens to my data if I stop paying / stop using Ithura?" On self-hosted, nothing changes; the software continues to run. On Ithura Cloud, workspace data is retained for 90 days after subscription end, then purged. Documented in the billing lifecycle section of the ops docs.
"Can I export everything?" Yes. The Workspace File export (planned) produces a portable SQLite bundle. Wiki pages export as Markdown or PDF. Boards export as SVG or PNG. Every issue is reachable via the JSON API with a workspace API token.