GDPR project management software is software that lets you know where your project data lives, who can see it, and what happens to it, including when AI is involved. No tool makes you compliant on its own; compliance is about how you run it. A self-hosted, open-source tool like AlianHub gives you the strongest starting position: the data sits in your own database, on infrastructure you choose.
Key takeaways
- GDPR is about control and accountability. A tool helps or hurts, but cannot make you compliant by itself.
- The easiest data to account for is data that never left your server.
- Project tools hold more personal data than people think: names, timesheets, leave, client details.
- AI adds a new question: what does the model see, and where does it go?
- Self-hosting plus a local model can keep everything inside your network.
This article is general information, not legal advice. Talk to your data protection officer or a lawyer about your own obligations.
Why project tools matter for GDPR
Project management software rarely gets the same scrutiny as a CRM or an HR system. Yet it often holds:
- Names and emails of every employee, contractor and guest.
- Time entries, timesheets and leave requests.
- Client contacts and details in tasks, comments and attachments.
- Chat messages, sometimes including personal topics.
All of that is personal data. You need to know where it is stored, who can access it, how long it is kept and how to export or remove it when asked.
Hosted vs self-hosted: who holds the data?
| Question | Typical hosted tool | Self-hosted AlianHub |
|---|---|---|
| Where is the data stored? | The vendor's chosen cloud | Your server and your MongoDB |
| Who runs the infrastructure? | The vendor and its sub-processors | You, or a provider you choose |
| Can you read the code? | Usually not | Yes, open source under AGPL-3.0 |
| Who controls backups? | The vendor | You, from Settings, Instance, Backups |
| Can AI run without sending data out? | Depends on the vendor | Yes, with a self-hosted model |
Hosted tools can be perfectly good choices with the right agreements in place. Self-hosting simply removes a whole category of questions.
Tip: whichever tool you choose, write down where your project data lives and who can reach it. That one page answers many of the questions an auditor or client will ask.
The controls that matter in AlianHub
Access
Members have one of four roles: Owner, Admin, Member and Guest. You can add custom roles and custom fields, and run several companies in one instance. The settings sidebar includes Sign-in and SSO, SCIM, and Security and permissions.
Records of activity
The audit log records activity in your workspace, and the Instance console can export an audit CSV. That helps you show who did what.
Backups and restore
Backups are archives you create from Settings, Instance, Backups. Keep at least one copy off the host, and test restores on a separate machine. The admin guide and our backup and restore guide cover the details.
Data import
Moving from another tool? Imports from Jira, ClickUp, Trello, Asana, Monday.com and CSV can be undone, which makes a test migration low risk.
How AlianHub's AI respects your data
AI is where privacy questions are getting sharper. AlianHub's AI features are designed so you decide what the model sees.
Choose where the model runs. Nothing in the product requires AI. When you use it, AlianHub runs on your own LLM API key with multiple providers supported, or on a self-hosted model such as Ollama or vLLM on your own GPU. With a self-hosted model, runs stay inside your network, which suits regulated teams and air-gapped installs.
Agents see only their scope. Agents are members with an owner, a run budget and a scope. Ask answers come only from projects the person can open.
Connected AI acts as you. If someone connects Claude or ChatGPT over MCP, it sees what they can open and changes only what their role allows. Reading chat is a separate permission that never includes direct messages.
AI memory is private. Each person's AI memory, up to 50 short facts, is visible only to them, admins included. When importing memories from ChatGPT, Gemini or Claude, passwords, keys and card numbers are removed first. "Forget everything" clears it.
Everything is logged. Every AI action, whether it acted, proposed or was refused, goes in the audit log.
Privacy and AI are not opposites. You just need to decide where the model runs.
How to do this in AlianHub
- Install AlianHub on a server you control with Docker Compose. MongoDB 7 stays on the internal network only.
- Put a reverse proxy with a certificate in front of port 4000, so everything runs over HTTPS.
- In Settings, Members, invite people with the narrowest role that works; use Guest for clients.
- Set up Sign-in and SSO if your company uses it.
- Decide on AI: set your provider and key, or point AlianHub at a self-hosted model so nothing leaves your network.
- Start agents at L1 so every change waits in the AI Inbox, and scope them to the projects they need.
- Schedule backups and run a restore test on a separate machine.
- Review the audit log monthly, including the "Outside agents" tab for connected AI.
A business scenario: a consultancy with EU clients
A consultancy handles client engagements that include personal data. Clients increasingly ask where their project information is stored and whether AI tools see it.
The firm self-hosts AlianHub on a server in a region it chooses and runs AI on a self-hosted model. When a client asks, the answer is short: data stays on our server, and our AI runs inside our network. Agents in the Client delivery pack draft status updates at L1, so a person approves each before anything changes.
Answering security questionnaires gets quicker because the facts are simple, and the firm can bid for clients with strict data requirements it previously had to pass on.
FAQ
Is AlianHub GDPR certified?
AlianHub does not claim any certification. It is self-hosted software, so how it is deployed and operated decides your position. It gives you control over where data lives and who can access it.
Can AI features work without sending data to a third party?
Yes. You can run a self-hosted model such as Ollama or vLLM on your own GPU, so AI runs inside your network.
Can I export my data?
Backups produce archives you can download from Settings, Instance, Backups, and the Instance console exports an audit CSV.
Who can see a person's AI memory?
Only that person. AI memory is private, admins included, and can be switched off or cleared with "Forget everything".
Want to see the controls first? Explore the live demo or read the AI control page, then self-host AlianHub free. Share this with your DPO before your next tool review.