Self-hosted or cloud ERP: who owns your business data?
With a cloud ERP you rent the system, and what you own when the subscription ends is usually an export file. With a self-hosted open-source ERP you own the system as well as the data, and can keep running it wherever you choose. The option most businesses want sits between the two: an ERP the business owns, on infrastructure someone else runs. This article sets out what you own with each, what South Africa's privacy law asks of you either way, and the questions to ask before you sign.
Three things to own
"Who owns the data" is really three questions.
- The data. Your customers, stock, prices, staff records and ledger. Can you get all of it out, in a form another system can use?
- The custom code. The modules or settings that make the system fit your business. Do they belong to you, and can they run anywhere else?
- The right to keep running the system. If you stop paying the vendor, does the software stop too?
A cloud ERP usually answers the first question reasonably well and the other two poorly. A self-hosted open-source ERP answers all three.
What a cloud ERP leaves you with
Take Odoo's own hosted services as an example, because the same software can also be self-hosted, which makes the difference easy to see.
On Odoo Online, the administrator can download a complete backup of the database from the database manager, and Odoo's privacy policy says the customer keeps ownership and full control of the data. That is better than many services. But three things follow from the terms:
- The licence ends with the subscription. The Odoo Enterprise Subscription Agreement grants the Enterprise licence for the duration of the agreement. When it ends, the licence is revoked and the customer must stop using the software.
- Custom code is restricted. Odoo's documentation says Odoo Online is incompatible with custom modules and with modules from the Odoo Apps Store. Odoo.sh, the developer platform, allows them, with each extra module charged as maintained code.
- The location is the vendor's choice. Odoo's privacy policy lists its hosting regions, none of them in Africa, and states that backups for regions outside Europe are kept in Europe and Canada, with no option to choose or restrict where. The agreement is governed by Belgian law.
Many accounting and ERP services give less. Zoho Books, for example, lets an administrator create a backup of records as CSV or spreadsheet files, with a download link that expires after 30 days. That is a copy of the records, not a working system.
This is what renting means, and it suits many businesses. What matters is knowing it before the data and the business processes are inside.
What POPIA asks of you, wherever the ERP runs
Under the Protection of Personal Information Act (POPIA), the business that decides why and how personal information is processed is the responsible party. Choosing a hosted ERP does not change that.
- Section 19 requires appropriate, reasonable technical and organisational measures to protect personal information in your possession or under your control, and regular checks that they work.
- Sections 20 and 21 treat the hosting provider as an operator. You must have a written contract that requires it to keep the same safeguards and to tell you immediately if it suspects unauthorised access.
- Section 72 restricts sending personal information to a third party in a foreign country. It is allowed only where, for example, the recipient is bound by law or agreement to protection substantially similar to POPIA, or the person concerned consents, or the transfer is needed to perform a contract with them.
An ERP holds personal information about every customer, supplier and employee, so the hosting decision is also a POPIA decision.
The self-hosted middle path
Self-hosting used to mean a server in a back room and someone in the business looking after it. It no longer has to.
With an open-source ERP such as Odoo Community, licensed under the GNU Lesser General Public License version 3, there is no subscription for the licence to end with. The software, the database and the modules built for you are yours to run for as long as you like. The question becomes only who runs the infrastructure, and that can be a service you buy and can change.
| Cloud ERP (rented) | Self-hosted on your own hardware | Self-hosted on Noiz | |
|---|---|---|---|
| Who owns the system | The vendor | You | You |
| Your custom code | Restricted by the platform | Yours | Yours |
| Who runs the servers | The vendor | You | Noiz |
| What you keep if you leave | An export | Everything | Everything |
On a Noiz Cloud server you can run Odoo Community or another open-source ERP yourselves: you hold the server, the data and the administrator account, and Noiz keeps the hardware and the network healthy. With Managed Odoo, Noiz runs the server and Odoo together: updates within your version, a backup of the database and file store before every change, and checks afterwards. If you leave, you receive a final export of your database and file store, and because the software is open source, that export runs anywhere Odoo runs.
For example, a business that starts on a Noiz Cloud server and later wants the server in its own building can move the same database and modules there without rebuilding anything.
Questions to ask before you sign
- If we stop paying, what do we keep, and in what format?
- Who owns the custom modules or configuration you build for us?
- In which country is the data stored, and the backups?
- Will you sign a written operator agreement under POPIA section 21?
- Which law governs the contract?
- How do we take the system, not only the data, to another provider?
Our article on why we choose Odoo ERP explains the case for Odoo in more detail. If you would like to talk through which option fits your business, a ticket reaches the people who run the servers.
Sources
Checked 19 October 2026.
Odoo
- Odoo Enterprise Subscription Agreement, version 13: sections 3, 4.4, 5.1, 6 and 8.1
- Odoo licences
- Odoo Online
- Odoo.sh
- Odoo Privacy Policy
- Odoo Cloud Hosting SLA
Other ERP services
The law
- Protection of Personal Information Act 4 of 2013: sections 19 to 21 and 72
Noiz
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
