Ask explicitly

• Where database and files live and who controls credentials

• When a provider can access production and whether access is audited

• Export formats for content, media and configuration

• Who owns backups, how they are encrypted and whether restore is tested

• How retention, data requests and erasure work

• What is delivered when hosting or operators change

Control boundary

Self-hosting gives infrastructure control but does not automatically create compliance or security. Accountable owners still need policy, access reviews, patching, monitoring, backups and incident response.

Handover criteria

• Application package and version

• Database schema and migrations

• Configuration and a secure secret-transfer process

• Uploads or object storage

• Install, upgrade, backup, restore and incident runbooks

• Accounts and permissions controlled by the organization