Who Owns Your CRM Data When You Self-Host Mautic?

The short answer: your deployment defines the data boundary

When you self-host Mautic, the database and infrastructure chosen for that deployment are the home for its application records. Deal tracking added inside that installation follows the same operating boundary: your team chooses the database host, access controls, backups, integrations, and retention process. That gives you direct operational control over where core records are stored. It does not, by itself, describe every network path; attachments, license checks, webhooks, backups, and connected services each need to be reviewed separately.

Where Deal Flow records live

Deal Flow adds first-class deal entities to Mautic instead of hosting core deal records in a separate Deal Flow customer-data service. The documented storage map is:

Storage details checked August 29, 2026 against the published Security and Data documentation and the Deal Flow entity documentation.

What self-hosted control changes

Self-hosting moves infrastructure decisions into your operating model. Your team or hosting partner can choose:

• Database placement. Select the database host and region used by the Mautic deployment.
• Administrative access. Decide who receives infrastructure, database, filesystem, and Mautic permissions.
• Backup handling. Choose where database and uploaded-file copies are stored, how long they are retained, and who can restore them.
• Connected systems. Approve integrations, webhook destinations, monitoring services, and other paths that receive application data.
• Lifecycle procedures. Define exports, retention, client handoff, and decommissioning around the infrastructure you operate.

How the boundary differs from a hosted CRM

With a hosted CRM, the vendor operates the application and its primary storage environment. Your team evaluates that vendor's published hosting locations, access model, export tools, backup practices, subprocessors, and deletion process.

With self-hosted Mautic, your organization or chosen hosting partner operates the deployment. Core Deal Flow records use that deployment's database, while uploaded files use its Deal Flow uploads directory. You can align those resources with your own infrastructure plan, but you also own the work of configuring, monitoring, backing up, and recovering them.

This is an architecture choice, not a claim that one model answers every security, residency, or governance question. Evaluate the concrete controls and data paths in the deployment you will actually run.

Draw the external paths too

A useful data map includes more than the primary database. For Deal Flow, review these documented paths:

• License requests. Activation and validation contact the Deal Flow license service with the license key and hostname. Update checks also include the installed plugin version.
• Outbound webhooks. When an administrator enables a webhook, selected deal and contact payloads can be sent to the configured destination.
• Inbound integrations. Authorized sources can create or update records through the documented inbound webhook path, so their credentials and payload retention belong on the same diagram.
• Your infrastructure services. A remote database, backup target, log service, proxy, or hosting control plane may process data according to the architecture your team selected.

External-path details checked August 29, 2026 against the published Security and Data documentation and webhook documentation.

A practical ownership review

Before placing client or company deal records into a self-hosted system, write down the answers to these questions:

1. Where is the Mautic database hosted? Record the provider, region, account owner, and administrators.
2. Where are uploaded files stored? Include the live filesystem and every backup copy.
3. Who can reach each layer? Review Mautic roles separately from server, database, and hosting access.
4. Which connections send data elsewhere? Inventory webhooks, automations, email services, logs, and backup targets.
5. How are records restored or handed off? Test recovery and document what happens when a client, employee, or hosting provider changes.
6. Who reviews the map? Assign an owner and repeat the review when the deployment or integration set changes.

For the broader boundary between contact management, marketing automation, and deal operations, read Does Mautic Have a CRM?. Teams building a product-led revenue process can also see the SaaS founder workflow.

Frequently asked questions

Where does Deal Flow store deal data?

Deal, pipeline, stage, note, task, and deal-contact association records use the database behind your Mautic deployment. Uploaded attachment files use the Deal Flow uploads directory on the infrastructure that runs the plugin.

Does self-hosting mean every data path stays inside one server?

Not by itself. The Mautic database may run on separate infrastructure, and your backup, integration, webhook, and hosting choices can move or copy data across other systems. Review each configured path separately.

Does Deal Flow copy Mautic contacts into a separate customer database?

Contacts remain Mautic contact records. Deal Flow stores the association between a deal and a Mautic contact, including the contact's role on that deal, in the database used by the Mautic deployment.

Does Deal Flow make any external network requests?

Yes. License activation and validation contact the Deal Flow license service. Administrators can also configure outbound webhooks that send selected deal and contact data to their chosen destinations.