NIS2 and GDPR for MSPs: comparison table and architecture
Deploying a self-hosted mesh VPN control plane ensures metadata, network topologies, and audit logs remain within the managed service provider's sovereign perimeter. However, while on-premises coordination simplifies data residency obligations under Regulation (EU) 2016/679 and Directive (EU) 2022/2555, it does not replace administrative duties, endpoint hardening, or mandatory security incident reporting.
Data types processed by a mesh VPN coordination server
The coordination server communicates via gRPC on TCP port 50051 and stores internal node inventories, public WireGuard keys, fixed addresses inside 100.64.0.0/10, and administrative audit logs. Under Regulation (EU) 2016/679 (GDPR), device names, user identifiers, and mapped network addresses constitute personal or operational identifiers that require documented processing safeguards. Centralising these records on third-party multi-tenant infrastructure introduces data transfer obligations and sub-processor dependencies that European managed service providers (MSPs) must continuously assess.
The data path itself behaves differently because WireGuard holds an individual key pair on each endpoint, eliminating usernames and passwords from transmission entirely. WireGuard is a registered trademark of Jason A. Donenfeld. Because endpoints negotiate direct peer-to-peer tunnels using STUN on UDP port 3478, raw application payloads bypass central servers. When symmetric firewalls or carrier CGNAT prevent direct connections, packets traverse a relay on TCP port 4430 that forwards opaque traffic it cannot decrypt, keeping payload confidentiality intact regardless of network topology.
Control plane hosting options and European regulatory perimeters
The self-hosted package runs three containers with Docker Compose: the coordination server handling gRPC and STUN, the relay, and a PostgreSQL database. It requires Docker Engine 24 or newer with Compose v2 on Linux x86_64 or arm64, consuming 2 vCPU and 2 GB of RAM for hundreds of nodes. Deploying this stack locally ensures that metadata never leaves internal servers, as developed by Sinergia, an engineering company based in Barcelona.
When managing remote client environments, MSPs often compare sovereign models against external coordination planes, as detailed in our analysis of Tailscale alternatives in 2026: comparison table. Tailscale operates its own coordination servers and DERP relays, whereas Headscale offers an open-source self-hosted coordination server compatible with Tailscale clients. Similarly, NetBird provides open-source self-hosted or cloud management, while ZeroTier maintains proprietary network controllers. By contrast, running an on-premises coordination stack removes international data transfer liabilities under Chapter V of the GDPR.
| Architecture model | Metadata residency | Supply chain scope | MSP compliance burden |
|---|---|---|---|
| Multi-tenant SaaS coordination | Hosted in provider clouds across varied jurisdictions | Includes foreign SaaS vendor and upstream hosting providers | Verify vendor international transfers and third-party data agreements |
| Self-hosted coordination on-premises | Retained within local PostgreSQL instance on provider hardware | Restricted to local host environment and base container images | Maintain host patching, backup integrity, and database protection |
| Hybrid coordination with external relay | Metadata stays local while encrypted transit passes shared relays | Local control plane plus relay network infrastructure providers | Monitor relay availability and maintain strict SPKI fingerprint pins |
Compliance responsibilities that self-hosting cannot resolve
Prialo holds no certification under Directive (EU) 2022/2555 (NIS2), Regulation (EU) 2016/679 (GDPR), or Spain's Real Decreto 311/2022 (Esquema Nacional de Seguridad). Retaining cryptographic keys and databases on customer-owned infrastructure removes foreign cloud exposure, but it does not satisfy statutory obligations automatically. An MSP remains entirely responsible for endpoint security, operating system updates, identity lifecycle management, and prompt breach notifications to national competent authorities.
Article 21 of NIS2 obliges essential and important entities to enforce robust access control, network segmentation, and supply chain security policies. When configuring routing into sensitive client networks—such as managing SSH and RDP to Customer Servers: Step by Step for MSPs—the control plane isolates management traffic without opening public router ports. However, the administrator must still enforce granular access controls, ensure enrolment keys expire promptly, and review internal audit logs to prevent unauthorized lateral movement.
Administrative controls and verification for sovereign nodes
Linux and macOS endpoints join the self-hosted network by referencing the coordination server, relay endpoint, and cryptographic SPKI fingerprint during installation.
sudo PRIALO_AUTH_KEY='<enrolment key>' prialo install --server=control.example.com:50051 --relay=control.example.com:4430 --tls-pin=sha256:<fingerprint>- Verify cryptographic pinning by checking that prialo status reports Control: tls, pinned and shows an assigned IP inside 100.64.0.0/10.
- Enforce least privilege subnet exposure by advertising paths with prialo up --advertise-routes=192.168.50.0/24 and requiring explicit approval via prialo node routes <router> --approve 192.168.50.0/24.
- Protect control plane APIs by keeping port 8080 restricted to localhost and accessing management dashboards exclusively through authenticated SSH tunnels.
- Audit node connections regularly using prialo peers, prialo ip, and prialo routes to inspect all active peer routes.
- Revoke stale credentials immediately by expiring reusable enrolment keys or invalidating disconnected systems via prialo logout.
Current platform availability must be factored into deployment timelines: as of 2026-10-17, the self-hosted server and terminal clients for Linux and macOS are fully functional. Windows operates via an early build lacking an installer or digital signature, Mac and iPhone apps remain in Apple's review queue, and Android client support is in preparation.
Frequently asked questions
Does using a self-hosted control plane make an MSP compliant with NIS2?
A self-hosted control plane does not automatically grant NIS2 compliance. It simplifies supply chain auditing by keeping infrastructure metadata under local control, but the MSP must independently implement required operational measures, incident management policies, vulnerability remediation, and continuous network access monitoring.
How does self-hosting the coordination server satisfy GDPR data residency rules?
Self-hosting ensures all personal and operational telemetry, including node labels, public keys, and RFC 6598 addresses, remains in the MSP's own PostgreSQL database. No international data transfers occur because data is not shared with or processed by external foreign multi-tenant providers.
Can relay servers inspect private customer traffic under European privacy rules?
Relay servers cannot inspect or decrypt network traffic. WireGuard establishes end-to-end cryptographic encapsulation between devices. When a relay forwards frames on TCP port 4430 at roughly 23 nanoseconds per frame, it handles only opaque payloads without processing unencrypted personal data.
What hardware resources must an MSP allocate for the self-hosted stack?
The self-hosted stack requires a Linux x86_64 or arm64 host running Docker Engine 24 or newer with Compose v2. Allocating 2 vCPU and 2 GB of RAM provides sufficient capacity to manage coordination, STUN, and database services for hundreds of nodes.
Would you rather run your own server? Guide to the self-hosted prialo package