Most of us got into self-hosting for control, cost, or because some SaaS did something obnoxious. I want to make a case for a fourth reason that I think is underrated here: **jurisdiction.**
Quick version. The **US CLOUD Act (2018)** lets American law enforcement compel any US-headquartered company to produce data it controls, regardless of which country the servers physically sit in. "Data residency in Canada" or "EU region" is a marketing checkbox on a US company's product page. It isn't a legal shield, because the thing being compelled is the company, not the disk.
This is a big part of why self-hosting matters beyond the hobby. When you run it yourself, there's no third party to serve a warrant on. That's not a small property.
I'm Canadian and the trade war is what got me digging into this, so I'll own that bias up front. But the legal mechanism predates all of it and will outlast it, which is why I think it's the argument worth making rather than the flag-waving one.
Below is what I've actually landed on. Tools first, then a few projects out of Canada that I don't see mentioned here much and think deserve a look… (they can have value in any country or jurisdiction).
—
## Three Canadian projects worth your time
Leading with these because they're the part of this post that might actually be new to you.
### Jami
**This is the one I most want people here to look at.** Built in Montreal by Savoir-faire Linux, started life as SFLphone in 2004, became an official GNU package in 2016.
Everything else in the encrypted messaging space, Signal included, still routes through somebody's servers. Encrypted in transit and at rest, fine, but a server exists, a company operates it, and a court can point at that company. Jami removes the server from the data path entirely. It's fully peer to peer, using a distributed hash table for peer discovery, the same approach BitTorrent uses. No central server holding message content, no phone number, no email, no account stored anywhere except on your own device.
For the jurisdiction argument this is about as clean as it gets: there's nothing to subpoena because nobody is holding anything.
* GPLv3, official GNU package, backed by the FSF
* Linux, Windows, macOS, iOS, Android, Android TV
* Text, voice, video, group calls, screen sharing, file transfer with no size cap
* Works over LAN with no internet connection at all
* There's also **JAMS** (Jami Account Management Server) if you want to self-host account management for an org rather than running pure DHT
Trade-offs, because this sub will find them anyway: P2P calls can be unreliable behind restrictive NATs and corporate firewalls where a relayed call would just work. Onboarding is rougher than Signal. Large group calls are less battle-tested. The Android build has historically been heavier on battery than centralized alternatives.
If anyone here is running it in production for a team I'd genuinely like to hear how it's holding up, because most of what I can find is either project documentation or people who tried it for a week.
### CIRA Canadian Shield and CIRA Anycast DNS
CIRA is the non-profit that runs .ca. Their Anycast DNS infrastructure now serves 550+ TLDs globally, and they signed the .ca zone with DNSSEC back in 2013.
**Canadian Shield** is their free public resolver. It blocks malware and phishing using threat data from the Canadian Centre for Cyber Security, which flags roughly 400 new malicious domains a day. Around 500,000 users, about 20 million blocks a month. Three tiers:
* **Private** (149.112.121.10 / 149.112.122.10) — resolution only, no third-party data sharing
* **Protected** (149.112.121.20 / 149.112.122.20) — adds malware and phishing blocking
* **Family** (149.112.121.30 / 149.112.122.30) — adds adult content filtering
DoH and DoT are both supported, and it works fine as an upstream for Pi-hole or AdGuard Home if you want CIRA's threat feed underneath your own blocklists. If you're outside Canada the latency probably isn't worth it, but if you're here it's the highest benefit-per-minute change on this entire list.
They also reinvest their surplus into grants and free security tooling for municipalities, schools and hospitals, which is a nice thing for a registry to do with its money.
### BigBlueButton
Open source conferencing built in Ottawa. Quietly runs a large share of European online education. Self-hostable, and heavier than Jitsi but with much better classroom and moderation features: breakout rooms, whiteboard, polling, presenter handoff, session recording.
If you've been running Jitsi and outgrew it, this is the next step up and it doesn't get talked about here anywhere near enough.
### One with an asterisk: GrapheneOS
The GrapheneOS Foundation is a Canadian federal non-profit incorporated in Toronto in March 2023 (corp #1485757-7), and it holds the project's trademark and IP.
Two things I'd rather say myself than have corrected below:
* The project pushes back on being framed as Canadian. By their own account roughly 20% of the dev team is in Canada, the lead developer is Ukrainian, one director is from Kazakhstan, and they've said relocating the foundation wouldn't be difficult. "Canadian legal base" is accurate. "Canadian project" isn't.
* As of writing, the federal corporate registry shows overdue annual filings and a notice of intent to dissolve. Administrative, fixed by filing, but it's a public record so you'd find it anyway.
Still the best hardened mobile OS available. Just described accurately.
—
## The stack, by effort
### Low effort
| Replacing | With | Notes |
|—|—|—|
| Google Public DNS / 1.1.1.1 | **CIRA Canadian Shield** 🇨🇦 | Two numbers in your router |
| Chrome / Edge | **Firefox**, **LibreWolf**, **Vivaldi** | Vivaldi is Norwegian if you want off US-run projects entirely |
| Google Search / Bing | **Mojeek** (UK, own index), **Startpage**, **Qwant** | Mojeek is the only one here not leaning on Google or Bing |
| LastPass / browser passwords | **Vaultwarden**, **KeePassXC** | Vaultwarden if you want it self-hosted and light |
| Google Maps (mobile) | **Organic Maps**, **OsmAnd** | OSM data, offline, no account |
| Zoom | **Jitsi Meet**, **BigBlueButton** 🇨🇦, **Jami** 🇨🇦 | |
| GitHub | **Forgejo**, **Gitea**, **Codeberg** 🇩🇪 | Forgejo if self-hosting, Codeberg if not |
### Weekend projects
| Replacing | With | Notes |
|—|—|—|
| Google Photos / iCloud Photos | **Immich** 🏆 | Closest thing to full parity on this whole list |
| Dropbox / Drive / OneDrive | **Nextcloud**, **Seafile**, **Syncthing** | Seafile if you only want files and want them fast |
| Spotify | **Navidrome** | Subsonic API, so you get Symfonium, Amperfy, substreamer |
| Audible | **Audiobookshelf** | Excellent mobile app, syncs progress properly |
| Netflix (owned media) | **Jellyfin** | |
| YouTube (hosting your own) | **PeerTube** 🇫🇷 | Federated, ActivityPub |
| Slack / Teams | **Mattermost**, **Rocket.Chat**, **Zulip** | |
| Notion | **AppFlowy**, **Outline**, **Logseq**, **Affine** | Outline if you want a team wiki specifically |
| Trello / Asana | **Vikunja**, **Planka**, **OpenProject** | |
| Nest / Alexa / Ring | **Home Assistant** + **Frigate** + **ESPHome** | Also just better than what it replaces |
| Mint / YNAB | **Firefly III**, **Actual Budget** | |
| Kindle / comics | **Kavita**, **Komga**, **Calibre-Web** | |
| Google Search (self-host) | **SearXNG** | Metasearch, so you're still hitting upstream engines |
| Cloudflare | **Caddy** + **CrowdSec**, or **BunnyCDN** 🇸🇮 | |
### Heavier lifts
| Replacing | With | Notes |
|—|—|—|
| Stock Android / Play Store | **GrapheneOS** + **F-Droid** / **Accrescent** | Pixel hardware required |
| Windows / macOS | **Linux Mint**, **Fedora**, **Debian** | |
| Google Workspace (whole org) | **Nextcloud** + **Collabora** + **Mailcow** | Mailcow is the hard part. Reputation management is a real ongoing cost |
| AWS / Azure / GCP | **Hetzner** 🇩🇪, **Netcup** 🇩🇪, **Infomaniak** 🇨🇭, **OVH** 🇫🇷 | See the note below |
| Colocation | **eStruxture** 🇨🇦, or your local Canadian-owned DC | |
| Route 53 / Cloudflare DNS | **CIRA Anycast DNS** 🇨🇦 | Paid enterprise tier. ISPs and the federal government use it |
—
## About OVH and French hosting, since this sub loves OVH
I know the reflex here is Hetzner or OVH and I'm not going to tell you they're bad hosts. But this is worth knowing before you pick.
In late 2025, GrapheneOS pulled their entire infrastructure out of France and off OVH. Their stated reasoning was that France isn't a safe country for open source privacy projects, that backdoors in encryption and device access are expected there, and that they didn't feel safe using OVH even for a static site served through OVH's Canada and US subsidiaries. They also said they're avoiding travel to France including conferences, and discouraging staff from working from the country. They pointed to Switzerland, Luxembourg and the Netherlands as alternatives that aren't backing Chat Control.
Combined with the ongoing Chat Control push, that's enough for me to default to Germany, Switzerland and the Netherlands. But this is a live dispute rather than settled fact, OVH is competent and cheap, and reasonable people here will disagree. Decide for yourself, just decide deliberately.
—
## Where the honest gaps are
I'd rather you trust the rest of this than think I'm overselling:
* **Self-hosted does not mean non-American.** Home Assistant, Bitwarden, Signal, Firefox are all US-based projects. If your goal is jurisdiction rather than control, self-hosting solves it and choosing a non-US vendor solves it, but "it's open source" by itself doesn't.
* **Email is still the hard one.** Mailcow is fine software. Deliverability and IP reputation are the actual cost, and that cost never goes away. Most people should use Proton, Tutanota or Mailfence rather than self-host
* **Search has no good answer.** SearXNG is a metasearch frontend, so you're still ultimately hitting Google or Bing. Mojeek runs its own crawler but the index is much smaller. There's no self-hosted general web search and there isn't going to be.
* **Nothing replaces iOS.** GrapheneOS needs Pixel hardware. If you're on iPhone, the mobile OS layer is closed to you.
* **Netflix's actual catalogue.** Jellyfin plays what you own. It doesn't license content.
—
## If you do one thing
Change your DNS. Ninety seconds, no migration, immediate benefit.
If you do two, self-host your password manager. Vaultwarden on anything, even a Pi, and now the master key to your entire digital life is on hardware you physically own and in a jurisdiction you actually live in.
Everything else on this list is a project. Those two are an afternoon.
—
Happy to be corrected on any of this, especially the Jami reliability question and anything about CIRA's enterprise tier that I've gotten wrong. I'd rather fix the post than defend it.
Images below, free to repost, no credit needed.
*Disclosure: I used Claude to review this, fix my spelling, build the images and do the markdown. The research, the picks and the opinions are mine, and I run most of this stack myself. I have not yet been able to buy another server to self host an AI due to money things but its on my list. This is not in promotion of a blog or product and I am not being paid in any way to post this. I also work in a Microsoft shop and am typing this in Edge, so I'm aware of the irony.*
Edited to make more factual about my hosting experience
https://www.reddit.com/gallery/1vzkd4f
Source: r/selfhosted · by /u/Wooden_Original_5891