Self-hosted remote desktop data residency

Self-hosted remote desktop data residency means you choose the country of the server that carries the session relay and its records. That is separate from a UK GDPR restricted transfer. DeskZap, remote access software from Hot Rocket Software LTD (UK), supports relay self-hosting on Advanced at £10 per user per month (£100 a year).

Vendors use 'residency', 'sovereignty' and 'UK hosting' as if they were one switch. They are not. Residency is a place. A restricted transfer is a legal test about making personal information accessible to a separate organisation outside the UK. Encryption is a control on who can read the traffic. You can have any one of the three without the other two.

This page uses the ICO's words for the legal test and the NCSC's words for what to ask a cloud service. The product facts are from the DeskZap pricing and features pages, both checked in October 2026.

Data residency

Data residency: the country or region of the server that stores or processes a given set of data. If you cannot name that place, you do not have a residency answer. You have a slogan.

Restricted transfer

Restricted transfer: the ICO's term for making personal information accessible to a separate organisation outside the UK, where UK GDPR applies to your processing and you initiate that access (ICO brief guide to international transfers, updated 15 January 2026, checked October 2026). Letting an overseas support company see a screen can meet that test even if you never email them a file. The ICO's own example is a UK business that gives an Indian service company access to information it already holds.

End-to-end encryption

End-to-end encryption: the session is encrypted between the two computers, so the relay in the middle cannot read the screen. DeskZap, remote access software from Hot Rocket Software LTD (UK), describes its sessions as AES-256 end-to-end encrypted, with the relay forwarding bytes it cannot decrypt (DeskZap features page, checked October 2026). The activity log is not the same object as the screen contents.

Run the ICO's three-step test before you answer a client. Step 1: does UK GDPR apply to the personal information in the session? If the screen shows customer records, staff files or a mailbox, yes. Step 2: are you initiating access by an organisation outside the UK? Step 3: is that organisation a separate legal entity from you? Three yes answers mean a restricted transfer, and every such transfer needs UK adequacy regulations, an appropriate safeguard such as the IDTA, or a valid exception (ICO brief guide, updated 15 January 2026, checked October 2026).

A technician in your own UK company, connecting to your own UK PC, is not that test. A contractor company in another country, given access to the same PC, can be. The ICO is explicit that 'making accessible' counts, not only sending a copy. A remote support session is access.

Adequacy is the simplest legal route where it exists, because information can flow without an extra safeguard. It is not a reason to skip the rest of UK GDPR. The ICO says you still check the organisation you share with under your other duties. If there is no adequacy decision, an appropriate safeguard has to be paired with a transfer risk assessment. If neither fits, an exception has to be necessary and proportionate. If none of those apply, the ICO says you must not make the transfer.

Self-hosting changes the facts you put into that test. It does not delete the test. If you place the relay on a server in the UK and only your own staff can administer it, you have a clear residency statement and a simpler transfer story. If a vendor's staff in another country can still open the admin console, say so. NCSC cloud principle 2 says protection of the assets that store or process your data should include the legislation that data is subject to (NCSC cloud security principles, version 2.1, reviewed 7 June 2023, checked October 2026).

Each row is a need, the fact that decides it, and the DeskZap answer. Prices are from the pricing page, checked October 2026.

Row: You need a country you can point at. Fact: residency follows the server you choose. DeskZap Advanced runs the relay on infrastructure you manage, so the country is the country of that server.

Row: You only need encryption of the screen. Fact: encryption is not location. DeskZap sessions are AES-256 end-to-end encrypted on every plan, and the relay cannot read them.

Row: An overseas company will watch the screen. Fact: that can be a restricted transfer. Complete the ICO three-step test and the safeguard. Self-hosting does not remove their access if you still invite them.

Row: You want the log in the same place as the relay. Fact: the activity log is operational data, separate from the pixels. On a self-hosted relay you decide where that stack runs.

Row: A solo user wants their own two PCs. Fact: they usually do not need to run a server. DeskZap Starter is £5 per user per month or £50 per year, hosted, with 2 managed computers.

Row: A client contract says 'UK infrastructure'. Fact: put the relay on a UK server you control, then write the address and the operator list into the contract. That is an Advanced deployment, at £10 per user per month or £100 per year.

Row: You are tempted to claim the cloud product is 'UK only' without a region. Fact: do not. Say hosted, name the provider arrangement you actually have, and self-host when the sentence has to be precise.

The pricing FAQ states the boundary in one sentence: self-hosting of the relay infrastructure is supported by the DeskZap runtime, and Advanced is the plan for organisations that need data residency control or want the control plane on infrastructure they manage (DeskZap pricing page, checked October 2026). Starter and Business do not add that option.

Advanced is £10 per user per month, or £100 per user per year. Five operators are £50 per month or £500 per year, on top of whatever you pay the server provider. There is no separate infrastructure licence inside the DeskZap price. There is also no operator-side cap on managed computers, and no concurrent session limit (DeskZap pricing page, checked October 2026).

The operator experience stays the one you already use. Named accounts, roles, device groups, TOTP two-factor authentication and the activity log do not become a second product because the relay moved. OIDC single sign-on still connects Google Workspace, Microsoft Entra ID, Okta or another OIDC provider, with an email-domain allow list (DeskZap features page, checked October 2026). That matters because NCSC principle 9 expects role-based control of who can manage the service, and principle 6 expects a high degree of confidence in any provider personnel who can touch your systems (NCSC cloud security principles, checked October 2026). When your own administrators are the people with that access, the confidence is yours to manage.

Session recording with retention is part of DeskZap Support. It sits beside the activity log: who connected, when, to which device, under which policy. USB device redirection and pen support are part of Support too. They do not change where the relay sits.

Write the client note as five lines, then stop.

1. Name the legal entity that runs the relay.

2. Name the country of the server.

3. Say whether a separate company outside the UK can open an admin console or a support session.

4. Say whether screen contents are end-to-end encrypted, and where the activity log is stored.

5. Run the ICO three-step test on any overseas processor and attach the result. The ICO expects that mapping of contracts and flows (ICO brief guide, checked October 2026).

The ICO also expects you to choose a processor that can give sufficient guarantees, and to put Article 32 security duties into the contract (ICO guide to data security, checked October 2026). A residency sentence with no contract is a brochure. A contract with no location is a gap.

For a team that is not ready to run a server, the honest DeskZap deployment is the hosted service on Starter or Business, with the note written to match that fact. For a team whose client will ask for the server's country, Advanced is the plan that makes the sentence true, because you place the relay. The Advanced plan pricing is the number. The security features are the controls that stay in place after the move. The GDPR-conscious remote desktop guide is the longer version of the one-page note.

DeskZap, remote access software from Hot Rocket Software LTD (UK), does not ask you to pretend that encryption and residency are the same word. Hosted plans are priced for teams that want the relay run for them: £5 or £7 per user per month. Advanced, at £10 per user per month, is the plan for the team that has been asked where the server is and needs to point at a machine they control.

You can start on the 7-day Starter trial, prove the session, and move the relay when a contract requires it. You do not rebuild the operator list to do that. That is the buying reason. If a client needs the country named, buy Advanced and name it. If they need the legal test completed because an overseas firm will watch the screen, complete the ICO test as well. Both sentences can be true, and only both are a complete answer.