Your data
Self-hosting means the data is on your box and stays there. This page is the specifics of that: where it sits, how workspaces are separated, and what the instance does not send anywhere.
Where it lives
All state is under ./data/ next to your compose file, in one folder per
service. The databases are in data/db; uploads and images in
data/files; issued certificates and proxy config in data/caddy and
data/caddy-config; installed module code in
data/modules. No named volumes, so the folder is the whole picture:
copy ./data/ and you've copied everything. The backup and restore commands are
in Operating and
Data and backups.
Workspaces are separated at the database
Each workspace gets its own Postgres database, not a shared table with a workspace column filtering the rows. The isolation is structural: one workspace's queries run against its own database and can't see another's. On one box you can host yourself, a household, and a small group, each in its own space, with that wall between them. The concept is covered in Workspaces.
Stored integration credentials (the keys and tokens a workspace enters to connect a service) are encrypted at rest before they hit the database, with the key from Secrets and keys. The workspace that owns them never sees them back in plaintext.
Nothing phones home
The instance makes no unsolicited outbound call. There's no telemetry pinging a central service, no analytics, no error reporting, and no update check. Usage counters and audit records exist, but they're rows in your own Postgres, for your own admin console; they never leave the box.
The only outbound calls are the handful of features that contact a third party when you use them (AI, barcode lookups, the extension catalog), each with an off switch. Those are listed with their switches in Network exposure and Privacy. Turn them off and the instance talks to nothing but the devices on your own network.
Moving off
There's no lock-in to work around, because the data was never anywhere but your disk. You can export a workspace's contents and take restorable snapshots from Backup and export, and the whole-instance folder copy is a portable backup you can restore onto any other box that runs Docker. Nothing about leaving requires cooperation from a service, since there isn't one.