Self-hosting or hosted service? A decision guide for small teams

What you are really choosing

Self-hosting means you run the software on infrastructure you control. A hosted service means the vendor runs it and you pay through a subscription or by accepting limits. The trade is control against effort. Neither is universally better, and many teams use both for different tools.

Several products in our catalogue offer both routes. Nextcloud is an open-source file synchronisation platform that can be deployed on infrastructure you control, while Dropbox is a hosted service. Bitwarden and Penpot are open source and can be self-hosted as well as used as services.

What self-hosting gives you

The main benefit is control over where data lives and who operates the service. That can matter for compliance, for privacy preferences or simply for independence from a vendor's pricing changes. It can also lower recurring licence costs, although hosting and support costs depend on how you deploy.

Control is real only if you use it. Deciding the location of your files is not useful if backups are missing or the server is never patched.

What self-hosting takes from you

Every self-hosted service becomes a small piece of operations work. The catalogue records for Nextcloud, Bitwarden and Penpot all make the same point in different words: self-hosting requires administration, backups and infrastructure. Be honest about who will do that work, and what happens when they are on holiday.

• Updates and security patches, applied promptly and tested.
• Backups that are automatic, stored elsewhere and restored in a test at least once.
• TLS certificates, domain names and firewall rules.
• Monitoring, so you find out about downtime before your users do.
• Capacity planning as storage and users grow.
• A named person responsible, and a second person who can step in.

What a hosted service takes care of, and what it does not

A hosted service removes most operations work. You gain managed synchronisation, recovery windows and support, and you pay for it in subscription fees and vendor dependence. Read the plan differences carefully: recovery and version-history windows differ across plans, and team security and administration features are not uniform across tiers.

Hosted does not mean you can forget about backups. If a service is your only copy of important files, an accidental deletion or a locked account can still hurt. Keep an independent copy of anything you cannot afford to lose.

Special care for password vaults

A password manager holds the keys to everything else, so the stakes of a mistake are high. Self-hosting a vault can be appropriate for teams with real operational discipline, but a badly maintained server is a worse risk than a managed one. If you self-host, treat the vault server as critical infrastructure with tested backups and prompt updates. If you do not have that capacity, a hosted plan is a reasonable choice.

A realistic view of the costs

People compare a subscription price with the price of a small server and conclude that self-hosting is cheap. The real comparison includes your time. Count the hours to install, secure and update the service, the cost of storage and off-site backups, and the risk that something breaks at a bad moment. For a team with spare operational capacity those costs can be small. For a team without it, they are often larger than the subscription they replace.

The catalogue records reflect this: hosting and support costs for self-hosted Nextcloud depend on the deployment you choose, while hosted plans tie price to storage and features. Neither number tells you the total until you add your own labour.

Security and compliance considerations

Running a service yourself makes you responsible for its security. That means keeping software patched, limiting who can reach the server, using strong authentication and watching for unusual activity. A vendor that operates thousands of installations has a security team; you have whoever is on your list.

If you handle regulated or client data, check what your obligations are before choosing either route. Sometimes a hosted service with clear certifications and contracts is the easier way to comply, and sometimes keeping data on your own infrastructure is the requirement.

A simple way to decide

Score your situation against these questions. Mostly yes on the first group points toward a hosted service, mostly yes on the second toward self-hosting.

• Hosted: we have nobody with time to run servers; downtime would hurt more than fees; we need vendor support and clear service terms.
• Self-hosted: we have regular operational capacity; data location or independence is a firm requirement; hosting cost and effort are lower than long-term subscription cost.

Always have an exit plan

Whichever route you pick, write down how you would leave it. Know how to export your data in a usable format, how long it would take, and what you would move to. A working exit plan is the best protection against price changes, outages and changes of direction, and it makes the original choice much less risky.