---
title: "Self-hosted vs cloud billing: how to decide"
url: https://getlago.com/blog/self-hosted-vs-cloud-billing
description: "When to self-host billing and when managed cloud wins: regulated-industry triggers, data sovereignty, cost trade-offs and a decision checklist."
authors: ["Anh-Tho Chuong"]
tags: ["Pricing & Monetization", "Infrastructure"]
published: 2026-02-23
updated: 2026-10-08
reading_time_minutes: 6
---

# Self-hosted vs cloud billing: how to decide

*Last updated: 2026-10-08*

Self-host your billing when a regulation, a customer contract or your security model requires billing data to stay in an environment you control, or when you need to change the billing engine itself. Otherwise, start with managed cloud. Self-hosting buys control, not savings, and the operating work moves from the vendor to your team.

### Two models, defined

**Self-hosted** means you run the billing platform in an environment you control: your AWS VPC, your GCP project, your Azure tenant or your own data center. You install, configure, upgrade and secure it. You own the data, the access model and the right to modify the code.

**Managed cloud** means the vendor operates the platform as a service. Servers, scaling, backups, patches and security infrastructure are the vendor's job. You configure billing and use it.

For usage-based billing, the difference matters more than it does for flat subscriptions. A [usage-based model](https://getlago.com/solutions/use-cases/usage-based) depends on a stream of raw product events. Where those events land, who can read them and how fast they aggregate are architecture decisions, not settings.

Billing data also draws more scrutiny than most application data. A single invoice run touches personal data, payment status, transaction history and contractual pricing terms. A [fintech company](https://getlago.com/blog/fintech-billing) billing across the EU can fall under several frameworks for the same records.

### When self-hosting earns its cost

Four reasons justify the operational overhead.

**Data sovereignty and regulation.** Some regulations or customer contracts require billing data to stay in a specific region or inside your own network.

**Zero third-party access.** If your security model says no vendor can ever reach your billing data, self-hosting is how you guarantee it. Your network segmentation, key management, logging and incident response apply to billing directly, instead of being delegated to a vendor's shared infrastructure.

**Code-level customization.** APIs and configuration cover most billing needs. A minority of teams need to change the engine itself: custom aggregation logic, proprietary pricing algorithms or deep ties to internal systems. An [open-source codebase](https://getlago.com/blog/open-source-billing-tools) lets you do that.

**Vendor independence.** With the [code](https://github.com/getlago/lago) and the infrastructure in hand, a change in a vendor's terms doesn't strand your billing.

> **Not a reason to self-host: payment processor choice.**
>
> Lago keeps metering and pricing independent from payment processing, so you can
>
> [connect the payment provider you already use](https://getlago.com/docs/guide/payments/payment-providers)
>
> on self-hosted and managed deployments alike. Don't take on operations for that.

### When managed cloud wins

Managed cloud is usually the better default when:

- **You need billing running soon.** Self-hosting adds infrastructure planning, deployment and hardening before your first invoice.
- **DevOps capacity is limited.** Uptime, scaling, backups and patches become an ongoing cost in engineering time and risk.
- **You need uptime guarantees.** Multi-region failover and round-the-clock monitoring take real engineering to build yourself. Managed providers can offer them as a contractual SLA.
- **You want updates without upgrade projects.** Managed platforms ship features and security patches continuously. Self-hosted deployments upgrade when you schedule the work.

### The data sovereignty landscape

The EU [Data Act](https://digital-strategy.ec.europa.eu/en/policies/data-act) has applied since 12 September 2025. It sets rules for access to and use of data, including switching between data processing services.

The US [CLOUD Act](https://www.law.cornell.edu/uscode/text/18/2713) requires US electronic communication and remote computing providers to preserve or disclose data in their possession, custody or control, regardless of whether that data is located inside or outside the United States. For teams subject to [GDPR's transfer rules](https://gdpr-info.eu/chapter-5/), that adds a second question to data residency: which jurisdictions can compel your billing vendor to hand the data over.

[DORA](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) has applied to EU financial entities since 17 January 2025. It puts specific requirements on their contracts with ICT third-party providers, covered below.

Self-hosting changes the answer you give an auditor. "On our servers, in our region, under our access controls" is something you can show. "In our vendor's cloud, in the region named in their sub-processor list" depends on a chain of contractual assurances. Both can pass an audit. The first takes less explaining.

### Regulated-industry triggers

The right platform for a regulated company is the one whose deployment model matches the obligations you actually carry. Start by naming them:

- **Healthcare (HIPAA).** Under [HIPAA's Security Rule](https://www.law.cornell.edu/cfr/text/45/164.308), a covered entity can let a business associate handle electronic protected health information only with satisfactory written assurances that it will be safeguarded. If billing data contains PHI, either your billing vendor signs that agreement or the data stays in your own environment.
- **US federal (FedRAMP).** [FedRAMP](https://www.fedramp.gov/) authorizes cloud services that sell to federal agencies. If your contract requires an authorized cloud service and your billing vendor's service isn't authorized, running billing inside your own authorized boundary is the usual path. Some government and defense teams go further, with [air-gapped deployments](https://getlago.com/blog/air-gapped-billing-system).
- **EU personal data (GDPR).** [GDPR Chapter V](https://gdpr-info.eu/art-44-gdpr/) allows transfers of personal data outside the EU only under its protective conditions. Strict interpretations lead some teams to keep billing data in-region or in-house.
- **EU financial services (DORA).** DORA [Article 30](https://www.digital-operational-resilience-act.com/Article_30.html) requires financial entities' contracts with ICT providers to state where data is processed and stored, and, for critical or important functions, to grant access, inspection and audit rights. Self-hosting simplifies those clauses because the provider is you.
- **Contract clauses.** Enterprise customers sometimes require on-premise data handling in the master agreement, regardless of regulation.

None of these rules mandates self-hosting on its own. Each one raises the bar for any third party that touches the data. When that bar is too high for a managed vendor, or clearing it costs more effort than running the system yourself, self-hosting earns its cost.

### Which billing systems can you self-host for data residency requirements?

For strict data residency, you need a billing system you can deploy in the region, network or data center your requirement names, with nothing leaving that boundary by default. In practice that means:

- **The full stack runs in your environment:** API, workers, database, cache and event store.
- **The source code is inspectable,** so your security team can verify what the system does with data.
- **The vendor needs no runtime access** to operate or support it.

Then check the platform itself: [role-based access control](https://getlago.com/docs/guide/security/rbac), [SSO](https://getlago.com/docs/guide/security/sso), [audit logs](https://getlago.com/docs/guide/security/audit-logs) and a vendor security posture you can review. Lago's free and open-source product is [licensed under AGPL-3.0](https://getlago.com/blog/open-source-licensing-and-why-lago-chose-agplv3), and both it and Lago Premium self-hosted run every component in your environment. RBAC, SSO and longer audit-log retention are premium. Lago is [SOC 2 Type II certified](https://getlago.com/docs/guide/security/soc); see [Lago security](https://getlago.com/security) for details.

If your residency requirement is regional rather than network-level, a managed deployment in the right region may also satisfy it. Confirm with your compliance team before you take on the operational load.

### Control, not savings: how the options compare on cost

Total cost of ownership (TCO) is the full cost of running billing over time: license, infrastructure, engineering hours, maintenance and support. Compared on TCO, the three options stack up like this:

1. **Self-hosted open source.** The software license is free. Your cost is infrastructure plus the engineering time to deploy, monitor, secure and upgrade it.
2. **Managed cloud.** One fee covers infrastructure, maintenance, updates and support. Your engineers stay on your product.
3. **Self-hosted premium.** The highest TCO. You pay for a premium license and also carry your own infrastructure and engineering time. At Lago, self-hosted premium is priced above Cloud.

Budget for self-hosted premium as a control decision. Moving between these options is a configuration change, so the first choice doesn't lock you in.

When you build the comparison, record each option's fields explicitly: license or subscription, usage assumptions, included capabilities and add-ons, support and response targets, implementation scope, and who owns infrastructure and operations. Mark anything a vendor hasn't stated as "not stated" rather than estimating it. Lago's [pricing and packaging summary](https://getlago.com/docs/pricing) covers what each Lago option includes and who runs the infrastructure.

Why does self-hosting a premium license cost more than the managed version of the same product? Three cost drivers sit with the vendor, not the customer. Finance teams also experience month-end close, audits and data retention differently under each model. **We cover both in**[**Self-Hosted vs Cloud Billing: The Complete Guide**](https://getlago.com/academy/self-hosted-vs-cloud?utm_source=blog&utm_medium=cta&utm_campaign=self-hosted-vs-cloud-billing)**.**

### Decision checklist

**Lean self-hosted if:**

- A regulation or contract requires billing data to stay in your network.
- You need zero third-party access to billing data.
- You need to modify the billing engine's source code.
- You have the DevOps capacity to run it well, including on-call.
- Control, sovereignty or customization justify a higher TCO.

**Lean managed cloud if:**

- Speed to market matters.
- Your engineering team is small or fully committed to your core product.
- Standard compliance such as SOC 2 and GDPR is enough.
- You want predictable costs and automatic updates.
- You need uptime SLAs and don't want to engineer them yourself.

Unsure? Start managed.

### Ready to set it up?

If the checklist points to self-hosting, the next questions are practical: which components you run, Docker Compose or Kubernetes, and what you own once it's live. Our [step-by-step guide to self-hosted billing](https://getlago.com/blog/self-hosted-billing) covers the setup.

### Get the full guide

The guide breaks down the three cost drivers behind self-hosting, the CFO's view of each deployment model, and a decision framework you can take to your security and finance teams.

[**Download Self-Hosted vs Cloud Billing: The Complete Guide**](https://getlago.com/academy/self-hosted-vs-cloud?utm_source=blog&utm_medium=cta&utm_campaign=self-hosted-vs-cloud-billing)

Want to talk through your requirements? [Book a demo](https://getlago.com/book-a-demo).

### Citations

1. [EU Data Act, European Commission](https://digital-strategy.ec.europa.eu/en/policies/data-act)
2. [18 U.S. Code § 2713 (CLOUD Act), Cornell LII](https://www.law.cornell.edu/uscode/text/18/2713)
3. [GDPR Chapter V, transfers of personal data](https://gdpr-info.eu/chapter-5/)
4. [Regulation (EU) 2022/2554 (DORA), EUR-Lex](https://eur-lex.europa.eu/eli/reg/2022/2554/oj)
5. [DORA Article 30, key contractual provisions](https://www.digital-operational-resilience-act.com/Article_30.html)
6. [45 CFR 164.308 (HIPAA Security Rule), Cornell LII](https://www.law.cornell.edu/cfr/text/45/164.308)
7. [FedRAMP](https://www.fedramp.gov/)
8. [Lago pricing and packaging summary](https://getlago.com/docs/pricing)