Why businesses should consider self-hosting

The real cost of business IT

Entrepreneurs starting a business or running an SME are all too aware of how expensive the essentials are to set up and maintain. This is a real challenge for startups and SMEs, which need to keep their costs to a minimum to survive.

The biggest of those costs is often IT. Most businesses assume it's unavoidable, and that they simply have to pay for Microsoft 365, cloud hosting and the rest. Software licences, cloud subscriptions and hosting all mount up. They also lead to vendor lock-in, leaving businesses beholden to annual price increases and other compromises. But it doesn't have to be this way.

The following is an overview of the essentials a business needs to get up and running, focusing on self-hosted solutions. They put businesses in control, while avoiding pricey software licences and the security compromises that cloud solutions introduce.

Hosting and servers

Many businesses turn to Amazon Web Services (AWS), Google Cloud Platform (GCP) or Microsoft Azure for their hosting, as they've successfully positioned themselves as the market leaders in business-grade hosting. But with them come confusing pricing models, proprietary tools, expensive support contracts and plenty of technical headaches. It doesn't take much digging to find businesses that got a nasty shock when they saw their monthly bill.

To avoid “bill shock”, and the inevitable vendor lock-in of AWS, GCP and Azure, there are better alternatives. A business that needs to provide online services can rent dedicated servers for a fixed cost, and use open-source software, such as Proxmox, to turn them into its own “cloud”. Some infrastructure is better run on hardware in the office, for security and performance. This has the added benefit of no monthly bill: a small server uses only a few pounds of electricity a month. Running your own hardware also gives a business more control and flexibility later on, for maintenance, scaling and connecting other services.

Mail servers

A business needs email accounts from day one, for everyone who works there. They're not just for communication. Email accounts are also the identity people use to log in to almost every other service.

Businesses often sign up to Google Workspace or Microsoft 365 to set up email accounts on their own domain. But these charge per user, per month, and come with real privacy concerns. In 2013, the US government demanded emails that Microsoft held on a server in Dublin. Microsoft refused, and won in court. So the US changed the law. Under the CLOUD Act, American companies can now be made to hand over customer data wherever in the world it's stored, including the UK and Europe. For a UK business, that alone is an extremely good reason to self-host.

Running their own mail server gives businesses full control and visibility over their data, privacy, backups and more. If a business already runs a dedicated server, hosting email on it is a natural add-on.

But email is the hardest service to self-host. Installing a mail server is the easy part. It also needs SPF, DKIM and DMARC records set up correctly, reverse DNS, and a server IP address with a clean reputation. Get any of it wrong, and your messages quietly land in spam folders, or are rejected outright by Gmail and Outlook.

Even when it's all set up correctly, a new mail server has to build a reputation over time, so expect a settling-in period. And no setup can save a server that sends spam. If it's used for unwanted bulk email, it will be blocked, however well it's configured.

That's exactly the kind of fiddly, technical work I take care of: getting it set up right, and keeping it healthy. You get the benefits without the headaches.

File sharing

File sharing is essential for every business, both for working across several devices and for sharing documents with clients and colleagues. WeTransfer and Dropbox might be fine for students, but they lack the security, features and professionalism a business needs. For example, a free WeTransfer link can be opened by anyone who gets hold of it, and there's no record of who downloaded what.

They also mean parking your sensitive files on someone else's servers. You can't see who has access to them, how they're protected, or what else they're used for. Dropbox is an American company too, so the CLOUD Act applies to everything stored there. That's a compliance problem as well. UK GDPR, client contracts and standards such as ISO 27001 all expect a business to know where its data is held, and who can access it.

A self-hosted platform lets businesses share and transfer files just as they would with Dropbox or WeTransfer, but without the limits. It runs on hardware they already have, so there's no extra cost, and no file size caps, expiry limits or price hikes to worry about.

It's more secure, too. Open-source platforms such as Seafile can encrypt files end to end: they're encrypted on your own device before they're uploaded, so not even the server can read them. That also makes it easier to stay compliant with security policies.

And it removes transfer bottlenecks. Inside the office, files move at the full speed of your own network, rather than going out to the internet and back. Outside it, with the rollout of true full fibre (FTTP), it's no longer uncommon for an office to have a gigabit connection or more. Your own server makes full use of it, rather than being held back by a provider's limits.

Conference calls and instant messaging services

Love it or loathe it, every business needs a way to message and meet. Many use Teams, Slack, Zoom or Discord. But each comes with serious compromises: expensive monthly bills, limited call lengths, and a lack of security, as every conversation sits on their servers. They're all American companies, so the CLOUD Act applies here too. Many people also find their interfaces frustrating.

The good news is that there are self-hosted alternatives, such as Matrix for messaging and Jitsi for video calls. They do the same job securely, without limits, and with a polished interface.

They usually give better call quality too, with sharper screen sharing and noticeably less lag. That's because they run on a server set up just for your team, rather than one shared with millions of other users.

Password manager

Businesses often overlook the importance of a password manager, which inevitably leads to security weaknesses. According to a Security.org report, people without one were nearly twice as likely to have had their identity or login details stolen in the year before the report.

Without a password manager, staff tend to store and share passwords in spreadsheets, and reuse the same password across several accounts. Sharing access safely with colleagues becomes a headache, and the business risks breaking security regulations.

Cloud password managers are a big target, because they hold millions of people's passwords in one place. LastPass has had several security breaches. In the worst, in 2022, attackers stole copies of customers' encrypted password vaults. A self-hosted password manager only holds your own business's passwords, so it's a far less attractive target.

Passbolt, for example, also makes good security the easy option. It creates a strong, unique password for every account. Passwords can be shared securely with individuals or teams, with fine-grained access, so each person only sees the ones they need.

It can also store and share the two-factor (2FA) codes for an account. Many services only allow one login, or one 2FA device, per account. With the codes in a shared password manager, your whole team can use that account safely, without passing a phone around or turning 2FA off.

Dedicated VPNs for network access

VPNs have become mainstream in the UK, even if many people aren't really aware of how they work. You can barely watch a YouTube video without an advert for one. And within hours of the Online Safety Act's age checks coming into force on 25 July 2025, Proton VPN, a Swiss-based provider, reported an increase of more than 1,400% in UK sign-ups. For businesses, VPNs are critical in two areas.

The first is protecting staff's internet traffic from snoopers when they're on the go, using public Wi-Fi at an airport, hotel or coffee shop. The second is giving staff secure, encrypted access to the office network when they're not in the office. When the Covid lockdowns began, a VPN was the quickest way to get everyone working remotely, so businesses rushed to set one up.

For the first, a consumer VPN such as Surfshark or NordVPN might be enough. But it can't do the second. A VPN on the business's own infrastructure, such as WireGuard, does both, with the added confidence of knowing all its traffic goes through its own servers.

It also gives your whole team one fixed (static) IP address. You can then whitelist that address in your firewalls, so that sensitive systems, such as servers and admin panels, only accept connections from your own staff. Consumer VPN providers charge extra for a static IP, per user, and across a team that soon gets really expensive. With your own VPN server, it's included.

If your team is spread around the world, you can run your own VPN servers near them. There are server hosting providers on every continent that needs one (sorry, Antarctica), so staff in New York or Sydney connect to a server close by, for a faster connection. Each server still has a fixed IP address that you control and can whitelist.

Git repositories and deployment platforms

Businesses that develop software will often look to GitHub to host their code, and possibly run their pipelines. A self-hosted GitLab offers more DevOps controls, a broader set of features, and a higher level of security. You can keep it on your own network, behind your VPN, so it isn't reachable from the internet at all.

Since Microsoft bought GitHub, many developers have raised privacy concerns. GitHub's Copilot AI was trained on code from public GitHub repositories, and was the subject of a class-action lawsuit over it. And as GitHub is owned by Microsoft, the CLOUD Act applies to your code too. Hosting a private GitLab server avoids all of this, and gives businesses full control, and peace of mind that their code stays private and secure.

Reliability is a concern too. GitHub has regular outages, and in my experience it's getting worse. In 2026, it rate-limited so heavily that I couldn't even run composer install, which downloads PHP packages from GitHub. Many developers worry GitHub will go the way of other Microsoft acquisitions (just look at what happened to Skype). With your code and pipelines on your own server, someone else's outage or policy change can't stop your team working.

GitLab also has built-in CI/CD pipelines and an API, so businesses can build, test and deploy their software automatically, in any way they can imagine.