Disclosure: I work on Tessera, which is self-hosted. That is the position I am arguing from, and the costs of that position are in the last section.
Security questionnaires ask where customer data is processed. Access-control tools tend to get a shallow answer to that question, because people think of them as gatekeepers rather than as data processors. They are both.
Here is what a hosted access broker necessarily knows about you.
Your infrastructure inventory. Every registered target: hostnames, addresses, cluster endpoints, database names, environment labels. That is a map of your estate, and it is the document an attacker would most like to read before deciding where to spend effort.
Your organisational structure. Who has access to what, which teams exist, who approves for whom, who was granted production access at 2am during an incident. Org charts are inferable from access graphs with unpleasant accuracy.
Your session content, if recording is on. Every command, every query, every screen of output. That includes whatever your engineers pasted into a terminal, which — be honest about your own estate here — includes secrets sometimes.
Timing. When your incidents happen, how long they last, who gets pulled in. That is commercially sensitive on its own.
None of that requires the vendor to hold your credentials. It is the metadata, and the metadata is the part that survives every architectural mitigation.
Where this shows up
GDPR and processor chains. Session recordings contain personal data — identified individuals performing identified actions at identified times. A hosted vendor is a processor, which means a DPA, transfer mechanisms if data leaves the EEA, and a sub-processor list you have to monitor. It also means their sub-processors become your problem, which is a chain you do not control and cannot easily audit.
Sector rules. Financial services, healthcare and public sector procurement in most European jurisdictions have specific requirements about where data resides and who can compel access to it. "The vendor has a region in Frankfurt" answers less of this than people assume, because residency and jurisdiction are different questions, and the second one follows the vendor's corporate structure rather than the location of the disk.
Your own customers' questionnaires. If you sell to enterprises, their questionnaire asks about your sub-processors. An access tool with a hosted control plane is a sub-processor, and it is one you have to justify to every customer who reads carefully.
Availability of the access path. A hosted control plane means your ability to reach your own production depends on a third party's uptime. This is not theoretical — it is the scenario where you cannot log in to fix your outage because their outage is upstream of yours.
What self-hosting changes
The whole thing collapses if the control plane runs inside your perimeter.
The vendor is not a processor, because they process nothing. There is no DPA to negotiate for this component, no sub-processor chain, no transfer mechanism, and nothing to disclose on your own sub-processor list. Data residency is wherever you deployed it, which is a question you already answered for the rest of your infrastructure.
It also removes the vendor's jurisdiction from the analysis entirely. This is the part worth stating plainly, because it is where people get it backwards. Where the vendor is incorporated stops mattering when the vendor never receives the data. A self-hosted tool from a company in Chișinău, Tallinn, Delaware or Singapore has the same data-residency answer, because the answer is determined by where you ran the binary.
The check that makes this real is licensing. A tool that self-hosts but phones home for entitlement still has a channel to the vendor, and that channel carries telemetry — usually usage counts, sometimes more. Offline licence verification, where the entitlement is a file checked locally with no outbound request, is what makes "self-hosted" mean what people think it means. Ask about this specifically during evaluation; it is the difference between a self-hosted product and a hosted product with a local component.
What it costs you
Self-hosting moves the work rather than removing it, and the honest version of this argument includes the bill.
You operate it. Patching, upgrades, backups, monitoring. For a single Go binary plus PostgreSQL that is modest — this is not Kubernetes — but it is not zero, and it lands on a team that already has a queue.
You own the availability. If the broker is in the access path and it is down, nobody gets in. You need a deployment topology, a backup of the encryption and JWT secrets, and a break-glass procedure that does not depend on the broker. Nobody else is going to page themselves about this at 3am.
You own the hardening. A box holding production credentials is a high-value target. TLS terminated properly, PostgreSQL restricted, metrics endpoints protected, and ideally an independent penetration test before go-live. A hosted vendor does some of this for you; when you self-host, you do all of it.
There is no vendor SOC 2 to point at for this component. That cuts both ways. You cannot hand an auditor a third-party report, but you also do not need one, because the component is inside a perimeter you are already attesting to. Which of those is better depends entirely on who is asking.
The trade
Hosted buys you operational simplicity and a compliance artefact, and costs you a processor relationship, a sub-processor chain, and a third party holding a map of your infrastructure.
Self-hosted costs you operational work and gives you an answer to the residency question that does not require anyone to trust a vendor's jurisdiction, including the vendor's.
For most organisations under a few hundred engineers, running one Go binary and one Postgres instance is a smaller ongoing burden than maintaining a processor relationship and defending it in every customer questionnaire. But it is a real trade and it should be made deliberately rather than by default in either direction.
Tessera is self-hosted with offline licence verification — the control plane runs entirely inside your perimeter and makes no outbound requests. https://tessera.company/docs/operations/secure/
Top comments (0)