Cloud vs self-hosted HR software: keeping employee data on your own server

HR software holds some of the most sensitive information a business keeps: names and home addresses, salaries and bank details, attendance, leave, performance notes and sometimes health information. Before you choose a system, it is worth deciding where that information should live and who should look after the servers it runs on. This guide compares cloud HR software, where a vendor runs everything for you, with self-hosted (often called on-premise) HR software, which you install on a server you control. It is general information, not legal advice; for questions about employment or privacy law in your country, speak to a qualified adviser.

What is the difference between cloud and self-hosted HR software?

Cloud HR software is usually sold as software as a service (SaaS). The US National Institute of Standards and Technology (NIST) describes SaaS as one of three cloud service models, alongside platform as a service and infrastructure as a service. With SaaS, the vendor runs the application, the servers and the database, and your team signs in through a browser or an app.

Self-hosted HR software is installed on infrastructure you choose: a server in your office, a virtual private server, or a cloud account that belongs to your business rather than to the HR vendor. The vendor supplies the software and updates; you, or a technical partner you appoint, run it.

The line is not always sharp. Some vendors offer a managed private installation, and some self-hosted products are installed on rented cloud servers. The useful question is not "cloud or not?" but "who controls the server, the database and the backups?"

Who controls the employee data in each model?

With cloud HR software, your employee records sit in the vendor's database, in the regions the vendor chooses or offers. You can usually export data, but the vendor decides how the system is built, when it changes and where copies are kept.

With self-hosted software, the database is on a server you control. You decide where it is located, who has administrator access, how long backups are kept and when data is deleted. That level of control is the main reason businesses choose self-hosting.

Data location matters because many privacy laws regulate personal data that leaves a country or region. The European Commission, for example, explains that when personal data is transferred outside the European Economic Area, special safeguards are needed so that the protection travels with the data, using tools such as adequacy decisions, standard contractual clauses and binding corporate rules. Whichever model you choose, find out exactly where employee data is stored and processed, including backups and support access.

Keep in mind that responsibility for the data stays with you either way. Microsoft's guidance on the shared responsibility model says that for every cloud deployment type, the customer owns its data and identities and is responsible for protecting them.

Who is responsible for security in each model?

Security work does not disappear when you choose cloud software; it moves. Microsoft's shared responsibility guidance puts it plainly: in an on-premises datacentre you own the whole stack, and as you move to the cloud some responsibilities transfer to the provider. In practice, it looks like this:

• Patching: NIST describes patch management as identifying, prioritising, acquiring, installing and verifying patches, updates and upgrades. A SaaS vendor patches its own servers and application. If you self-host, someone on your side must update the operating system, the database, the web server and the HR application itself.
• Backups: a cloud vendor runs backups of its platform, but you should still know how to export your own data. If you self-host, backups are your job. The US Cybersecurity and Infrastructure Security Agency (CISA) recommends keeping offline, encrypted backups of critical data and regularly testing that they can be restored.
• Access control: in both models you manage user accounts, roles and permissions. Microsoft lists accounts and access management, including multifactor authentication, among the responsibilities customers always keep.
• Internet exposure: CISA advises prioritising timely patching of internet-facing servers, especially for known exploited vulnerabilities. A self-hosted HR system that staff reach from their phones is an internet-facing server.

CISA's ransomware guide also notes that small and medium businesses can find it difficult to keep internet-facing servers updated, and for identity and email systems it suggests moving to reputable managed cloud providers to reduce, though not eliminate, maintenance work. That is a fair point to weigh: self-hosting gives you control, but only if someone actually does the maintenance.

If a third party looks after your servers or backups, CISA recommends putting your security requirements into the contract and giving that third party only the access its role requires.

How do the costs compare?

The two models spread costs differently, so compare them over several years rather than month by month.

• Cloud HR software is usually a recurring subscription, often charged per employee or per user. Costs grow as your headcount grows, and you rely on the vendor's pricing staying reasonable. Hosting, security and updates are included.
• Self-hosted HR software is often licensed in a different way, for example a flat price or a price by team size. On top of the licence you pay for a server, someone's time to install and maintain it, backups and monitoring.
• Hidden costs on both sides: data migration, staff training, paid add-on modules, integration work and, at the end, the effort of moving your data out again.

Ask each vendor for a breakdown of every recurring charge, and add an honest estimate of your own team's time for a self-hosted system.

What about integrations and customisation?

Most HR systems need to connect to something else: accounting software, a bank payment file, a CRM, a time clock, single sign-on or a company chat tool. Cloud products often offer ready-made connectors but limit how far you can change the product itself. Self-hosted software can sometimes be extended more freely, because it runs on your server and may expose its database or an API to your own tools, but every change you make is something you have to maintain through future upgrades.

Before you commit, list the systems the HR software must talk to and ask the vendor to show each connection working, rather than promising it.

Which model suits which business?

Cloud HR software tends to suit businesses that:

• have no in-house IT person and no technical partner;
• want the vendor to handle uptime, updates and backups;
• are comfortable with the vendor's data locations and contract terms.

Self-hosted HR software tends to suit businesses that:

• want employee data on a server they control, in a location they choose;
• have someone, in-house or external, who can patch, back up and monitor a server;
• prefer a pricing model that does not rise with every new hire;
• want to brand the system or connect it closely to their own tools.

Office Manager, Dzimark's own HR and payroll product, is one example of the self-hosted approach: its product page describes attendance, leave, payroll, payslips and HR letters, invoices, projects and time tracking, installed on hosting you control. It is self-hosted software, not open-source software.

Which questions should you ask any HR software vendor?

Use these questions whichever model you are leaning towards:

• Where exactly is employee data stored and processed, including backups and support access?
• Who can see our data on your side, and how is that access logged?
• How are security updates delivered, and how quickly after a fix is released?
• What backups are taken, how long are they kept, and how do we test a restore?
• Does the system support multifactor authentication and role-based permissions for HR, managers and staff?
• How do we export all our data, in which formats, if we leave?
• For self-hosted software: what server specification is required, who installs it, and what happens if an upgrade fails?
• Which integrations exist today, and which would need custom work?
• What does every recurring charge cover, and how can prices change?

If your HR system needs to connect to a sales or customer system, our CRM development page explains how we approach custom integrations.

Sources

• NIST: SP 800-145, The NIST Definition of Cloud Computing
• NIST: SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
• CISA: #StopRansomware Guide
• Microsoft Learn: Shared responsibility in the cloud
• European Commission: Rules on international data transfers