Managed or self-hosted
The SaaS versus self-hosted debate is usually settled on licence price or a principle of sovereignty. Both criteria are bad. The right one: who will carry operations.
The question comes up in every platform selection, and it is usually settled for the wrong reasons. On the managed side: "it is cheaper, there is nothing to operate". On the self-hosted side: "our data never leaves, we keep control". Both arguments are slogans, and both run into the same question: who does the work that is left.
Because work is left in both cases. Managed, the vendor operates its servers, not your platform. Configuration, contracts, the deployment chain, observability and consumer management stay with you, along with the whole job described in getting configuration out of the console.
And self-hosted, you keep the control you are able to exercise. It is measured in the skills available, not in where the binaries sit.
What operations really contains
This is the list nobody draws up before deciding, and it fits in six rows.
| Work | Rhythm | Managed | Self-hosted |
|---|---|---|---|
| Product fixes and vulnerabilities | Continuous, urgency imposed | Vendor | You |
| Minor version upgrade | A few times a year | Vendor, often without notice | You, on your own calendar |
| Major version upgrade | Every two to four years | Vendor, with an imposed window | You, several months of project |
| Platform certificates | Quarterly to annual | Shared | You |
| Capacity and load testing | At every traffic tier | You, within the tier you bought | You, entirely |
| On-call duty on the data plane | Permanent | Vendor | You |
The right-hand column reads one way only: it describes a headcount, not a task. The next question is therefore arithmetic.
The questions that really decide
Who holds the on-call rota? That is the first one, and it is often enough. A sustainable rota takes at least four people, failing which it rests on one or two and collapses with the first departure.
And the constraint is not the number of badges. It is the number of people able to diagnose the platform at three in the morning, almost always smaller than the declared headcount. If there are not four of them, self-hosting is a recruitment project dressed up as a technical one. Cost it as such.
Where is your sensitive traffic? The sovereignty criterion is legitimate, but it only holds up with a text in hand. The regimes that really constrain are named and few: HDS certification for health data, SecNumCloud qualification when the contracting authority demands it, the DORA regulation for the financial sector since January 2025, the NIS2 directive for essential entities.
Each carries precise requirements, on hosting, on exit rights or on control of subcontractors. None of them says "no cloud". And when you take the inventory text by text, the constrained share is almost always a minority of the estate. That is what opens the hybrid scenario: the bulk of the traffic managed, a local gateway for the constrained flows, a single control plane for both.
What is your edge latency? A round trip to a SaaS point of presence adds milliseconds that count for high-frequency internal flows. Modern architectures answer with gateways deployed close to the backends and a remote control plane. Check what your candidate really offers in that mode: this is where products differ the most.
Where do the two curves cross? Managed, the bill follows traffic. Self-hosted, it is almost entirely fixed: licence, machines, and above all people. A four-person rota, plus the work in the table above, comes to two to three full-time equivalents. At a fully loaded cost of around one hundred thousand euros a year per experienced platform engineer, that is two to three hundred thousand euros a year before the first licence.
The crossing point is then one division: the annual self-hosted total, divided by the managed unit price of your scenario, gives the volume beyond which managed becomes the more expensive one. Do it with your own figures before the meeting. The result almost always surprises in the same direction, because the human line item is the only one nobody had costed. The full frame is in what an API management platform really costs.
What happens when the vendor has an incident? Managed pools the outages too. Read the real SLA, the public incident history, and above all your own plan: an outage of the managed control plane must leave your gateways serving traffic. That is an architectural property to verify by testing, not on the brochure.
The honest answer
For most organisations with no established platform team, managed is the right default: API management failures come from operations, and managed takes away the most thankless part of it. Self-hosting is justified by named constraints, regulatory, latency or scale, carried by a team that already exists.
And the choice is not final, on one condition set on day one: that the configuration is exportable and that the domain names do not depend on the hosting mode. With those two properties, changing your mind is a project of a few weeks. Without them, it is a migration.
Published in January 2026.
On the same subject