On-premise or SaaS: where should confidential business data live?
Published · Digidaya
Software that holds your cost structure, your applicants’ records or your clients’ engineering drawings raises a question that ordinary tools do not: whose servers is it on? Here is how the three options compare, and how we decide for our own products.
Three ways to run business software
SaaS — the vendor runs the software on its own infrastructure and you use it through a browser. Your data lives on servers the vendor operates, usually alongside other customers’ data.
Private VPS — the software runs on a virtual server dedicated to your company, at a hosting provider you choose. Nobody else’s data shares the installation.
On-premise — the software runs on servers your company owns and operates, inside your own network.
How they compare
| SaaS | Private VPS | On-premise | |
|---|---|---|---|
| Where the data lives | Vendor’s servers, shared | A server dedicated to you | Your own servers |
| Time to start | Same day | Days | Weeks |
| Cost pattern | Subscription | Hosting plus licence | Hardware plus licence |
| Who runs updates | Vendor | Shared | Your team, or your partner |
| Control over access | Vendor’s policy | Yours | Yours |
When SaaS is the right call
SaaS is often the sensible default. You start the same day, the vendor handles updates and uptime, and you pay as you go instead of up front. For tools whose data is not especially sensitive, or where the value comes from being shared across organisations, those advantages usually win.
When the data should stay with you
The calculation changes when the data is the business itself. A mining contractor’s cost structure is its competitive position. Applicant records are personal data about real people. An electrical drawing belongs to the client who commissioned it.
For data like this, three questions decide it: who can technically reach the data, who is accountable if it leaks, and whether you can show a client or an auditor exactly where it sits. A private VPS or an on-premise installation gives a direct answer to all three.
In Indonesia there is also a legal dimension. Law No. 27 of 2022 on Personal Data Protection sets obligations for organisations that process personal data, which covers recruitment and assessment records. Where that data sits is part of meeting them; your legal counsel is the right person to say how it applies to you.
Questions to ask before you sign
Where exactly will our data be stored? A country and a provider are the minimum answer. For a private VPS, ask whose account the server sits under, yours or the vendor’s.
Who at the vendor can open it? Support staff often need access to fix problems. Ask how that access is granted, whether it is logged, and whether you can see the log.
How do we get everything back out? Ask for the export format and whether it includes attachments and history, not only the current records. Ask what happens to your data after the contract ends.
Who applies updates, and when? On-premise gives you control over timing, and the duty to keep up. Agree who patches what before go-live.
What does it cost over three years? Compare subscription fees with hardware or hosting, licences, and the hours your team will spend running it. The cheapest first year is not always the cheapest system.
How we decide for our own products
We apply the same test to what we build. SEKALA holds cost structures, SALVAN holds applicant records, and SCHEMAX holds clients’ electrical drawings. All three are deployed only on a private VPS or on the customer’s own servers, and are not offered as SaaS.
Two of our products run as secure SaaS instead: SWAKARA, which turns a description of a business process into a product requirements document, and TETRATALENT, for DISC psychometric assessment. Both are used straight from the browser, with nothing to install.