Self-hosted vs. SaaS — the GDPR question.

"Self-hosted or SaaS?" is one of the first questions any enterprise asks about CognitoHire. The marketing answer is "yes, both." The honest answer is "it depends, here’s the framework." Most of the time the right answer is SaaS. Sometimes it’s self-hosted. The trick is knowing which case you’re in.

What “data sovereignty” actually means

Data sovereignty is the principle that personal data is subject to the laws of the country in which it is physically stored and processed. For GDPR purposes, this matters because:

• EU personal data must be stored in the EU (or in countries with adequate data protection regimes — the “adequacy” list).
• Cross-border transfers require standard contractual clauses, binding corporate rules, or other lawful mechanisms.
• For highly sensitive data (health, biometrics, candidate evaluations involving protected characteristics), additional restrictions apply.

SaaS providers can absolutely meet these requirements. Most do, through regional deployment, data residency commitments, and SCCs. But there are categories of enterprise where the calculus tips toward self-hosted.

When self-hosted makes sense

1. Government and regulated industries. Defence, healthcare, financial services. The procurement process for these often requires data never to leave a specific physical infrastructure. SaaS is non-starter regardless of compliance posture.
2. Enterprises with their own ML infrastructure. If you already have GPU clusters, model registries, and ML ops teams, self-hosted CognitoHire integrates more deeply with your existing stack.
3. Cross-border privacy concerns. Multinational enterprises hiring across jurisdictions with conflicting privacy regimes. Self-hosted lets you choose the storage location per tenant.
4. Cost at very high volume. Above roughly 50,000 candidates/year, the economics of self-hosted (no per-query API costs) start to dominate.

When SaaS is the right answer

1. SMB and mid-market. Under 5,000 candidates/year, the operational overhead of self-hosting isn’t worth the marginal control benefit.
2. No existing ML ops capability. Self-hosting CognitoHire requires Postgres, Redis, an LLM runtime (Ollama or vLLM), and basic Kubernetes literacy. If you don’t have that, SaaS is materially less risky.
3. You actually want updates. SaaS customers get every update the day it ships. Self-hosted customers schedule their own upgrade cycle.

The decision framework

We use a simple four-question framework with prospects:

• Q1: Are you legally required to keep candidate data on-premises? If yes, self-hosted is your only option.
• Q2: Do you have ML/infra ops capability already? If no, lean SaaS.
• Q3: What’s your annual candidate volume? Under 5K: SaaS. 5K–50K: either works. Over 50K: model the economics carefully — self-hosted likely wins.
• Q4: How important is data residency to your board, your CISO, or your legal team? If it’s a frequently-discussed concern, self-hosted closes the conversation.

The platform is the same in both modes. The difference is who runs it. The intelligence doesn’t change because of where the servers are.

And if you’re not sure: start with the managed cloud pilot. You can always migrate to self-hosted later. We’ve done it for three customers, and the migration is well-documented and supported.