Hosting models
Vendor-hosted PaaS vs PaaS in your own cloud account
Every PaaS gives you push-to-deploy. The difference is whose cloud account your apps run in. A vendor-hosted platform runs them on its own infrastructure; an own-cloud platform (bring your own cloud, or BYOC) deploys them into an AWS, Google Cloud or Azure account you own. Here is how the two compare, and when each wins.
Updated
| Vendor-hosted | In your own cloud account | |
|---|---|---|
| Control | The vendor chooses the instance types, network layout and regions on offer. You configure your app, not the infrastructure. | The cluster, network and databases are in your account. You can peer networks, use your own security tooling and reach other services in your cloud directly. |
| Compliance | You rely on the vendor's attestations (SOC 2, ISO 27001) and, for health data, its willingness to sign a BAA, often on a higher plan. | Data stays in an account you control, under your cloud provider's attestations and BAA. A security review sees your own AWS, Google Cloud or Azure account, not a third party's. |
| Cost | One bill that includes the compute, at the vendor's markup. Cheapest to start; the markup grows with your usage. | Two bills: the platform's fee and your cloud provider's. Cloud credits and committed-spend discounts apply to the compute. A cluster has baseline costs, so very small apps can cost more. |
| Lock-in | Leaving means moving apps, data and networking to a new host, plus replacing any platform-only features. | The infrastructure is already yours. Leaving the platform means taking over operations of what it set up, not moving the app. |
| Setup | Sign up and deploy. Nothing else to own. | Connect a cloud account and grant permissions first. You also own that account's quotas, limits and support plan. |
| GPUs | Only the GPUs the vendor stocks, if any. | Whatever GPU capacity your cloud account can get, subject to its quotas. |
Vendor-hosted wins when…
- You are a solo developer or a small team shipping a first product, and nobody wants to own a cloud account.
- Your apps are small enough that a cluster's baseline cost would dwarf them.
- You don't handle regulated data, or the vendor's published compliance plan covers what you need.
- You value one bill and one dashboard over control of the network.
Your own cloud wins when…
- Customers or auditors ask where data lives, and "in our own AWS account" is the answer they want.
- You have cloud credits or committed-spend discounts you want your compute to use.
- Your apps need to reach databases or services already running in your cloud, privately.
- You run GPU workloads and want your cloud's GPU capacity.
- You want the infrastructure to stay put if you ever leave the platform.
The middle ground
Some platforms offer both. Northflank runs on its own cloud or yours on published plans; Railway and Vercel list bring-your-own-cloud as an enterprise feature. Google Cloud Run runs in your own Google Cloud project but only on Google Cloud. If you expect to start vendor-hosted and move later, a platform that offers both modes saves you a migration.
Which options run where
Your cloud account, or either
- Porter Your cloud account
- Northflank Vendor-hosted or your cloud
- Qovery Your cloud account
- Google Cloud Run Your cloud account
Questions to ask either kind
- Which regions can my apps and databases run in, and can I pin them to one?
- Can I get your SOC 2 report, and will you sign a BAA? On which plan, at what price?
- What happens to my running apps if I stop paying?
- How do I export my databases, and how long does it take?
- For own-cloud platforms: which permissions do you need in my account, and what do you run there?