Spreedly vs Hyperswitch

Spreedly charges a recurring platform fee, and the exact amount and what it includes are set in your contract, so ask the vendor for the written order form. In practice the fee buys the hosted orchestration layer, the connections to its supported gateways, and the hosted vault that holds your card data. Check whether transaction-based charges, gateway pass-through costs, network tokenization, and export or support services are billed separately. Ask for a line-by-line schedule of every recurring and usage-based charge, the renewal terms, and what happens to fees if you export your vault and stop using the service.

Hyperswitch is licensed under Apache 2.0, so the software itself carries no license fee. Your recurring costs move to the infrastructure it runs on, the staff who operate it, and any external services you choose, such as a third-party PCI vault or processor fees charged by your gateways. Confirm the license terms against the repository's current license file, and check whether any hosted features you plan to use, such as the SaaS Hyperswitch Vault, are priced separately from the open-source core.

Most of the one-time cost sits in the initial build: architecture and design, deploying the Router, Scheduler, PostgreSQL and Redis components, configuring gateway connections, building or integrating the vault, and migrating cards. Recurring costs include cloud or data center capacity, database and cache operations, monitoring, patching and upgrades, on-call coverage, gateway and vault service fees, and periodic PCI DSS assessment and penetration testing. Ask any implementation partner to split its written quote into these two groups so you can compare them with your current recurring Spreedly invoice.

Migration cost depends on how many payment methods you hold, how many receiving services accept an export, and how much reconciliation you need. Spreedly documents exporting vaulted payment methods to a PCI compliant third party through a single card export or an encrypted batch file export, with processing generally taking up to two weeks and one free export per merchant per receiving service. Costs rise with the number of receiving endpoints, the need to re-validate tokens, parallel-running periods and any fees the receiving vault charges. Ask the implementer to quote the export handling, token mapping, testing and cutover as separate line items.

The assessment cost depends on your PCI DSS scope, which is set by the vault model you choose. Hyperswitch documents that in the self-hosted, in-house PCI model the merchant is fully responsible for PCI DSS certification and data handling, which typically means the largest assessment and testing effort. Pairing self-hosted orchestration with an external PCI vault reduces the card data environment you must assess, though it adds a vendor fee. Ask any assessor and tester for a written scope, the list of systems in the cardholder data environment, the number of test cycles, and whether retesting after changes is included. DeployOpen prepares systems, controls and evidence for assessments and runs security testing, but independent assessors issue any report or attestation.

On Spreedly, usage-based and per-transaction charges grow with volume, and the platform fee may tier with usage, so check the order form. On a self-hosted Hyperswitch deployment, volume drives compute, database storage and replica capacity, Redis memory, log and metric retention, and bandwidth, while the software license stays flat. Gateway and processor fees grow with volume on both options because you pay those providers directly. Fixed costs include PCI DSS assessment scope and the baseline team. Ask vendors and implementers to model cost at your current and projected volumes, and to state which items are fixed and which scale.

Plan for ongoing work in four areas: upgrades and patching of Hyperswitch, its vault, the database and cache layers, and the Control Center; monitoring, backup and incident response for the payment path; key management and access reviews for the vault; and gateway maintenance when processors change APIs or certificates. Hyperswitch's Control Center supports single sign-on through OpenID Connect only, with no SAML, JIT or SCIM provisioning, so user administration may need manual steps that add to operating effort. Ask for a written support scope, the upgrade and testing approach, the response model, and whether continuous testing or a retainer is included.

Ask each provider for a quote built from a written scope, with deliverables and timelines agreed before work starts. Request the following: the list of gateways and processors in scope, the vault model and PCI DSS responsibilities, the migration plan and export handling, the hosting architecture and its sizing assumptions, the security testing and assessment support, the backup and recovery approach, and the ongoing support model. Ask for one-time and recurring items separately, the volume assumptions behind each usage figure, and any fees for exports, renewals or early termination of your current Spreedly contract. DeployOpen does not publish a price list, so a quote follows from the written scope.

A self-hosted vault takes sustained engineering effort, mostly in setup, key management, hardening and operations rather than in the code itself. Hyperswitch runs a Rust core app server, a separate card vault service, an encryption service for key management, PostgreSQL with a master and replica setup, and Redis. Each of these components needs deployment, monitoring, backup, patching and access control. The effort rises if you choose the in-house vault model, because the merchant then carries full responsibility for PCI DSS certification and card data handling. Ask any implementation partner for a written scope that lists each component, the environments it covers and the operational runbooks it will hand over.

The duration depends on how many gateways you re-point, how many vaulted payment methods you move, and how carefully you phase live traffic. No supplied figure fixes a timeline, so treat any number from a vendor as a claim to test. Spreedly documents encrypted batch exports that are generally processed within 2 weeks, which means the receiving environment must be ready to accept data on that schedule. Other drivers include the number of processor integrations, reconciliation requirements, and how long your team needs to run both platforms side by side. Ask for milestones tied to gateway cutovers rather than a single go-live date.

A team with strong platform engineering, payments integration and security skills can attempt it internally, but the work is wider than a software install. It covers Kubernetes or cloud deployment, vault design, gateway configuration, token migration, PCI DSS evidence and incident response. Many teams combine internal ownership with a fixed-scope engagement for the hardest parts, such as hardening, backup design and assessment readiness. Before deciding, list the skills you have in-house, then compare that list against the components and controls in a written scope. DeployOpen plans, implements, hardens, backs up and documents self-hosted platforms in your own infrastructure, and most engagements are fixed-scope with deliverables agreed before work starts.

Your staff must supply decisions, access and ongoing ownership that no outside party can provide. Expect demands on your payments team to map every active gateway and payment method, on your security team to define vault and key custody rules, and on your infrastructure team to provide the Kubernetes or cloud environment with network controls. Someone accountable must also approve the PCI DSS scope decision and own the evidence afterward. Ask any partner which tasks they expect from your side, how many hours of availability they assume for each phase, and who signs off on cutover criteria.

Hyperswitch documents connections to more than 100 payment processors, including Stripe, Adyen, PayPal, Worldpay and Checkout.com, plus wallets such as Apple Pay and Google Pay. Coverage is not the same as parity with your current setup, so check each processor you use against the Hyperswitch connector list and confirm the features you rely on, such as specific payment methods, regions, 3-D Secure flows and webhook events. Also confirm how Hyperswitch handles routing rules and retries for your traffic, since the documentation describes intelligent routing as a workflow you configure. Build a processor matrix before you commit.

Self-hosting moves card data handling into your own environment, so your PCI DSS scope usually grows unless you reduce it by design. Hyperswitch documents three vault models: self-hosted with its native in-house vault, self-hosted orchestration with an external PCI vault provider such as VGS or Tokenex, and self-hosted orchestration with the SaaS Hyperswitch Vault. The documentation states that in the self-hosted, in-house model the merchant is fully responsible for PCI DSS certification and data handling. Pairing self-hosted orchestration with an external vault can keep your systems out of direct card data storage, but you still need to confirm that choice with your assessor. Note that DeployOpen prepares controls and evidence for assessments but does not issue audit reports or certifications.

Your organization keeps control only if the vault and its keys sit in your environment and you can export your data in a usable form. Spreedly documents exporting vaulted payment methods to a PCI compliant third party through a single card export or an encrypted batch file export, with one free export per merchant per receiving service. Confirm the receiving party, its PCI status and the file format before you request an export. Also decide how long you will keep the Spreedly account active during the transition, because the export must complete before you close it. Ask your partner to document where each key, token and backup lives.

The right choice depends on whether you can staff and assure a self-hosted payments stack, not on a general ranking of the two products. Spreedly offers a hosted vault and gateway connections with its own PCI DSS Level 1 posture, which removes much of the infrastructure burden. Hyperswitch gives you Apache 2.0 code, self-hosted routing and vaulting, and control over data location, at the cost of operating the platform yourself. Evaluate both against your processor list, your PCI DSS scope tolerance, your staffing and your exit plan. Document the decision so that auditors and your board can trace the reasoning.