Does self-hosted Moodle cost less than Cornerstone once you count everything?
Moodle removes the license line, but it does not remove the cost of running a learning platform. Self-hosted Moodle is GPL-3.0 software with no license fee, so the saving is real only if the hosting, integration, audit, upgrade and migration work that Cornerstone's subscription currently covers can be carried for less. The answer depends on your own numbers, and the supplied facts do not include Cornerstone's price, so you need to obtain the subscription quote from Cornerstone in writing and compare it line by line against the components below.
Start by listing what the subscription buys today. Cornerstone describes its learning platform as a cloud application that holds ISO/IEC 27001, SOC 2 Type II and FedRAMP Moderate authorization. Those attestations are held by the vendor. If you move to Moodle, the controls behind them become your own control set, and you will need to evidence them yourself or through an independent assessor. Ask your auditor and your security team to estimate that effort before you compare totals, because it recurs every assessment cycle and is not a one-time migration cost.
Then price the components that move to your side of the ledger: the hosting and database tier, backups and disaster recovery, staff or a partner for upgrades and security patching, integrations with your HRIS and content libraries, and the export and migration project itself. Moodle's release cadence and its requirement that sites move to supported PHP and database versions, such as PHP 8.3 or later and PostgreSQL 17 for Moodle 5.3, mean upgrades are a recurring task. Confirm which Moodle release line your organization will standardize on and its support end date, because that date sets your upgrade calendar.
Which cost components change when you move from Cornerstone to Moodle
This table sets each Cornerstone cost component against its self-hosted Moodle equivalent and marks whether it is one-time or recurring. Read it as a checklist for your quote: the rows that recur every year, and the rows that move onto your own team, usually matter more than the license line itself.
| Cost component | Cornerstone (commercial side) | Self-hosted Moodle (open-source side) | One-time or recurring |
|---|---|---|---|
| Subscription or license | Annual subscription priced by Cornerstone, with terms set in your order form. Confirm the renewal date and any uplift clause. | No license fee. GPL-3.0 code, so the cost is the people and infrastructure to run it, plus any paid plugins or managed hosting you choose. | Recurring on the Cornerstone side; Moodle has no license line |
| Content library licenses | LinkedIn Learning, Coursera and Skillsoft are often licensed by the buyer separately from Cornerstone. Check whether those contracts name Cornerstone as the delivery channel and whether they allow other platforms. | Each library must be re-checked for use outside Cornerstone. Some vendors license content only for named platforms, so the integration may need a new agreement before cutover. | Recurring, and often outside the Cornerstone contract |
| Hosting and infrastructure | Included in the subscription. Cornerstone operates the cloud application, databases and availability. | Your servers or cloud account, web and database tier, backups, monitoring and a staging copy for upgrades. Moodle 5.1 requires PostgreSQL 15 or a supported MySQL, MariaDB or SQL Server version, and the document root must point to /public. | Setup is one-time; running costs recur |
| Integrations and HRIS feeds | Connectors to your HRIS and identity provider are configured through Cornerstone, and vendor-supported feeds are included in the service. | Build or configure user feeds with Moodle authentication plugins (LDAP, OAuth 2, SAML2 through a plugin) and your own sync jobs. Each feed needs testing and ongoing maintenance when the HRIS changes. | Build is one-time; upkeep recurs |
| Data export and migration | Transcripts, certifications and user data are exported through Cornerstone's Data Exporter API, which requires OData skills and a clear export scope. | Import SCORM, AICC and xAPI packages and reload learner history from the export. Completion records and certification dates usually need separate mapping and validation, so budget time for reconciliation. | One-time project cost |
| Compliance evidence | Cornerstone describes ISO/IEC 27001, SOC 2 Type II and FedRAMP Moderate authorization for its cloud service. You inherit that evidence only for the parts Cornerstone operates. | You produce the evidence for your own environment: access reviews, change records, backup tests, log retention and vulnerability scans. Independent auditors issue any attestation, and DeployOpen prepares the controls and evidence for that assessment. | Recurring, and grows with audit scope |
| Support and upgrades | Vendor support and platform upgrades are part of the subscription, with support terms set in the contract. | Community forums and documentation are free. Paid support comes from Moodle Partners or a service provider. Moodle 5.1 general support ends 5 October 2026, so plan upgrades against those dates. | Recurring |
| Internal skills | Administrators learn Cornerstone's tools. Vendor training is part of the commercial relationship. | Staff need Linux, database, PHP and Moodle administration skills, or a contracted team that holds them. Plan for at least one owner for patching and upgrades. | Recurring; hiring or contracting is the main cost driver |
What pushes the Moodle total cost up or down
Self-hosted Moodle has no license fee, so its total cost follows the size and shape of your deployment. The drivers below pull the total in different directions, and most of them are set by decisions you make before any server is provisioned.
Active learners and concurrency
Your compute bill depends less on total headcount than on how many learners are active at once, such as during a mandatory annual compliance window when thousands of staff log in within the same hour. Peak concurrency sets the size of the PHP application tier, the database and the cache. Ask your Cornerstone account team for the peak concurrent user figures you pay for today, then compare them with your own log data before sizing a Moodle environment.
Package and data volume
Large SCORM, AICC or xAPI packages and video-heavy courses increase storage, backup size and restore time. Docebo accepts ZIP uploads of up to 2 GB, and Cornerstone and other platforms also set their own limits, so check the package sizes in your library before assuming a limit will not matter. Moodle's storage cost is driven by how much content you keep and how many versions you retain, so an inventory of your library is the first input for a storage estimate.
Availability and disaster recovery targets
A training system that must stay up through a regulator visit or a company-wide certification deadline needs redundant web servers, a replicated database and tested restores. Each step up in uptime target adds hosting capacity, monitoring and on-call effort, and a second site adds cost that recurs every month. Document the recovery time and recovery point your compliance owner expects, because those two numbers determine how much of the Cornerstone cost you actually replace.
Number of integrations
Each HRIS feed, single sign-on connection, content library and reporting export is a component you build, test and maintain yourself. Cornerstone supplies many of these integrations as part of the subscription, while Moodle relies on core authentication plugins such as LDAP, LTI, OAuth 2 and Shibboleth, plus third-party plugins where core does not cover your case. Count your current integrations and mark which ones are native, which need a plugin and which need custom code, since custom code carries the highest ongoing cost.
Compliance scope you must evidence
Cornerstone holds certifications such as ISO/IEC 27001, SOC 2 Type II and FedRAMP Moderate for its cloud service. With Moodle, those attestations do not transfer, so every control covering hosting, access, logging, backup and change management becomes evidence you collect for your own audit. The wider the regulatory scope, the more people hours go into control design and recurring evidence collection, and an independent auditor will charge separately for the assessment itself.
In-house skills in PHP, databases and Linux
Running Moodle well requires people who can operate a PHP application, administer PostgreSQL or MySQL, and manage Linux servers, web server configuration and backups. If these skills exist in your platform team, the added cost is mostly time. If they do not, you will pay for them through a managed hosting partner, a support contract or new hires, and that cost recurs. Check the current Moodle release requirements for PHP and database versions with your team before deciding who runs the platform.
How to build a Cornerstone versus Moodle cost model with your own numbers
This sequence turns a vendor renewal and a Moodle idea into one cost model on a shared written scope, so the comparison rests on your contract, your users and your environment rather than on list assumptions.
Collect the current Cornerstone order form and renewal terms
Procurement and the business owner of training gather the current order form, the signed subscription terms, the renewal notice period and any uplift or true-up clauses. Ask Cornerstone to confirm in writing which modules, user counts and content libraries the fee covers and how overage is billed. The step is done when every recurring charge has a source document and a renewal date you can point to.
List every content library and add-on
The learning operations lead lists each third-party content library, each add-on module and each usage-based charge on the order form, along with its license term. Note which libraries your teams rely on for compliance courses and which you could replace with internally built content. Confirm with the vendor whether a library license can be exported, retained or reused if you leave the platform. The output is a line-item register that separates recurring fees from one-time setup charges.
Inventory integrations and HRIS feeds
The integration owner documents every connection between Cornerstone and other systems, including HRIS user feeds, single sign-on, reporting pipelines and any data warehouse exports. For each one, record the owner, the data it moves, the frequency and whether the vendor bills for the connector or API access. The check is a diagram or table that a Moodle team could read without asking the original builder what it does.
Size the Moodle environment against your counts
The platform team converts your active learner count, peak concurrent sessions, course and file volumes, and retention needs into a sizing sheet for Moodle. Confirm the supported stack for the release you plan to run, such as the PHP, database and web server versions listed in the Moodle release notes, and check the upgrade path from your current version. The output is a sizing document that the hosting team can price against, with the assumptions stated.
Price hosting options with your cloud or data center team
Your infrastructure team prices the sizing sheet on the hosting option you choose, such as your existing cloud accounts, a data center or a managed Moodle provider. Separate compute, storage, backup, monitoring, network and staff time, and state which of these are one-time build costs and which recur each month. Ask a managed Moodle provider to quote against the same sizing sheet. The step closes when each hosting option has a costed line for every component.
Add migration and validation effort
The project lead estimates the effort to reload SCORM, AICC and xAPI packages, migrate completion history and learner records, rebuild recertification rules, and test the results with sample learners. Note who does each task: your staff, an implementation partner, or the vendor under its export terms. Request every partner quote against the same written scope, including deliverables, exclusions and acceptance tests, so the numbers are comparable. The output is a one-time cost block with its assumptions listed.
Add an annual compliance evidence line
The compliance lead adds a recurring line for the work that Cornerstone's own attestations currently cover for you. These include access reviews, change records, backup restore tests, audit log retention and evidence collection for independent auditors, who issue any reports or certifications. Cornerstone describes ISO/IEC 27001, SOC 2 Type II and FedRAMP Moderate authorization for its platform; confirm which of those you would need to evidence yourself. The step closes with a yearly figure and the list of who produces each control artifact.
Compare both options over a period you choose
Finance and the training owner place the Cornerstone renewal and the Moodle option side by side over a period you select, such as the term of the next contract. Show one-time and recurring costs separately, mark which inputs are confirmed quotes and which are internal estimates, and rerun the model with the lowest and highest user counts you expect. The step is done when a reviewer can trace every total back to a source document, a quote or a named assumption.
How Moodle version and database choices shape the running cost
The Moodle version and database you choose set how often you pay for upgrades and how much platform work your team carries each year. Moodle 5.1 requires 64-bit PHP 8.2 or later and PostgreSQL 15, MySQL 8.4, MariaDB 10.11 or Microsoft SQL Server 2017 or later, and a site must already be on Moodle 4.2.3 or later to upgrade. If your current install is older, the first upgrade is a project of its own and should be scoped as one, with the PHP and database changes priced in alongside it. Moodle 5.3 raises the floor to 64-bit PHP 8.3 or later, PostgreSQL 17, MySQL 8.4, MariaDB 11.4 or SQL Server 2019 or later, and upgrades must start from Moodle 4.4 or later. Ask your team which database engine and version you already license or operate, because a database that falls outside these lists adds a migration cost before Moodle itself is touched.
Two settings create recurring work that is easy to miss in a cost comparison. From Moodle 5.1, the web server document root must point to the new /public directory instead of the main Moodle folder, or the site may show directory listings or errors. Your hosting runbooks, reverse proxy rules and deployment scripts all need that change, and the cutover should be tested in a staging copy before production. Version choice also drives upgrade frequency. Moodle 4.5 is a long-term support release with security support until 4 October 2027, and Moodle 5.3 is the next LTS with security support until 1 October 2029. Staying on an LTS line means fewer major upgrades, but each one still needs regression testing of your plugins and integrations. Before you commit to a line, confirm the current support windows on the Moodle releases page, since point releases and dates change.
Questions buyers ask about Cornerstone and self-hosted Moodle costs
Is Moodle free to license for an enterprise training program?
Yes, Moodle's code is licensed under the GNU General Public License version 3, so there is no per-user license fee for the software itself. The costs move elsewhere: servers or cloud accounts, database and PHP operations, backups, upgrades, storage for course content, and the staff or partner time to run the platform. Cornerstone's subscription bundles hosting, operations and its attestations into one fee, so the comparison has to list each of those components on the Moodle side. If you choose Moodle's managed hosting through MoodleCloud or a Moodle Partner, you pay a hosting fee instead of an infrastructure bill. Ask any quote to show each component separately.
How long does a Cornerstone to Moodle migration take?
No fixed duration applies to every program, so treat any single number with caution. The length depends on the number of courses and content packages, how many years of transcripts and certification history you must keep, how many HRIS feeds and recertification rules must be rebuilt, and how much validation your compliance owners require before cutover. Start by inventorying those items. A written scope should state which components move, which stay in Cornerstone during a parallel run, and what acceptance tests show that completion and certification records are correct.
Can our own team run a Moodle migration without outside help?
Some teams can, if they have people who already operate PHP and PostgreSQL or MySQL in production, can manage a web server document root, and understand LMS data models well enough to map certification rules. Moodle 5.1, for example, requires 64-bit PHP 8.2 or later and sites must be on Moodle 4.2.3 or later to upgrade, and from Moodle 5.1 the web server document root must point to the new /public directory. Those prerequisites are manageable but must be checked against your environment. Plan for skills in identity federation, backup and restore testing, and records export, not only installation. Confirm these gaps honestly before deciding who does the work.
What does a fixed-scope DeployOpen engagement cover?
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. A fixed-scope engagement agrees the scope, deliverables and timeline in writing before work starts, so you can see what is in and out. For a Moodle migration that typically means environment design, installation, authentication and user feed integration, content reload, records export and migration, documentation and handover. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. Ongoing support and upgrades are available as retainers.
Do our SCORM and xAPI training packages move to Moodle?
In most cases the original packages can be reloaded, because Cornerstone supports SCORM, AICC and xAPI content and Moodle works with standard packages from common authoring tools. Reloading the content does not move learner history, though. Completion records, scores, transcripts and certification dates must be exported from Cornerstone and mapped into Moodle separately, and the export path and data model should be confirmed before you commit. Test a sample of each package type, including any content from third-party libraries, to confirm launch, tracking and completion behavior in the new environment.
How do we get a quote that compares Cornerstone with Moodle fairly?
Ask both sides to price the same scope, the same user counts and the same retention period. On the Cornerstone side, the current subscription, any content library licenses you keep paying, and any add-on modules for reporting or certification should be listed. On the Moodle side, list hosting or managed hosting, database and storage, backup and disaster recovery environments, authentication and SSO work, integration and data export work, your internal staff time, support or retainer costs, and the audit evidence you will produce yourself. Separate one-time costs such as migration and validation from recurring costs such as hosting, upgrades and support. DeployOpen provides a quote following from a written scope and does not publish a price list.
Which Moodle version should we plan around for a new deployment?
Plan around a version that still receives security support for the length of your planned operation. Moodle 4.5 is a long-term support release from 7 October 2024 with security support until 4 October 2027, and Moodle 5.3 is the next LTS with general support until 4 October 2027 and security support until 1 October 2029, according to Moodle's release schedule. Major releases ship every six months, so confirm the current support window on the release page before you fix a version. Upgrade effort recurs over the life of the platform and should appear as an ongoing line in your cost comparison.
Which Cornerstone-related costs continue after you leave
Check who holds each content library contract before you set a cutover date. Third-party libraries such as LinkedIn Learning, Coursera and Skillsoft may be bought through Cornerstone or contracted directly with the provider, and the two arrangements end differently. If the subscription sits with Cornerstone, the license may stop when your Cornerstone agreement ends, and the courses you were assigned will disappear from your learners' view even though the content still exists. If you hold a direct contract, you keep paying for it after the LMS change, and you may need to reconfigure access from Moodle through the provider's own integration. Pull the order forms, renewal dates and termination notice terms for every library, and ask your procurement team to confirm in writing which party owns each one.
Confirm your records retention obligations before you decide what to export. Training transcripts and certification history are often evidence for regulators, auditors or contract clauses, and the retention period for them is set by your legal, compliance and records teams, not by the LMS. Once you stop paying for Cornerstone, you may still need to keep an archive of exported completions, certificate dates and course versions for years after the learner leaves. That archive has its own cost: storage, backup copies, access controls, and the effort to restore records in a readable form if someone asks for them. Ask legal to define the retention period per record type, and ask your storage team what the archive will cost to hold, search and restore over that period. Treat these terms as decisions to confirm with your legal and procurement teams, not as assumptions carried over from the current contract.
What evidence work moves onto your budget
Cornerstone's attestations cover its platform, but a self-hosted Moodle leaves the evidence for your own controls with your team or your partner. The cards below are the parallel evidence streams that move into your budget, and each one needs an owner, a schedule and a record before an auditor asks for it.
Access reviews
Each review confirms who holds administrator, manager and course-creator roles in Moodle, and that leavers from your HRIS feed no longer have access. Cornerstone runs this inside its own service, so with Moodle you own the recurring review, the approver sign-off and the export of role assignments as evidence. Ask whether your auditor expects quarterly or event-driven reviews, and who in your organization signs them.
Change records for upgrades
Moodle ships major releases in April and October and point releases every two months, so your change log grows faster than a typical SaaS tenant. Each upgrade needs a ticket, a tested staging run, a rollback plan and a record of plugin versions before and after. Confirm your change board's threshold for what counts as a standard change and what it requires from the vendor's release notes.
Backup and restore tests
Backups of the database, the moodledata directory and the code are only evidence once you have restored them into a separate environment and recorded the result. Under Cornerstone this sits with the vendor, but with self-hosted Moodle your team owns recovery objectives, restore drills and the proof that learner records and certificates come back intact. Ask for a dated restore test log, not just a backup job status.
Logging and retention settings
Auditors look for evidence that training records, authentication events and administrative changes are logged and kept for the period your program requires. In a self-hosted Moodle you configure log retention, web server and database logs, and where they are shipped, and you must document each setting. Confirm the retention period your compliance owner requires before setting any value, because the default is not a substitute for that decision.
Independent audit fees
DeployOpen prepares systems, controls and evidence for assessments, but it does not issue audit reports, attestations or certifications. Independent auditors and certification bodies do that work, and their fees are a separate line from implementation. Cornerstone describes ISO/IEC 27001, SOC 2 Type II and FedRAMP Moderate statements on its platform page; confirm with your compliance lead which of these, if any, your program requires you to hold for the training system.
How DeployOpen scopes a fixed-price Moodle implementation
DeployOpen plans, implements, hardens, backs up and documents self-hosted Moodle inside your own cloud accounts, data centers or air-gapped networks. Engagements are fixed-scope, so the costs of hosting, content migration, integrations and your own audit work are agreed in writing before any work starts.
How we scope
- We inventory your Cornerstone subscription components, content libraries and integrations so the written scope names each one.
- The scope lists which Moodle release, PHP version and database engine will be installed, confirmed against the current Moodle release notes.
- We agree in writing which HRIS user feeds, transcript exports and certification rules are in scope and which stay with your team.
How we build
- We install Moodle in your environment, set the web server document root to the /public directory, and configure authentication through your chosen identity provider.
- We reload SCORM, AICC and xAPI packages and test completion and score reporting for each content type before cutover.
- We run security testing against the Moodle deployment and document the configuration evidence your own compliance team will need.
How we hand over
- You receive architecture, configuration, backup and runbook documentation written for your administrators.
- We set up backups and a tested restore procedure, with the upgrade path documented for future Moodle releases.
- Handover covers the controls you now operate yourself, so your compliance owners know what evidence to keep. DeployOpen prepares that evidence but does not issue audit reports or certifications.
How we support
- Ongoing support, upgrades and continuous security testing are available as a retainer after handover.
- Retainer scope, response expectations and upgrade cadence are agreed in writing, so you can ask for them in any quote.
- Ask your DeployOpen contact to confirm how support covers Moodle point releases and plugin updates for your installation.
