Hosted BigBlueButton or self-hosted BigBlueButton: which model fits your classes
Choose hosted BigBlueButton if you want the premium features and a region choice without operating servers. Choose self-hosted BigBlueButton if the meeting servers and recordings must stay in your own infrastructure and your team can size, connect and upgrade them. The decision turns on control and staffing as much as on cost. Official hosting from the project's founders at bigbluebutton.com adds the Enhanced capabilities, including recordings, meeting analytics, personal rooms, guest invites, a dial-in number and increased capacity. Enhanced is sold by the number of concurrent sessions you buy, with no published prices, so the cost depends on your peak concurrency and the quote you receive.
Hosted Enhanced also lets you pick one of four hosting regions for meetings and recordings: North America, Canada, Europe or Asia/Pacific. Confirm with the provider which region holds your recordings, how long they are retained and how they are deleted, since those answers shape privacy review. Self-hosting moves that control to you. You choose the data center, the storage and the retention policy, but you also own the work: a BigBlueButton 4.0 server needs Ubuntu 24.04, 16 GB of memory, 8 CPU cores, 500 GB of disk for recordings, and 250 Mbit/s symmetrical bandwidth, as the BigBlueButton install documentation describes. Plan for the UDP port range, TLS hostnames and a TURN server for users behind restrictive firewalls.
Plan the staffing before the cost. Self-hosted classes need someone to size the servers for peak concurrency, watch bandwidth, apply patches and run upgrades. Direct upgrades from 2.6, 2.7 or 3.0 are not supported for 4.0, so each major move is a clean server installation with data migration. Ask whether your team can absorb that cycle on a fixed schedule. If you run more than one server, the load-balancing design adds further work, which the sibling page on the Scalelite cluster covers. If your team cannot staff this, hosted Enhanced is the stronger fit even though the recurring spend is higher.
Hosted BigBlueButton vs self-hosted BigBlueButton on features, licensing and control
This table sets BigBlueButton Enhanced, the premium hosted service from the project's founders, against BigBlueButton servers you run yourself. Read each row as a question to put to both options: who runs the servers, who pays for capacity, and which features are included. Enhanced has no published prices, so the cost row tells you what to request in a quote rather than what to expect to pay.
| Factor | Hosted BigBlueButton Enhanced | Self-hosted BigBlueButton |
|---|---|---|
| Licensing | Hosted service sold by Blindside Networks under its own terms. Confirm the service terms before signing. | BigBlueButton is LGPL-3.0 licensed, so you can run and modify the open source project under that license. |
| Premium features | Recordings, meeting analytics, active learning activities, personal rooms, guest invites, a dial-in number, account customization and increased capacity. | Audio, video, slides with annotations, chat, screen sharing, polling, multi-user whiteboard, shared notes and breakout rooms. The Enhanced list is not part of the open source feature set. |
| Capacity purchase model | Sold by the number of concurrent sessions purchased, not by server capacity. Prices are not published, so request a quote for your session count. | No session license. Capacity depends on the servers you size, which is governed by the hardware and bandwidth you provision. |
| Hosting regions | Choose from North America, Canada, Europe or Asia/Pacific for meetings and recording storage. | Wherever you place your servers, including your own data centers or cloud accounts in any region you can reach. |
| Where servers run | On the provider's infrastructure, in the region you select. | On your infrastructure, which must meet the sizing in the install documentation: Ubuntu 24.04, 16 GB RAM, 8 CPU cores and 500 GB disk for recordings. |
| Who applies upgrades | The hosting provider manages the platform. Confirm the upgrade schedule and maintenance windows in writing. | Your team or your implementation partner. BigBlueButton 4.0 does not support direct upgrades from 2.6, 2.7 or 3.0, so a clean server installation is recommended. |
| Recordings and data location | Stored in the region you chose at purchase. Confirm retention and deletion terms with the provider. | Stored on your disk, which you size for recordings and back up on your own schedule. |
| Cost structure | Recurring fees by concurrent session count, plus any setup or LMS-provider charges. Ask for every component in the quote. | Hardware or cloud spend, bandwidth, staff time to install and maintain, and any outside support you contract for, including the one-time migration effort. |
What BigBlueButton Enhanced adds beyond the open source server
BigBlueButton Enhanced is the premium hosted version that Blindside Networks, run by the founders of BigBlueButton, sells on top of the open source server. The open source BigBlueButton already gives you audio, video, slides with annotations, chat, screen sharing, polling, a multi-user whiteboard, shared notes and breakout rooms, so the premium layer is not a replacement for the core classroom. It adds a set of extras: recordings, meeting analytics, active learning activities, personal rooms, guest invites, a dial-in number, account customization and increased capacity. For a teaching team, personal rooms and guest invites matter most for recurring use, because instructors keep a fixed room link for each course and can invite guest speakers without creating a new meeting each time. Recordings and analytics matter when staff need to review sessions or measure participation after the fact. The decision turns on whether your team needs those extras more than it needs to own the servers. If your main requirement is a virtual classroom that runs on your own infrastructure, the open source server covers the core functions, and you carry the hosting, sizing and upgrade work described elsewhere on this page. If your team mainly wants the hosted extras and has no requirement to keep meeting traffic on its own hardware, the premium route removes much of that operating load. Ask Blindside Networks or your LMS provider to list, in writing, which features are included at each tier, how the concurrent session count is measured, and whether recordings and analytics are covered by the same plan as increased capacity.
Before you sign, confirm the hosting region, the recording retention terms and the data handling that apply to your users. BigBlueButton Enhanced customers choose one of four regions for hosting meetings and storing recordings: North America, Canada, Europe and Asia/Pacific. Check that the region you pick matches your data residency rules and that recordings are stored where your policy allows. Ask whether guest invites and dial-in numbers add cost or count against the concurrent session pool, since those features are the ones most likely to change usage. Premium pricing is sold by the number of concurrent sessions purchased and has no published prices, so the quote depends on your peak concurrency rather than on total enrolments. Request the quote against a written usage profile, including the peak number of simultaneous classes, expected recording volume and the number of instructors who need personal rooms.
Where data lives and who controls access in each model
Hosted BigBlueButton Enhanced and a self-hosted server differ most on who holds the servers, the recordings and the shared secret. The cards below set out the decisions each model leaves with your team and the questions to put to the vendor before you sign.
Data location for meetings and recordings
Enhanced lets you choose one of four hosting regions for meetings and recordings: North America, Canada, Europe or Asia/Pacific. With self-hosting, the location is whatever data center or cloud account your team picks, and that choice carries your own residency obligations. Before committing, confirm in writing which region holds live media, recordings and any logs, and whether backups leave that region.
Administrative control and access
On Enhanced, the vendor operates the platform and you manage meetings, accounts and customization within its tooling. A self-hosted server gives your administrators root access, control over firewall rules, operating system patching and who can reach the host. That control also means your team carries the access reviews, privileged account logging and incident response that the vendor would otherwise handle.
Shared secret and API checksums
Every BigBlueButton API call carries a checksum computed from a secret shared with the server, which defaults to SHA-256. The docs warn never to embed that secret in a web page, so the LMS or portal calling the API must compute checksums server side. Self-hosting makes you responsible for rotating the secret, restricting who can read the server configuration, and confirming that your integration never exposes it to browsers.
Identity integration with Greenlight v3
Greenlight v3 supports external authentication through OpenID Connect, configured with environment variables. The docs suggest Keycloak as a broker to add Google, Microsoft, SAML and other login methods. Self-hosting means you run Keycloak and the OIDC client configuration yourself, including token lifetimes and user deprovisioning. Confirm how each hosted plan handles single sign-on before assuming it is available.
Audit evidence and certifications
Ask the vendor in writing which certifications, attestations and data processing terms apply to the hosted service, and whether they cover Enhanced regions you would use. Self-hosting shifts that proof to your own controls, logs and change records. DeployOpen prepares controls and evidence for an independent auditor, but it does not issue audit reports, attestations or certifications, so the assessment itself must come from an independent body.
Which model fits each team situation
An institution that runs classes on a fixed timetable usually cares most about reliable capacity at known peak times, recordings that teachers can find, and an integration with its learning management system that staff do not have to maintain. Hosted BigBlueButton Enhanced is sold by the number of concurrent sessions purchased, so the first step is to count peak concurrency from your timetable rather than total users. Self-hosting shifts that sizing into your own hardware and bandwidth plan.
- Peak concurrency: Map the busiest hour of the week to concurrent sessions, then ask the vendor how a session bundle is priced and what happens when you exceed it.
- Recording storage: Self-hosted servers need disk planned for recordings, which the install documentation sizes at 500 GB for a 4.0 server with recording enabled. Confirm retention rules before you buy disk.
- Premium features: Check whether recordings, analytics, personal rooms and guest invites are needed, because those are the Enhanced capabilities.
- Upgrade windows: Ask who schedules upgrades around term dates, since direct upgrades from 2.6, 2.7 or 3.0 are not supported.
- Integration owner: Confirm who maintains the LMS plugin or LTI setup after go-live.
Before you commit, ask the vendor for the concurrency tier that covers your peak hour and the regions where recordings are stored.
An organization whose data residency policy or internal network rules require servers inside its own cloud account, data center or isolated network needs to compare more than price. Hosted Enhanced offers four hosting regions, namely North America, Canada, Europe and Asia/Pacific, and those may or may not match where your data must sit. Self-hosting gives you control of location and network path, but it also makes you responsible for ports, certificates and sandboxed document conversion.
- Region match: Compare the four hosting regions with your residency requirement for both meeting traffic and recording storage.
- Network requirements: Plan for TCP 80 and 443, UDP 16384 to 32768, a valid hostname for SSL, and a TURN server for users behind restrictive firewalls.
- Identity integration: Greenlight v3 supports OpenID Connect through environment variables, and the docs suggest Keycloak for SAML and other login methods. Confirm which identity provider you must use.
- API secret handling: Every API call needs a checksum from a shared secret, so define where that secret lives and keep it out of web pages.
- Evidence: Ask for the logging and access records your auditors will expect, since DeployOpen prepares evidence but does not issue audit reports.
An implementation partner can plan the network build, but confirm the residency terms in writing with the hosting vendor and your own compliance team.
A small team that runs meetings a few times a month usually values low administration more than control of every component. For this group, the hosted model removes most server work, while self-hosting is only worth the effort if a rule, a budget structure or a need for custom integration makes it necessary. Both paths should be judged by how often someone must touch the platform after the first week.
- Admin hours: Estimate who would patch the server, renew certificates and watch disk for recordings, and whether that person exists.
- Session pattern: Occasional meetings may fit a small concurrency bundle, so ask how many concurrent sessions you actually need.
- Features used: If you only need meetings and screen sharing, the open-source feature set may be enough, while analytics or personal rooms point toward Enhanced.
- Hardware floor: A self-hosted 4.0 server needs 16 GB of memory, 8 CPU cores and 250 Mbit/s symmetrical bandwidth, which is a fixed cost even when usage is light.
- Exit path: Ask how recordings and user data would move if you change model later.
Ask the vendor for a written price based on your concurrency figure and confirm the hardware and bandwidth costs with your own infrastructure provider.
What your team runs in each hosting model
This table sets out who does each piece of BigBlueButton work when you run your own servers and when you use official hosting from the project's founders. Read each row as a question to answer before you pick a model, then use the confirm column to pin down what a hosted provider covers in writing.
| Requirement | Self-hosted: your team owns it | Hosted: what to confirm with the vendor |
|---|---|---|
| Server sizing | Choose and provision a host with at least 16 GB of memory with swap and 8 CPU cores with high single-thread performance, per the BigBlueButton 4.0 install docs. Size up as concurrent sessions grow. | Confirm how capacity is allocated, since BigBlueButton Enhanced is sold by concurrent sessions purchased, and what happens when you exceed them. |
| Disk for recordings | Provide 500 GB of disk if you record, or 50 GB without recording, and plan retention and backups yourself. | Confirm recording storage location within the four hosting regions, retention periods and how recordings are exported or deleted. |
| Bandwidth | Provide 250 Mbit/s symmetrical bandwidth on the server and check it with your upstream provider. | Confirm the regional media path and any bandwidth limits or fair-use terms in the contract. |
| Network ports | Open TCP 80 and 443 and UDP 16384 to 32768, and make sure no other web server already uses 80 or 443. | Confirm which ports and protocols your users need and whether your institution's firewall rules must change. |
| SSL and hostname | Own a valid hostname, obtain the certificate and renew it on schedule. | Confirm who manages the domain, certificate issuance and renewal for your branded address. |
| Docker for LibreOffice conversion | Install Docker so document conversion runs in a sandbox, and keep it patched. | Confirm whether document conversion for slides runs on the provider side and how uploads are isolated. |
| TURN server | Decide whether you need a TURN server for users behind restrictive firewalls, then deploy and maintain it. | Ask whether TURN relay is included and in which regions it is available to your users. |
| Upgrades | Plan a clean installation on Ubuntu 24.04. Direct upgrades from 2.6, 2.7 or 3.0 are not supported, so migrate data deliberately. | Confirm the upgrade schedule, maintenance windows and whether a migration from your current version is handled for you. |
| Greenlight or LTI setup | Install with bbb-install.sh alongside Greenlight or LTI support, configure OpenID Connect and manage the identity provider yourself. | Confirm which LMS integrations, personal rooms and external login methods the hosted plan supports. |
| Monitoring and support | Build your own health checks, capacity alerts and on-call process for the servers. | Confirm response expectations, incident reporting and any service levels stated in the agreement. |
How the cost of each model is built and what drives it up
Hosted BigBlueButton Enhanced is priced by the number of concurrent sessions you buy, not by capacity you run. The product can be bought through an LMS provider or directly from Blindside Networks, and no prices are published on the premium features overview. Treat every cost figure as something you must request, not assume. The recurring element is the concurrency you purchase, so the main driver is your peak concurrent sessions at the busiest hour of the week, not total enrollment. Ask whether the subscription is renewed annually or per term, whether overage is billed when you exceed the purchased count, and whether recordings and analytics are included in the same line or priced separately. Also ask which of the four hosting regions (North America, Canada, Europe or Asia/Pacific) hosts your meetings and where recordings are stored, because that choice may affect data residency obligations.
Self-hosting moves the cost into components you pay for directly. The recurring items are servers, bandwidth, recording storage and staff time. The current install documentation sets minimums for a 4.0 server of 16 GB of RAM with swap, 8 CPU cores with high single-thread performance, 500 GB of disk for recordings (50 GB without recording) and 250 Mbit/s symmetrical bandwidth. Recording volume and the number of classes running in parallel drive disk and bandwidth needs, and class size drives media load per session. One-time costs include the initial installation, hostname and SSL setup, TURN server configuration for users behind restrictive firewalls, and integration with Greenlight, LTI or your LMS. Confirm your own staff or partner rates for these tasks, because they vary by organization. Upgrades also recur: 4.0 cannot be upgraded directly from 2.6, 2.7 or 3.0, so each major move is a clean server rebuild with its own labor.
When you request a hosted quote, ask for the included concurrent session count and the overage rule, the hosting regions and any data residency commitments, the support tier and response expectations in writing, recording retention periods and how deletion is handled, the premium features included, and the exit terms: data export format, notice period and whether recordings can be taken with you. For a self-hosted estimate, ask a partner for a written scope covering server sizing for your peak load, bandwidth at that load, recording storage for your retention policy, the upgrade and backup plan, and the integration work. A quote from DeployOpen follows from that written scope, and it is the scope, not the server count alone, that sets the cost.
Moving between hosted and self-hosted BigBlueButton
This sequence moves meetings, recordings and LMS or front-end links from BigBlueButton Enhanced to a self-hosted server, or back, with a clean installation, a tested pilot and a documented cutover. Each phase ends with a check that the team can sign off.
Inventory meetings, recordings and integrations
The current administrator lists every active meeting room, recording set, LMS integration, front end (such as Greenlight v3), dial-in number, guest invite flow and identity login in use. Owners of each LMS course or account should confirm which rooms and recordings they rely on. The output is a written inventory with a named owner for each item, which becomes the scope of the move. Do not start technical work until the inventory has been reviewed by teaching and administrative leads.
Confirm recording and data export with the vendor
Ask Blindside Networks, the company behind bigbluebutton.com, in writing what export of recordings, meeting data and analytics is available, in what formats, and whether any of it depends on your plan. Also confirm whether premium-only features such as analytics or personal rooms have data that cannot be exported. Record the answers and the date received. The step is complete when the export method for each inventory item is written down and accepted by the owner of that data.
Plan a clean installation on the target server
Direct upgrades from BigBlueButton 2.6, 2.7 or 3.0 to self-hosted 4.0 are not supported, so the target server is a fresh build. Check it against the install documentation: Ubuntu 24.04, 16 GB of memory with swap, 8 CPU cores with high single-thread performance, 500 GB of disk for recordings (50 GB without recording), 250 Mbit/s symmetrical bandwidth, TCP ports 80 and 443, UDP ports 16384 to 32768, a valid hostname for SSL and Docker for document conversion. The output is a sizing note and a build plan signed off by whoever operates the network.
Rebuild the front end and identity links
Install the server with the front end you need, such as Greenlight v3 through the install script or your LMS integration, then rebuild user access. For Greenlight v3, configure external authentication through OpenID Connect using the environment variables described in its documentation, and confirm how an identity provider such as Keycloak fits your login methods. Map each account and LMS link to its new room. The step is complete when test accounts from every login method can enter a room and see their recordings.
Rotate the shared API secret and update LMS configuration
Generate a new shared secret on the self-hosted server, because the old secret belongs to the hosted environment. Every API call must carry a checksum computed with that secret, so update each LMS or integration configuration with the new endpoint and secret, and keep the secret out of any web page. Confirm the checksum algorithm each integration uses, since SHA-256 is the default and legacy SHA-1 should be retired where possible. The step is complete when each integration returns a successful meeting create call against the new server.
Run a pilot with a small set of classes
Choose a small group of classes or teams whose instructors agree to test the new server before anything else moves. Watch audio, video, screen sharing, breakout rooms, polling, the whiteboard, recordings and dial-in during real sessions, and record any problems with the time, browser and network involved. Confirm the TURN server setup for users behind restrictive firewalls. The pilot is done when the pilot group signs off in writing and every issue found has either been fixed or accepted by the owner.
Cut over DNS and LMS links
Schedule the cutover with the teaching and administrative owners, lower DNS time-to-live ahead of the change if your DNS provider supports it, then point the hostname at the new server and update LMS links and bookmarks. Keep the hosted environment running until users have confirmed access. The output is a cutover record with the time, the DNS change and the first successful sessions. Agree the timing and any freeze window in writing with the teams affected, since no duration for this phase is published in the supplied material.
Archive or retire the old environment
After the agreed hold period, export any remaining recordings and records, confirm that retained copies meet your records and data protection rules, then close the hosted subscription through the vendor's process. Remove stale credentials, shared secrets and DNS entries that point to the old service. The step is complete when the vendor confirms account closure in writing and your asset register shows the old environment as retired. Agree the hold period and the closure process with whoever performs the work before the move begins.
Self-hosted BigBlueButton cost, effort and migration questions
What does it cost to run BigBlueButton yourself?
Self-hosting has no license fee, so the cost is the infrastructure plus the people who build and run it. BigBlueButton 4.0 needs at least 16 GB of RAM with swap, 8 CPU cores with high single-thread performance, 500 GB of disk for recordings (50 GB without recording) and 250 Mbit/s symmetrical bandwidth, according to the BigBlueButton install documentation. Recurring costs include the server or cloud instances, storage that grows with recordings, bandwidth, TLS certificates, and staff time for upgrades and monitoring. One-time costs include the initial build and any integration work. Costs rise with concurrent classes, recording volume, and the number of servers. Ask any vendor or partner for a quote that separates one-time build work from recurring operations and states which components are included.
Can a team self-host BigBlueButton without outside help?
Yes, many teams do, provided they have Linux administration skills and someone who can troubleshoot networking. The project publishes an install script, bbb-install.sh, that can add Greenlight or LTI support on the same server. The harder parts are the environment: opening TCP ports 80 and 443 and UDP ports 16384 to 32768, providing a valid hostname for SSL, installing Docker for sandboxed LibreOffice conversion, and deciding whether a TURN server is needed for users behind restrictive firewalls. Ask whether your team has done this before, who will own upgrades, and who responds when a class fails at the start of a session. DeployOpen plans, implements, hardens and supports self-hosted platforms in the client's own infrastructure if you prefer to scope that work in writing.
How long does a BigBlueButton setup take?
The timeline depends on scope and environment, and no fixed duration is published here, so confirm estimates in writing. A single server with a standard hostname, open ports and no LMS integration is the simplest case. Timelines grow with the number of servers, a load balancer pool, LMS or Greenlight integration, single sign-on, recording storage design, backup and monitoring, and any firewall or network review your organization requires. Ask for a written scope listing deliverables, testing steps and acceptance criteria, since those drive the schedule more than the software does.
What skills does a self-hosted BigBlueButton team need?
The work needs four areas of skill. Linux administration covers the install, services, updates and disk management. Networking covers the UDP media range, firewall rules, NAT and the TURN option for restrictive networks. Security covers SSL certificates, the shared secret used for API checksums, and keeping the secret out of web pages. Application skills cover LMS integration and, if used, Greenlight v3 with OpenID Connect. Upgrade planning is a separate task: BigBlueButton 4.0 does not support direct upgrades from 2.6, 2.7 or 3.0, so the project recommends a clean server installation. Plan a migration window, test recordings and integrations on a staging server, and document the rollback path.
Does hosted BigBlueButton Enhanced keep recordings in a region I choose?
Yes, according to the premium features overview. Enhanced customers choose from four regions for hosting meetings and storing recordings: North America, Canada, Europe and Asia/Pacific. Confirm the selected region in the contract or order before you go live, and ask how recordings are retained, exported and deleted, since those rules matter for data protection review. Also ask how the chosen region applies to backups and support access. Enhanced is sold by the number of concurrent sessions purchased, and prices are not published, so request a quote for your expected peak concurrency.
Is moving from hosted to self-hosted BigBlueButton practical?
It can be practical, but it is a migration, not a switch. Confirm first which recordings, meeting data and Enhanced features (analytics, personal rooms, guest invites, dial-in number, account customization) you need to keep, and whether the hosted provider will export them in a usable format. Self-hosted BigBlueButton does not offer the Enhanced features by default, so plan replacements for each one you rely on. Also confirm the LMS integration steps, the new hostname and certificates, and user communication. Moving back to hosted has the same questions in reverse, plus the concurrency plan you would buy. Ask both providers for written export terms before you commit.
Does DeployOpen resell BigBlueButton Enhanced?
No. DeployOpen does not resell BigBlueButton Enhanced, and it is not a partner of BigBlueButton Inc. or Blindside Networks. Enhanced is bought through an LMS provider or directly from Blindside Networks, as described in the premium features overview. DeployOpen works on self-hosted open-source platforms inside a client's own infrastructure, including planning, implementation, hardening, backup, upgrades and documentation for those deployments. If you choose the self-hosted route, DeployOpen can scope that work in a written, fixed-scope agreement.
Do I need a single BigBlueButton server or a pool?
Start with the concurrency you need, then compare the options. One server covers many small or moderate classes if it meets the 16 GB, 8 core and bandwidth requirements, while a pool behind a load balancer is needed when concurrent sessions exceed what one server can carry. The Scalelite project is the load balancer the project points to for pools. Pools add dependencies, including PostgreSQL, Redis and NFS, and more operational work. Our sibling comparison, BigBlueButton single server vs Scalelite cluster, covers per-server capacity, pool sizing and the skills a pool requires.
How DeployOpen scopes, builds and supports self-hosted BigBlueButton
DeployOpen plans, implements, integrates, hardens, backs up, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For BigBlueButton, that means working from a written scope that sets out how your own servers, bandwidth, recordings and front ends will be run, whichever way you decide between hosting and self-hosting.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope records the number of BigBlueButton servers, expected concurrent sessions and whether recordings are stored on your own disk.
- Scope also names the front end, such as Greenlight or LMS integration, and the identity source to be connected.
How we build
- Servers are built in your cloud account, data center or air-gapped network against the BigBlueButton 4.0 install requirements.
- Network work covers TCP ports 80 and 443, UDP ports 16384 to 32768, a valid hostname for SSL and a TURN server where firewalls are restrictive.
- Sizing, bandwidth and document conversion settings are tested against the expected class and meeting profile before go-live.
How we hand over
- Handover includes configuration documentation, runbooks for upgrades and recording storage, and the steps used to build each server.
- Upgrades are planned as clean installations, since direct upgrades from 2.6, 2.7 or 3.0 are not supported for 4.0.
- Backup and restore procedures are documented and tested with your team so operators know what they are responsible for.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, scoped separately from the build.
- Retainer scope should state which servers, front ends and identity connections are covered and how upgrades are timed.
- Ask any provider to confirm in writing how they handle security patches, incident response and recording retention before you sign.
