Snipe-IT hosted vs self-hosted: when each model fits
Self-hosting Snipe-IT suits teams that must keep asset records, user identities and purchase data inside their own network and already have the PHP, MySQL and identity skills to run it. Hosted plans suit teams that want upgrades and server maintenance handled by someone else and are willing to pay for that. The self-hosted software is free under AGPL-3.0, so the decision is rarely about the license fee. It is about who carries the recurring work of patching, backing up, monitoring and upgrading the stack, and whether that work already has an owner.
The self-hosted stack needs PHP 8.2 or later and below 8.6, MySQL 5.7+ or MariaDB, and Apache with mod_rewrite or IIS with URL Rewrite, according to the Snipe-IT requirements. Your team also carries the LDAP or SAML configuration, the backup schedule and each upgrade, including the version currently published on the grokability/snipe-it releases page. Hosted plans, priced from $399.99 per year on the Snipe-IT pricing page, add email support, automated upgrades and server maintenance. Before you compare, ask the vendor exactly what the hosted plan covers for backups, restore testing, data location and identity integration, and whether those terms match your data handling rules.
Several conditions flip the decision. Choose hosted when no one on the team can own patching within your change windows, or when you lack a sound way to restore the database. Choose self-hosting when a data residency or audit requirement says where asset and user records may live, or when you already run Active Directory and SAML infrastructure that Snipe-IT should join. Revisit the choice if you add many integrations through the REST API, since custom work on your own server shifts maintenance cost back to your team. A quote from a partner such as DeployOpen should follow a written scope that names the hosting model, the identity sources and who performs each upgrade.
How the two models compare on license, cost and features
This table compares the hosted Snipe-IT plans with running the free AGPL-3.0 software on your own PHP and MySQL stack, row by row. Use it to see which costs are fixed by the vendor's published price and which depend on your own staff, infrastructure and quote scope.
| Factor | Self-hosted Snipe-IT | Hosted Snipe-IT plans |
|---|---|---|
| License | AGPL-3.0 for the software, per the grokability/snipe-it repository metadata | Vendor-operated service; confirm the terms of service and data processing agreement before signing |
| Published price | Software is free; the pricing page says the self-hosted software is and always will be free | From $399.99 per year, per Snipe-IT's pricing page |
| What the paid tier adds | Support, upgrades and server operation are your responsibility or a paid partner's | Email support, automated upgrades and server maintenance, per the pricing page |
| Full hosted feature list | Not applicable | Confirm on the pricing page which other items are included, such as user counts, storage or backup terms |
| LDAP and Active Directory login | LDAP sync imports users and lets them sign in with LDAP credentials, falling back to local accounts; you configure and operate the directory connection | Confirm with the vendor whether directory connections are supported on your plan and how they are configured |
| SAML single sign-on | SAML works with providers such as Entra ID, Okta and Authentik; you set up and maintain the identity provider trust | Confirm which identity providers and SAML settings the hosted plan supports |
| REST API | JSON REST API covers most actions available in the web interface, reachable on your own network | Confirm API access, rate limits and whether integration endpoints are the same as self-hosted |
| Stack you own | PHP 8.2 or later and below 8.6, MySQL 5.7+ or MariaDB, and Apache or IIS, or the Docker image | Stack is run by the vendor; you do not manage the PHP, database or web server layers |
| Cost drivers | Hosting, backups, patching, upgrades and staff time for administration | Annual subscription, plus any extra support or services you buy outside the plan |
Where your asset data lives and who controls access
Snipe-IT holds who has which laptop, license and accessory, so the location of that database and the identity path into it matter as much as the price. The four cards below cover where the data sits, how users get in, what audit evidence you must produce yourself, and what compliance work follows from both choices.
Data location and hosting control
With free self-hosting, the MySQL or MariaDB database, uploaded files and backups stay in your own data center or cloud account. With a hosted plan, the vendor operates the server, so the region, subprocessors and backup location become part of your records. Ask the vendor in writing where hosted data is stored, who can access it, and how backups are kept. Confirm any certifications the vendor holds directly, since DeployOpen does not issue them.
LDAP sync with local fallback
Snipe-IT's LDAP sync imports and updates users from LDAP or Active Directory, and users can sign in with directory credentials. Local accounts remain as a fallback. That fallback is useful during a directory outage but also creates a second login path you must govern. Decide who may hold local admin accounts, store their credentials in a vault, and review them on a schedule.
SAML sign-in with your identity provider
SAML login is supported with identity providers including Entra ID, Okta, Google Workspace, OneLogin, JumpCloud, Shibboleth and Authentik. Using SAML centralizes sign-in, enforcement of multifactor authentication and offboarding in your identity provider. Check that deprovisioning in the identity provider actually stops access to Snipe-IT, and confirm how role mapping works for your provider before you rely on it for admin rights.
Audit evidence you produce yourself
Snipe-IT records checkouts and asset history, but an auditor will ask for proof that access reviews, admin changes and backup restores happened. Plan to export logs, keep change records for upgrades and retain restore test results. Whether hosted plans supply any of this evidence for you is something to confirm with the vendor before you rely on it, since hosting does not transfer responsibility for your controls.
Compliance implications of each choice
Self-hosting makes you responsible for hardening, patching and evidence across the whole stack, which suits teams with mature operations. A hosted plan moves some operational work to the vendor, but your obligations as the data owner stay with you. DeployOpen can plan, implement and document controls and prepare evidence for an assessment, while independent auditors issue any attestation or certification. Map the framework you must meet to these choices before you commit.
How self-hosted Snipe-IT is assembled from PHP, MySQL and a web server
Self-hosting Snipe-IT means assembling a PHP application stack before you load a single asset. The supplied requirements call for PHP 8.2 or later and below 8.6, MySQL 5.7 or later or MariaDB, and either Apache with mod_rewrite or IIS with URL Rewrite to route requests to the application. Check these against the version of Snipe-IT you plan to run, since the Snipe-IT requirements page is the authority for the current matrix. Your platform team owns the PHP runtime patch cadence, the database backup schedule and the web server TLS configuration, and each of those is a recurring task that a hosted plan would otherwise absorb. The README also documents a Docker image as an alternative packaging route, which moves some of that work into container build and image update processes. Decide early which route your team will support, because the upgrade path differs between them.
The application itself is built on Laravel 12, so your PHP operations staff will be maintaining a framework-based codebase, not a static tool. Identity is the integration point that most affects security reviews. Snipe-IT's LDAP sync imports and updates users from LDAP or Active Directory and lets them sign in with directory credentials, falling back to local accounts. SAML login supports identity providers including Entra ID, Google Workspace, Okta, OneLogin, JumpCloud, Shibboleth and Authentik. Confirm which fallback behavior your policy permits, and test whether disabled directory accounts stop working in Snipe-IT before go-live, since local fallback accounts can keep access alive.
The JSON REST API covers most of the actions available in the web interface, so asset check-out, check-in and inventory updates can be scripted from your HR, procurement or ticketing systems. Treat the API as a second administrative surface: issue tokens to named service accounts, restrict them to the actions each integration needs and record who owns each token. Confirm endpoint coverage for your specific workflows against the Snipe-IT API overview, because the documentation describes most actions rather than all of them. Hosted plans reduce the server work in this stack, but they do not remove the need to decide how your integrations authenticate and who reviews their access.
What your team runs in each model
Self-hosting is free, but your team owns every layer Snipe-IT runs on. The application requires PHP 8.2 or later and below 8.6, MySQL 5.7 or later or MariaDB, and Apache with mod_rewrite or IIS with URL Rewrite. The effort depends on the skills you already have in-house and on the environment you run in, such as a single virtual machine, a container host or a shared server.
- PHP and database patching: Track security updates for the PHP runtime, the database server and the web server, and confirm each stays within the supported PHP range for the release you run.
- Backups and restore tests: Back up the database and uploaded files together, and test restores on a separate host, because an asset register that cannot be restored fails you during an audit or an incident.
- TLS and web hardening: Issue and renew certificates, and configure the reverse proxy or web server for HTTPS and the rewrite rules the application expects.
- Upgrades per release: Each release, such as v8.8.0 published on September 30, 2026, needs a staging test, a database migration check and a rollback plan. A Docker image is available, which changes how you package the stack but leaves the patching duty with your team.
Check whether an existing platform team already runs business applications like this one, and whether it has on-call cover for them. Confirm the supported stack in the Snipe-IT requirements before you size the servers.
Snipe-IT's hosted plans start from $399.99 per year and add email support, automated upgrades and server maintenance. The vendor takes on the infrastructure and release work, but your team still configures users, identity links and asset records. The practical question is where the boundary sits, and that boundary is set by the plan terms rather than by the product itself.
- Upgrade control: Automated upgrades remove the release calendar from your queue, but ask whether you can defer a version, how much notice you receive and how a failed upgrade is rolled back.
- Maintenance windows: Ask when maintenance happens, how long each window lasts and whether it can fall inside your change freeze periods or regulated reporting dates.
- Support response: Email support is included, so request response targets in writing, the hours covered and the escalation path if an administrator is locked out of the instance.
- Data export and exit: Ask where data is stored, how you export the full asset register and attachments, and how long data remains after termination.
Compare the plan price with the time your team would otherwise spend on the server work listed in the self-hosted tab. Read the Snipe-IT pricing page and get the hosted terms in writing before you sign.
Both models can use the same identity features. LDAP sync imports and updates users from LDAP or Active Directory and lets them log in with directory credentials, falling back to local accounts. SAML login supports identity providers including Entra ID, Google Workspace, Okta, OneLogin, JumpCloud, Shibboleth and Authentik. What changes is who builds and maintains each connection.
- LDAP bind and mapping: Self-hosted, your team sets the bind account, search base and attribute mapping, and decides whether local accounts remain for break-glass use.
- SAML registration: Your team registers the Snipe-IT service with the identity provider, maps attributes and plans for certificate rotation.
- Network reachability: A hosted instance must reach your identity endpoints. If the directory sits on a private network, confirm how the hosted service connects and whether your security policy allows it.
- Leaver deprovisioning: Whoever runs the instance owns the removal of access when people leave, so document the steps and test them in both models.
Ask the vendor which LDAP and SAML configurations it supports for hosted instances, and test each with a non-production account. The setup guides for LDAP sync and login and SAML show the settings your team will need to plan for.
Asset records are the audit trail for who holds which laptop, which licenses are assigned and which accessories are checked out. Governance applies in both models: someone must own the data, approve changes and decide how long records are kept. Hosting moves the servers, not the accountability for the records.
- Naming and status standards: Define asset tags, statuses, categories and check-out rules before any import, so the data stays consistent whichever model you choose.
- Edit and delete rights: Decide which staff can reassign assets or delete records, and review that list on a fixed schedule.
- API credentials: The JSON REST API covers most web interface actions, so integrations need credentials managed with the same care as administrator accounts. Confirm any hosted limits on API use with the vendor.
- Retention and export tests: Set how long records and attachments are kept, and test an export before an audit or a contract exit forces the question.
Write the data owner, retention period and export format into your procedures before migration, and check them against your internal policy and any external obligations that apply to your organization.
Moving Snipe-IT between self-hosted and the vendor cloud
This sequence moves a Snipe-IT asset register between a self-hosted instance and the vendor's hosted plan, or back again. It produces a verified copy of your asset, license, accessory and user records on the target, with login working for your people before the old instance is switched off. The order is illustrative, and the export and import options for each direction must be confirmed with the vendor before you commit to a plan.
Export and verify source data
Pull assets, licenses, accessories, consumables, components and users out of the current instance, using the export or API route your vendor confirms for that direction. The Snipe-IT API covers most actions available in the web interface, so it is a reasonable place to test what can be read. Check record counts per category against the source screens and spot-check checked-out items, license seat assignments and user departments. Done means you have a saved export and a signed-off count sheet that your asset owner accepts.
Confirm target version and identity settings
Record the Snipe-IT version on each side and confirm the target runs a version your team has tested, with PHP within the supported range, MySQL 5.7 or later or MariaDB, and a web server with URL rewriting. Document your LDAP sync and login settings and your SAML identity provider, including Entra ID, Okta or Authentik if that is your provider, and check that the same users can sign in before cutover. Ask the vendor which Snipe-IT release the hosted plan runs and how it upgrades. Done means you have a written target specification and a login test plan.
Run a test import on a staging copy
Load the export into a separate instance that matches the target, using the import route your vendor confirms for that direction. Compare record counts, check that checked-out assets still point to the correct people, and confirm that license seat totals, depreciation dates and custom fields match the source. Log every mismatch, fix the mapping, and repeat the import until a clean run is recorded. Done means a test run with no open mismatches that your asset owner has reviewed.
Test login and permissions end to end
Sign in on the test instance with LDAP, SAML and a local fallback account, and confirm that roles, permissions and API tokens behave as they do on the source. Where Snipe-IT falls back to local accounts for LDAP users, check that this is intended. Confirm that scheduled jobs, notifications and integrations that call the API are repointed to the new base URL and token. Done means a short sign-off list where each login path and integration has a named tester and result.
Cut over DNS and sign-in
Freeze edits on the source, run a final delta export if the source still changes, import it, then point the public hostname at the new instance and update SAML redirect and LDAP settings where the URL changed. Keep the source instance available, with writes stopped, for a period you agree in advance with your team, so you can roll back. Done means users reach the new instance, a test sign-in succeeds from outside the network, and the rollback path is documented.
Retire the old instance
After the agreed rollback window closes without issues, take a final backup of the source, record where it is stored and for how long your policy requires, then shut down the application and database services. For the hosted route, confirm with the vendor how data is returned or deleted at the end of a subscription before you cancel. Done means a stored archive, a decommissioning record and confirmation from the vendor that hosted data has been handled as agreed.
What drives the total cost of each option
Snipe-IT's self-hosted software is published as free, and the vendor's pricing page states it is and always will be free. That price covers the license only. Your organization pays for the PHP and MySQL or MariaDB stack, the Apache or IIS host, the time your administrators spend on installation, upgrades, patching and backups, and any directory work for LDAP sync or SAML login. Those labor and infrastructure costs are recurring because every Snipe-IT release, PHP version change and operating system patch lands on your team. The hosted path replaces part of that labor with a subscription starting at $399.99 per year, which the vendor's pricing page says adds email support, automated upgrades and server maintenance. Confirm what that tier excludes, such as custom integrations, LDAP or SAML configuration help, data residency options and backup restore testing.
One-time costs are the ones to scope carefully. Initial setup, asset category and field design, the LDAP or SAML integration with your identity provider, and the migration of existing asset records from spreadsheets or another tool happen once, but they often take longer than the software install itself. On the hosted side, the same migration and identity work still applies, so it does not disappear. Recurring costs on the self-hosted side include the hours spent reviewing each Snipe-IT release, testing the upgrade in a staging copy, and restoring a backup when something fails. Ask internal teams to estimate these hours in writing, and record who owns each task after go-live.
When you request quotes, ask the hosted vendor for the written tier scope, the support hours and response commitments, the upgrade policy and the data export terms if you leave. For a self-hosted implementation partner, ask for a fixed scope covering installation, identity integration, migration, backup and restore testing, hardening and handover documentation, plus a separate retainer for upgrades and ongoing support. Compare both options over the same period and include the internal hours in each total. A hosted plan may be cheaper for a small team with no spare operations capacity, while self-hosting may be cheaper when you already run PHP, MySQL and directory services well and can absorb the patching work.
Questions buyers ask before choosing hosted or self-hosted Snipe-IT
Can a small team self-host Snipe-IT without outside help?
Yes, a small team can run Snipe-IT alone if one person can operate a PHP web application, a MySQL or MariaDB database, backups and TLS certificates. The software is free and licensed under AGPL-3.0, and the README notes a Docker image is available, which can simplify the first build. The stack must meet the published requirements: PHP 8.2 or later and below 8.6, MySQL 5.7+ or MariaDB, and Apache with mod_rewrite or IIS with URL Rewrite. Before you commit, confirm that your hosting environment matches those versions, that someone owns operating system patching, and who responds when LDAP sync or a backup fails. Outside help is optional, and it usually matters most for the first deployment and for integration work.
How much effort do recurring Snipe-IT upgrades take when self-hosted?
Each upgrade is a scheduled task, and the effort depends on how often your team follows releases and how much testing it does. Snipe-IT publishes releases on its GitHub releases page, with v8.8.0 published on September 30, 2026, so a team should expect a steady cadence rather than a single yearly event. Each upgrade should include a full database backup, a review of the release notes, a test on a staging copy, and a check that the PHP version still falls within the supported range. Hosted plans add automated upgrades and server maintenance, which removes most of this routine work from your team. Ask any provider how it tests upgrades against your LDAP, SAML and API integrations before you rely on an automated schedule.
What do Snipe-IT hosted plans include beyond the listed items?
The pricing page lists hosted plans from $399.99 per year, and it says they add email support, automated upgrades and server maintenance. Anything beyond those three items is not confirmed by that page, so ask the vendor in writing before you sign. Confirm where data is stored, how backups are taken, how long they are kept, and whether you can test a restore. Ask whether the hosted instance can reach your on-premises directory for LDAP sync, which SAML identity providers are supported on the hosted service, how user and asset volumes are limited, and what the response commitments are for incidents. Get the answers as written terms, because a plan description alone does not show how these items are delivered.
How long does a Snipe-IT migration take, and what drives it?
No duration can be stated from the researched facts, so the timeline depends on your data and your cutover rules. The main drivers are the volume of assets, licenses, accessories and check-out history you need to carry over, how consistent your asset tags and custom fields are, how many users must be synced, and how many systems call Snipe-IT through its API. The JSON REST API allows most of the actions available in the web interface, which makes scripted import and export possible, but you should confirm which objects and history records your target setup can preserve. A migration between hosted and self-hosted instances also needs a cutover window for check-outs and an agreed rollback point. Ask any provider for a written plan that lists each data set, its validation steps and the expected cutover window.
Do LDAP and SAML work the same in hosted and self-hosted Snipe-IT?
The login features are the same product features, but the network path and supported providers can differ, so you must confirm them for each model. Self-hosted, LDAP sync imports and updates users from LDAP or Active Directory, and users can sign in with LDAP credentials while local accounts remain as a fallback. SAML is documented for identity providers including Entra ID, Google Workspace, Okta, OneLogin, JumpCloud, Shibboleth and Authentik, as described in the Snipe-IT SAML documentation. On a hosted plan, your team should verify that the vendor can reach your directory, which SAML providers it accepts, how certificates are rotated and whether the fallback local accounts behave the same way. Test sign-in, sync and deprovisioning in both models before you choose one.
When is a consultant worth hiring for a self-hosted Snipe-IT deployment?
A consultant is worth hiring when the work exceeds what your team can own, such as integrations with directories and identity providers, hardening, backup design, migration from spreadsheets or another tool, or evidence collection for an assessment. DeployOpen plans, implements, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and ongoing support and upgrades are available as retainers. DeployOpen does not publish a price list, and a quote follows from the written scope. For compliance work, DeployOpen prepares systems, controls and evidence, but independent auditors and certification bodies issue the reports.
Is self-hosted Snipe-IT actually cheaper than the hosted plan?
The software license costs nothing, but self-hosting moves costs to infrastructure, staff time and risk, so the answer depends on your own numbers. The hosted plan is listed from $399.99 per year and adds email support, automated upgrades and server maintenance. Self-hosting costs include the servers or cloud resources, backups and storage, monitoring, certificate renewal, upgrade testing, on-call coverage and the staff hours spent on each of these. Ongoing costs recur every year, while the initial build, migration and integration work are usually one-time costs. Costs rise with user count, the number of integrations and how strict your uptime and recovery requirements are. Compare the hosted list price with a written estimate of your own staff hours and infrastructure, and ask any provider for an itemized quote tied to a written scope.
When hosted Snipe-IT is cheaper in practice
Hosted Snipe-IT is usually cheaper when the cost of running the stack exceeds the subscription. The hosted plans start at $399.99 per year and add email support, automated upgrades and server maintenance, according to Snipe-IT's pricing page. For a small inventory managed by one or two people, that fee often costs less than the staff time needed to keep a PHP and MySQL application patched, backed up and monitored. The condition matters: if your team would not otherwise maintain the server, the subscription replaces work that would have landed on an admin with no spare capacity. Before deciding, ask your admin how many hours a quarter a self-hosted instance would take, including restoring a test backup, and compare that with the plan's stated scope. Confirm with Snipe-IT exactly which maintenance tasks and data backups the hosted plan covers.
Self-hosting is cheaper when the infrastructure already exists and the team already runs it. Snipe-IT's requirements call for PHP 8.2 or later and below 8.6, MySQL 5.7 or MariaDB, and Apache with mod_rewrite or IIS with URL Rewrite, per the requirements docs. If your organization already operates that stack, or runs the Docker image from the README on a container platform, the marginal cost is mostly the time to deploy and patch one more application. The software itself carries no license fee because the self-hosted edition is free. This is the condition where self-hosting wins on cost, and it holds only if your staff can apply PHP and database updates on the schedule the application needs.
Strict data residency is the third condition that can settle the question even when hosting looks cheaper. Asset records include user names, email addresses and device assignments, and the LDAP sync and SAML login features connect Snipe-IT to your directory. If policy requires that this data stay in your own data center or a specific jurisdiction, a hosted plan may not meet that rule regardless of price. Ask Snipe-IT where hosted data is stored, who can access it, and how backups are handled, and compare the answers with your data classification policy. Illustrative example: a bank with a regulator-approved hosting footprint may find the hosted option ruled out before cost is compared at all.
How DeployOpen scopes and runs self-hosted Snipe-IT
DeployOpen plans, implements, integrates, hardens, backs up, upgrades and documents self-hosted open-source platforms inside your own infrastructure, so Snipe-IT runs on your PHP and MySQL stack under your control. Engagements start with a written, fixed scope that sets out what is installed, connected and handed over before any work begins.
How we scope
- We confirm which PHP, MySQL or MariaDB, and web server versions your environment already runs against Snipe-IT's stated requirements.
- We record whether you need LDAP or Active Directory sync, SAML sign-in, or both, and which identity provider you use.
- We agree in writing whether a hosted plan or self-hosting fits your team, and what your internal staff will own afterward.
How we build
- We install Snipe-IT from the release you choose, either on bare servers or with the Docker image the project provides.
- We configure LDAP sync and SAML login, with local fallback accounts tested and documented before users are onboarded.
- We set up backups, upgrade procedures and access controls, then test restores and the Snipe-IT REST API against your agreed use cases.
How we hand over
- We document the deployed architecture, configuration keys, identity mappings and the runbook for routine upgrades.
- We walk your administrators through asset, license and accessory workflows, and the API calls your integrations depend on.
- We deliver the handover pack defined in the written scope, so your team can run Snipe-IT without relying on our staff.
How we support
- Ongoing support, upgrades and periodic testing are available as a retainer, scoped separately from the initial build.
- Retainers can cover patching against new Snipe-IT releases, backup verification and changes to identity or network setup.
- Ask any provider, including us, to confirm in writing who handles upgrades, backups and availability after go-live.
