Hosted or self-hosted Zammad: which model fits your helpdesk
Hosted Zammad fits teams that want per-agent billing and vendor-run operations, while self-hosting fits teams that must keep ticket data and control inside their own infrastructure. The deciding question is less about features, since Zammad's support knowledge base states that self-hosted Zammad always has full functionality, and more about who is accountable for hosting, backups and availability. Choose hosted when your data classification allows a vendor-operated service in ISO 27001 certified German data centers and your agent count fits a published plan. Choose self-hosted when residency, network isolation or internal change control rules out a third-party tenant, or when you already run PostgreSQL, Redis and reverse proxy operations well. Zammad's support knowledge base also says switching between the two models is possible at any time, so the choice is reversible, though the migration work should still be scoped.
Hosted plans carry conditions you should check against your requirements. Zammad's pricing page lists Starter v2 for up to 5 agents, Professional v2 for up to 35 agents, and Plus v2 with unlimited agents, and the channels and storage vary by plan. Hosted Professional and Plus also offer optional AI features billed per AI call. Ask Zammad which plan covers the channels your queues actually use, such as phone, WhatsApp or GitHub and GitLab integration, and whether the nightly backups listed for hosted instances meet your recovery objectives. Self-hosting removes the per-agent fee, but the cost moves to your staff and infrastructure, and the support subscriptions named Business, Enterprise and Corporation cover support and, for Corporation, update services rather than operations as a whole. Confirm with Zammad which services each subscription includes before you compare totals.
How hosted and self-hosted Zammad compare on each factor
This table sets hosted Zammad from Zammad GmbH against running Zammad yourself, factor by factor. Read each row as the question a buyer should answer for their own team, and check the cost rows against a written quote before deciding.
| Factor | Hosted Zammad | Self-hosted Zammad |
|---|---|---|
| License and software fee | Hosted plans billed per agent per month, excluding VAT. The service is run by Zammad GmbH. | No license fee for the AGPL-3.0 software. Support subscriptions are optional and sold separately. |
| Hosted plan prices | Starter v2 at 7 or 9 euros for up to 5 agents, Professional v2 at 16 or 18 euros for up to 35 agents, Plus v2 at 25 or 27 euros for unlimited agents, depending on billing period (Zammad pricing page). | Not applicable. Infrastructure, staffing and any support subscription are paid to your own vendors or Zammad. |
| Channels by plan | Starter v2 covers email, web form and SMS. Professional v2 adds chat, Telegram, SLAs and a knowledge base. Plus v2 adds phone, Facebook and WhatsApp (Zammad pricing page). | All channels are available as the software allows, but you must provision and maintain each integration yourself. Confirm the setup with Zammad. |
| Storage by plan | 20 GB on Starter v2, 50 GB on Professional v2 and 150 GB on Plus v2 (Zammad pricing page). | Limited by your own disks, database and object storage. Size and back up storage in your environment. |
| Full functionality | Depends on the selected package, with everything included on Plus (Zammad support knowledge base). | Always full functionality. Confirm feature parity against your plan before choosing a lower tier. |
| Data center location and certification | Runs in ISO 27001 certified data centers in Germany (Zammad pricing page). | Located wherever you deploy it, including your own cloud accounts, data centers or air-gapped networks. Confirm the controls you need with your auditor. |
| Backups | Nightly backups for hosted instances (Zammad support knowledge base). | Backups are your responsibility. Define the schedule, retention and restore tests yourself. |
| Updates, hosting and maintenance | Handled by Zammad GmbH as part of the hosted service. | Your responsibility, except that the Corporation support subscription includes update services (Zammad support knowledge base). |
| Self-hosted support subscriptions | Not applicable. | Business at 2,999 euros per year, Enterprise at 5,999 euros per year and Corporation at 9,999 euros per year (Zammad pricing page). |
| Optional AI features | Available on hosted Professional and Plus plans at 0.03 euros per AI call (Zammad pricing page). | Confirm with Zammad whether and how AI features are offered on self-hosted installations. |
| Switching between models | Possible at any time to self-hosted, and back again (Zammad support knowledge base). | Possible at any time to hosted, and back again. Confirm data migration steps before you move. |
Which hosted Zammad plan covers the channels you need
Hosted Zammad channel coverage steps up across three plans, so the plan you pick decides which inboxes you can connect. Starter v2 covers email, web form and SMS, with 20 GB of storage, and is priced at 7 or 9 euros per agent per month excluding VAT for up to 5 agents. Professional v2 adds chat, Telegram, SLAs and a knowledge base, with 50 GB, at 16 or 18 euros per agent for up to 35 agents. Plus v2 adds phone support, Facebook and WhatsApp channels, core workflows, GitHub and GitLab integration and 150 GB, at 25 or 27 euros per agent with unlimited agents. The price depends on the billing period, so confirm the figure you will pay on the Zammad pricing page.
The support knowledge base states that full functionality on hosted depends on the selected package, with everything included only on Plus. Self-hosted Zammad always has full functionality, so a channel or workflow that is locked on Starter is available to a self-hosted team on the same codebase. Before you compare totals, list every inbox you must serve, such as phone, WhatsApp, or a chat widget on your site, and map each one to a plan. Also confirm whether SMS, phone or social channels carry per-use charges on your chosen plan, because those costs sit outside the per-agent fee.
Treat the plan matrix as a point-in-time document. Channel availability, storage limits and agent caps can change between releases, so ask Zammad GmbH for written confirmation of the channel list for your exact plan and billing period before you sign. If you later outgrow a hosted package, the knowledge base says moving between hosted and self-hosted is possible at any time, which gives you a fallback, but it does not guarantee that a specific channel will transfer without reconfiguration. Test the channel you depend on most in a trial instance first.
Where your ticket data lives and what compliance evidence you can show
Hosted and self-hosted Zammad put ticket data in different places and leave you with different evidence to collect. The cards below cover where data sits, how backups run, how users sign in, and what each model means for residency and audit work.
Hosted data in German data centers
Hosted Zammad runs in data centers in Germany that Zammad states are ISO 27001 certified. The certification belongs to the data center operator, not to DeployOpen or to this page, so ask Zammad GmbH for the current certificate and its scope. Check whether the certified scope covers the specific facility and services that store your tickets, attachments and backups.
Nightly backups on hosted instances
Zammad's support documentation lists nightly backups for hosted instances, so backup timing is handled by the provider. Ask for the retention period, where backup copies are stored, whether they are encrypted, and how restores are requested and tested. Your recovery objectives must be written into the contract, because a backup that is not restorable on your timeline does not meet them.
Self-hosted data stays in your infrastructure
When you self-host, ticket data, attachments and database backups stay in the cloud accounts, data centers or networks you choose. You control residency and access logs, but you also produce the evidence yourself: backup test records, patch history and access reviews. Backups are your responsibility, so the schedule and restore tests must be documented in your own runbooks.
Sign-in through SAML and OpenID Connect
Zammad supports third-party login through SAML, OpenID Connect, Microsoft, Google, GitHub and GitLab, among other providers. Both models can use these options, but the identity provider behind them is your responsibility to govern and evidence. Confirm which login methods your compliance scope accepts and whether hosted configuration gives you the same settings and logs you would have when self-hosted.
Residency, subprocessors and audit evidence
Hosted use means a vendor relationship that brings subprocessors, contract terms and data transfer conditions into your audit scope. Self-hosting keeps those out of the chain but moves hosting controls onto your team. Before choosing, request the subprocessor list, data processing terms, incident notice commitments and your regulator's requirements from Zammad GmbH and your compliance team. DeployOpen prepares controls and evidence for assessments but does not issue audit reports or certifications.
What your team runs in each model
This table shows who carries updates, hosting, backups and availability under each model, plus the self-hosted components your team would install and keep running. Read the self-hosted column as your operations checklist and the hosted column as what the vendor operates on your behalf.
| Area | Hosted Zammad (Zammad GmbH) | Self-hosted Zammad (your team) |
|---|---|---|
| Updates and upgrades | Handled by Zammad GmbH on the hosted service | Your team applies minor and security releases such as 7.2.2; Corporation support subscription includes update services |
| Backups | Nightly backups for hosted instances, per Zammad's support knowledge base | Backups are the customer's responsibility; confirm retention and restore testing in your own runbook |
| Availability and hosting | Runs in ISO 27001 certified data centers in Germany | Your data center or cloud account; machine maintenance and availability are yours |
| Database | Managed by the vendor | PostgreSQL 15 or newer as the content store |
| Realtime and cache | Managed by the vendor | Redis 7 or newer for realtime websocket communication; Memcached needed for multi-instance deployments such as containers or cluster nodes |
| Reverse proxy and search | Managed by the vendor | Nginx or Apache as reverse proxy; Elasticsearch is optional but strongly recommended for search, reporting and attachment content |
| Kubernetes deployments | Not applicable | Zammad support covers only the Zammad application, not Kubernetes-specific issues; plan platform support separately |
What self-hosters take on after go-live
Self-hosting Zammad moves a set of recurring jobs from the vendor to your team, and those jobs cost more over time than the license, which is free. The AGPL-3.0 license has no fee, so the budget question is staff time and infrastructure. Plan for the release cycle first. Zammad 7.2 was released on September 23, 2026, followed by security releases 7.2.1 on October 6, 2026 and 7.2.2 on October 8, 2026, and Zammad also shipped 6.5.5 on October 15, 2026 for the 6.5 line. If you run both lines, or patch quickly across them, you need a named owner, a test instance and a change window for each update. On hosted plans the vendor applies these changes; on self-hosted installs, they land on your calendar.
Backups and restore tests are the second recurring item. Zammad's support knowledge base lists nightly backups for hosted instances, but for self-hosted installs backups are your responsibility. Confirm what you back up: the PostgreSQL 15 or newer database that holds ticket content, the attachment storage, and your configuration. A backup you have never restored is not evidence of recovery, so schedule a restore into a separate environment at a fixed interval and record how long it took. Redis 7 or newer and the search index can usually be rebuilt, but confirm that with the Zammad documentation for your install method before you rely on it.
Availability monitoring and the database and search stack form the third item. Self-hosted Zammad needs watching across the application, PostgreSQL, Redis and, if you enabled it, Elasticsearch, which the prerequisites describe as optional but strongly recommended for search and attachment content. Multi-instance or container deployments also need Memcached. Each component adds patching, capacity planning and an on-call path. Ask your internal team which of these they already operate, and ask your Zammad partner or support provider which service levels, if any, they will commit to in writing. The Zammad software prerequisites page is the reference for versions to track.
How Zammad support subscriptions change the self-hosted equation
This sequence shows how to match a self-hosted support tier to your needs, compare the published fee with the hosted per-agent cost and your internal effort, and end with a written scope and quote. The result is a documented decision you can take to procurement.
Confirm agent count and required channels
Start by listing how many agents will work in Zammad now and in the next budget cycle, and which channels they must handle, such as email, web form, SMS, chat, phone, or social messaging. Hosted plans differ in channels and agent limits, so this list decides which hosted plans are even candidates. Your team owns this step. It is done when you have one agent count and one channel list signed off by the support lead.
Match the need to a support tier
Compare your requirements with the three self-hosted support subscriptions: Business at 2,999 euros per year, Enterprise at 5,999 euros per year, and Corporation at 9,999 euros per year, as published on Zammad's pricing page. Ask Zammad GmbH in writing what each tier covers beyond the fee, and which of your systems and incidents fall inside support. It is done when you have named one tier and the written coverage that supports the choice.
Check whether update services are needed
Under the published terms, the Corporation subscription is the tier that includes update services. Self-hosted updates, hosting and machine maintenance otherwise remain your responsibility. Decide whether your team can apply Zammad releases, including security releases, on its own schedule. If it cannot, Corporation is the only listed option that covers this. It is done when you have a written answer on who applies updates under your chosen tier.
Price the hosted alternative per agent
Hosted plans are billed per agent per month, excluding VAT. Starter v2 is listed at 7 or 9 euros for up to 5 agents, Professional v2 at 16 or 18 euros for up to 35 agents, and Plus v2 at 25 or 27 euros with unlimited agents, depending on the billing period. Illustrative example: a team of 20 agents would fall in the Professional range, so the annual hosted cost depends on whether that team picks the lower or higher billing period. Convert the plan you need into an annual figure for comparison. It is done when both models are shown as annual totals for the same agent count.
Estimate internal effort and infrastructure
The self-hosted total includes costs the published subscription fee does not cover. Your staff handle backups, availability and updates unless you choose a tier that includes update services. You also run the stack: PostgreSQL 15 or newer, Redis 7 or newer, and optional Elasticsearch, with Memcached needed for multi-instance deployments. Estimate the staff time and infrastructure cost in your own environment, because the published materials do not price them. It is done when you have a documented internal estimate next to the subscription fee.
Request a written scope and quote
Ask Zammad GmbH for a written quote for the chosen subscription or hosted plan, including billing period, VAT treatment, and what the subscription includes. If you also bring in an outside partner for implementation, hardening, backups or upgrades, DeployOpen agrees that scope, deliverables and timeline in writing before work starts, and prices it separately from the Zammad fee. Compare the written quotes, not the list prices alone. It is done when you hold written scope and pricing for each part of the decision.
Record the model and switching path
Zammad's support knowledge base states that moving between self-hosted and hosted Zammad is possible at any time, so the first model you choose does not lock you in. Before you commit, confirm with the vendor how data, configuration and attachments move, how long the switch takes, and whether any subscription terms change. Record the chosen tier, the hosted plan considered, and the switching conditions in one decision note. It is done when that note is approved by the people who own budget and security.
Questions buyers ask before choosing hosted or self-hosted Zammad
What does self-hosting Zammad cost compared with hosted per-agent pricing?
Self-hosted Zammad has no license fee, so the cost is the infrastructure you run, the people who run it, and an optional support subscription. Hosted plans are billed per agent per month excluding VAT, starting at 7 euros for up to 5 agents on Starter v2 and 25 or 27 euros per agent on Plus v2 with unlimited agents, depending on the billing period (Zammad pricing page). Self-hosted support subscriptions are listed at 2,999 euros per year for Business, 5,999 for Enterprise and 9,999 for Corporation (Zammad pricing page). Ask for a quote that separates one-time setup from recurring server, database, Redis, Elasticsearch, storage, backup and staff time, and that states how each line scales with agent count and data volume.
How long does a self-hosted Zammad rollout take?
No supplied figure gives a standard rollout duration, so treat any number you hear as a claim to verify. The timeline depends on the size of your stack, the number of integrations (email, chat, SSO, ticket imports), data volume, and how many environments you need for testing. Zammad's documented requirements add work before go-live: PostgreSQL 15 or newer, Redis 7 or newer, and Elasticsearch, which is optional but strongly recommended for search and attachment indexing. Multi-instance deployments such as containers or cluster nodes also need Memcached. Ask for a written plan that lists each dependency, the migration method, and the acceptance tests before cutover.
What does a self-hosted team need from its own staff?
Self-hosting moves operational responsibility to you. Per Zammad's support knowledge base, updates, hosting and machine maintenance are the customer's responsibility, and backups are yours too, while hosted instances receive nightly backups. Your team needs skills in Linux administration, PostgreSQL, Redis, reverse proxy configuration (Nginx or Apache), certificate management and monitoring. If you deploy with Docker Compose or the Helm chart, you also need container operations skills. Zammad's Kubernetes documentation states that Zammad support covers only the application, not Kubernetes-specific issues, so plan for that platform ownership internally. Confirm these responsibilities in writing with any partner you hire.
Can a small team run self-hosted Zammad alone?
A small team can run it alone if it already operates similar stacks and accepts the patching and backup duties. The risk is not installation but routine work: applying security releases promptly, which Zammad published for both the 6.5 and 7.x lines in parallel (for example 7.2.2 on October 8, 2026 and 6.5.5 on October 15, 2026), testing upgrades, and restoring from backup. Without a second person who knows the stack, one absence can stall maintenance. The Corporation support subscription includes update services, which is one way to reduce that dependency. Ask your support provider exactly which update, upgrade and incident tasks are covered and which fall to your team.
Do hosted plan channel limits block a move to self-hosting or away from it?
Channel limits matter when you change plans, not when you switch models. Hosted Starter v2 covers email, web form and SMS. Professional v2 adds chat, Telegram, SLAs and a knowledge base. Plus v2 adds phone support, Facebook and WhatsApp channels, core workflows, GitHub and GitLab integration. Self-hosted Zammad always has full functionality, according to Zammad's support knowledge base, while hosted functionality depends on the package selected. If you need phone, Facebook or WhatsApp on a lower hosted tier, that is a reason to compare plans first. Confirm how each channel is connected and billed in your own setup before deciding.
Can Zammad data move between hosted and self-hosted instances?
Yes, Zammad's support knowledge base states that changing between self-hosted and hosted, and vice versa, is possible at any time. Confirm the procedure, timing, and what is included (tickets, attachments, users, configuration, and integrations) with Zammad before you commit, because the knowledge base does not supply a step-by-step process in the facts available here. Also confirm whether attachment search and reports depend on re-indexing in Elasticsearch after a move, and whether any external connections need reconfiguration. Ask for a rehearsal on a copy before cutover.
When is a consultant or support subscription worth the fee?
A consultant or support subscription is worth the fee when your team lacks the time or skills to cover installation, upgrades and incidents, or when uptime and response expectations are strict. Zammad's self-hosted support tiers are priced per year at 2,999, 5,999 and 9,999 euros, and the Corporation tier includes update services. DeployOpen plans, implements, integrates, hardens, backs up, upgrades and documents self-hosted platforms inside your own infrastructure, typically under a fixed scope agreed in writing, and offers ongoing support as a retainer. Compare that scope against the Zammad subscription so you do not pay twice for the same task. Request a quote that states deliverables, responsibilities and the support hours included.
How to choose a model from your agent count, channels and data rules
Start with agent count, because it decides whether hosted pricing is even in play. Zammad's hosted Starter v2 covers up to 5 agents, Professional v2 up to 35 agents, and Plus v2 has unlimited agents, with monthly per-agent rates excluding VAT of 7 to 9 euros, 16 to 18 euros and 25 to 27 euros respectively, depending on the billing period. A team of 40 agents cannot stay on Professional and must move to Plus, so multiply the per-agent rate by your real headcount, including shift coverage and supervisors who hold agent licenses. Self-hosted Zammad has no license fee, so its recurring cost is infrastructure, staff time and any support subscription (Business at 2,999 euros per year, Enterprise at 5,999 and Corporation at 9,999). Ask Zammad GmbH to confirm in writing how agent seats are counted for part-time and shared accounts.
Next, map channels to tiers. Starter v2 covers email, web form and SMS. Professional v2 adds chat, Telegram, SLAs and a knowledge base. Plus v2 adds phone, Facebook and WhatsApp, core workflows, and GitHub and GitLab integration. If you need phone or WhatsApp, or the Git integrations for a development-facing support queue, hosted Plus is the only hosted route and self-hosting is the alternative. Hosted Zammad also offers optional AI features billed at 0.03 euros per AI call on Professional and Plus, which is a recurring usage cost to model against call volume. Confirm with Zammad GmbH whether any channel your team needs is absent from your chosen tier or dependent on a third-party account you must provide.
Data rules usually settle the question. Hosted Zammad runs in ISO 27001 certified data centers in Germany with nightly backups, which can satisfy residency expectations for EU-only data. Self-hosting moves backups, patching and availability into your own control, so your team must document and test them. Hosted wins when agent count is modest or moderate, channels stay within the tier, your data can sit in German data centers, and you lack staff for patching and Redis, PostgreSQL and Elasticsearch operations. Self-hosting wins when data must stay in your own cloud accounts or data centers, when you need full functionality without tier limits, or when you can staff upgrades and backups. Before deciding, ask your auditors which evidence they accept for a hosted provider, such as the certificate scope and your contractual rights, and for self-hosting, which controls you must evidence yourself. Both models can switch later, according to Zammad's support knowledge base, but confirm timing and data transfer terms with Zammad GmbH first.
What DeployOpen handles when a team self-hosts Zammad
Self-hosting Zammad moves installation, hardening, backups, upgrades and evidence from the vendor to your team or your implementation partner. The cards below cover the services DeployOpen provides in that work, and each one lists what to confirm before a quote is agreed.
Scoping in writing first
Before work starts, the agreed scope, deliverables and timeline are written down. For Zammad, the scope should name the channels in use (email, web form, SMS, chat, phone or social), the number of agents, the authentication providers and any migration source. Those decisions shape the database, search and caching stack you will run. Ask for the written scope to list every component, so the quote follows from it.
Installation and integration
DeployOpen installs Zammad using the method your team selects, whether the package, Docker Compose or the Helm chart, inside your own cloud account, data center or air-gapped network. Integration covers PostgreSQL, Redis, the reverse proxy and optional Elasticsearch, plus third-party login through SAML or OpenID Connect where you need it. Confirm which install method your platform team supports, because Zammad support does not cover Docker or Kubernetes-specific problems.
Hardening and backup set-up
On hosted Zammad, the vendor runs nightly backups. Self-hosted, backups are your responsibility, so this work defines backup scope, schedule, retention and restore testing for the database, attachments and configuration. Hardening covers the reverse proxy, service accounts, secrets and network exposure. Ask how restore tests are evidenced and how often they run, since a backup that has never been restored is not yet a control.
Upgrade and release handling
Zammad ships minor releases and security releases on separate lines, and fixes can land on more than one line in the same period. DeployOpen plans the upgrade path, tests it in a staging copy, and applies it in a window your operations team agrees. Before you commit, check which release line your team will track and how security releases are handled in your change process.
Documentation and compliance evidence
DeployOpen documents the architecture, configuration, backup and restore procedures, and access controls, and prepares the evidence that compliance assessments ask for. DeployOpen does not issue audit reports or certifications, so independent auditors and certification bodies judge the result. Ask which controls your assessor expects to see and whether they will accept the documented evidence before the engagement is scoped.
Optional retainers for ongoing support
Ongoing support, upgrades and continuous testing can run under a retainer after the initial build. This is the recurring part of self-hosting that the hosted plan folds into its per-agent fee, so budget it separately. Ask for the retainer scope in writing, including who responds to incidents, which upgrades are included and how Zammad vendor support subscriptions interact with the retainer.
How DeployOpen scopes, delivers and supports self-hosted Zammad
DeployOpen plans, implements, integrates, hardens, backs up, upgrades and documents self-hosted platforms inside your own cloud accounts, data centers or air-gapped networks. For Zammad, that means starting from your channels, identity provider and data residency needs, then deciding with you whether self-hosting is the right model before any build work begins.
How we scope
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
- The written scope lists the channels, identity sources, integrations and migration sources in use today.
- Scope records who owns backups, patching, Elasticsearch and hosting, so responsibilities are explicit before quoting.
How we build
- Installation follows the chosen method, whether DEB or RPM packages, Docker Compose or Helm, within your infrastructure.
- Prerequisites such as PostgreSQL, Redis, Elasticsearch and Memcached are configured and tested against your environment.
- Identity integration, such as SAML or OpenID Connect, is configured and checked against your directory before go-live.
How we hand over
- Handover includes architecture notes, configuration records, backup and restore procedures, and an upgrade runbook.
- Migration from an existing helpdesk is tested with sample data so the team can verify tickets, users and attachments.
- Your staff receive documented admin tasks so routine operations do not depend on a single person.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Security releases and minor versions are reviewed and applied according to the agreed retainer scope.
- Ask for a written quote that names who handles patching, backups, monitoring and vendor support escalation.
