What does a citizen participation platform cost to build, partner or buy as SaaS?
The total cost of a citizen participation platform depends on the hosting model, the capacity of your internal team, the integrations you need and the legal duties attached to each process, not on a single license fee. Decidim, the framework behind most self-hosted options, is free software licensed under the AGPL-3.0, so the money goes to infrastructure, implementation, support and internal staff time. Any SaaS quote has to be compared against those same lines, not against a zero-cost download.
Each cost line moves for different reasons. Infrastructure recurs every month and grows with the number of spaces, concurrent voters and file storage, and it also carries the cost of backups, monitoring and a staging environment for testing upgrades. Implementation is mostly one-time work: installation, theming, configuring authorization handlers, SMTP, maps, geocoding and any OmniAuth login to your identity provider. Support and upgrades recur, because Decidim asks implementers to move one minor version at a time and to back up the database before each step, and it only receives security updates for its two most recent minor versions. Ask any provider, SaaS or partner, to price each of these lines separately and to state who holds the upgrade and patching duty.
Bringing in an implementation partner tends to cost less than building alone when your team lacks Ruby on Rails, PostgreSQL and security operations experience, or when a launch date is fixed by a legal or election calendar. It also makes sense when verification, retention or accessibility work would otherwise absorb months of internal time. A partner is worth comparing with SaaS on total cost over several years, including the exit cost if you later need to move data out. Before you request a quote, confirm the scope in writing, the recurring support terms after go-live, and which party pays for security testing of custom themes and integrations.
Cost components across in-house, partner and SaaS
This table compares who pays for each cost line of a citizen participation platform under three models: running Decidim yourself, bringing in an implementation partner, or buying a SaaS subscription. Read each row for the payer and whether the cost is one-time or recurring, then check the drivers in the sections that follow before comparing quotes.
| Cost component | In-house | Implementation partner | SaaS subscription |
|---|---|---|---|
| Software license | Decidim is AGPL-3.0, so no license fee is paid; confirm obligations with counsel before modifying code | No license fee for Decidim; partner fees cover the work, not the software | Recurring subscription paid to the vendor, usually priced by organization or usage tier; confirm terms in writing |
| Hosting and infrastructure | Recurring cloud or data center costs paid by your organization, including PostgreSQL, storage, backups and mail relay | Usually recurring and paid by your organization to its own cloud or data center; partner sets it up and documents it | Included in the subscription; confirm data location, backup and exit terms |
| Initial configuration and theming | One-time staff time for setup, spaces, components and custom themes | One-time, fixed-scope fee agreed in writing before work starts | One-time configuration effort, often by vendor or your staff within product limits |
| Integrations (identity, census, maps, email) | One-time build and test effort, plus ongoing maintenance when providers change | One-time fixed-scope build, with a separate scope for later changes | Often limited to the vendor's supported connectors; custom integrations may carry extra fees |
| Accessibility and security testing | Internal or external testing paid by your organization; one-time before launch and repeated after changes | Testing can be scoped in the same written agreement or bought separately from a testing provider | Vendor evidence may be available; confirm what is tested and whether results are shared |
| Upgrades and patching | Recurring internal staff time to follow each minor release upgrade path and apply security patches | Optional recurring retainer for upgrades and patch cycles; scope and response terms set in writing | Included in the subscription; confirm timing of upgrades and how custom code is handled |
| Support after launch | Recurring internal on-call and moderation support staffed by your teams | Optional recurring support retainer; confirm hours, severity levels and response targets in the contract | Recurring support tier included or sold separately; confirm response terms |
| Internal staff time | Largest recurring line: product owner, platform engineer, security and moderation roles | Ongoing time from your staff to define scope, review deliverables and run processes | Ongoing time for process design, moderation and administration; technical work is lower |
What you actually pay for when you self-host Decidim
Decidim carries no per-seat license fee. It is free, open-source software licensed under the AGPL-3.0 and maintained by the Decidim Association together with Barcelona City Council, so the budget question is not what the software costs but what it takes to run it. In a self-hosted model, you pay for infrastructure, for the people who operate it, and for any outside partner you bring in. Subscription pricing from SaaS vendors is a different line entirely, and it should be compared against the full run cost of your own hosting, not against zero. The Decidim repository is the natural starting point for confirming the license terms with your legal team before you budget.
The recurring cost sits in the platform's operating services. A Ruby on Rails application on PostgreSQL needs hosting for the application servers, the database, background job processing (ActiveJob), file storage for uploads (ActiveStorage), outbound SMTP for notifications and verification emails, maps and geocoding for proposals and meetings, and any social login providers you enable. Decidim's production setup guidance expects you to configure each of these, and each has a different provider choice. Managed database or object storage, a commercial SMTP relay, or a paid geocoding service each carries its own charge and its own data location, which is why the choice of every service drives the bill as much as the server size does.
Ask the team who will pay for each of these services and on what terms, and get the answer in writing before comparing quotes. Confirm peak traffic expectations for a voting window, backup retention for the PostgreSQL database, and whether any service will send participant data outside your jurisdiction. Those answers decide whether the monthly run cost is modest or grows sharply during a campaign. Price the upgrade path too, because each Decidim minor version has its own upgrade steps and a database backup beforehand, and that work recurs every release cycle.
Which drivers move each cost line
Six drivers decide how large each cost line becomes for a self-hosted Decidim platform. Some move infrastructure and support, others move implementation and internal staff time, and several move more than one line at once. Review them together before comparing a build, partner or SaaS quote.
Participatory spaces and components in use
Every process, assembly, initiative and component you switch on adds configuration, content migration, testing and moderation work. A single consultation with surveys and a few proposals is a small job, while a city running budgets, assemblies and initiatives in parallel multiplies configuration and staff training effort. Ask a partner to price the spaces and components as separate line items so you can see which ones drive the total.
Identity verification scope
The volume of authorization is one of the largest levers on implementation effort. Census uploads need data mapping and secure handling, while eID or SSO integration through OmniAuth needs configuration, a provider agreement and testing against each identity provider. Each additional verification method raises build cost, support load and the number of records you must justify keeping. Confirm which methods your legal basis actually requires before you scope them.
Accessibility and custom theme testing
A custom theme that departs from the standard components creates more testing work against WCAG 2.1 Level AA, which the ADA Title II rule requires for US state and local government web content. Each custom template, form and voting flow needs manual and assistive technology testing before launch, and every upstream upgrade can reopen that work. Ask for the test scope and the accessibility evidence in the quote, not only a list of changes.
Hosting location and data residency
Where the platform runs decides who operates the servers, backups, mail relay, maps and geocoding. Hosting inside municipal or national infrastructure shifts cost onto your own staff and procurement, while a cloud account you control moves it to recurring infrastructure fees. Any external map, geocoding or social login service that sends data abroad adds legal review and transfer documentation. Confirm each external dependency with your data protection officer before pricing hosting.
Upgrade cadence against supported versions
Decidim supports only the last two minor versions with security updates until version 1.0, currently 0.32.x and 0.31.x. The update guide asks you to move one minor version at a time and back up the database first, because some releases change database structures. Frequent upgrades raise recurring partner or staff hours, while a platform that falls behind the supported line forces an expensive catch-up upgrade. Ask whether the quote covers each minor-version step, testing and the patch windows.
Stakeholders and staff roles
The number of administrators, moderators, reviewers and external organizers who use the platform sets the training, access design and support volume. Each role needs permissions reviewed, onboarding material and a named owner for moderation decisions. A large municipal team with many departments costs more to onboard and support than a small team running one consultation, even when the software is identical. Ask the partner to define roles and handover responsibilities in writing before work starts.
How to build your own estimate
This sequence turns a vague budget question into a written, comparable scope that each build, partner or SaaS option can be priced against. It ends with quotes you can line up side by side.
List required spaces and components
Start by writing down every participatory space and component you need, such as processes, assemblies, initiatives, meetings, surveys, proposals, participatory budgets and accountability tracking. Mark which ones are needed at launch and which can wait. Decidim provides these building blocks, so each one you keep in scope adds configuration, testing and content work. Done when a product owner and a legal reviewer have both signed the list, and every line states how many spaces or budgets it covers.
Map each integration and its owner
For each integration, such as identity verification, census uploads, SMTP, maps and geocoding, social login and file storage, record who owns the system, who holds the credentials and who pays for any third-party service. Name an internal owner for every line. Gaps here are the most common source of surprise cost later, because an unowned integration usually lands on whoever answers the support ticket. Done when every integration has a named owner and a written note on whether its data leaves your jurisdiction.
Decide hosting and who operates it
Choose where the platform runs, whether in your cloud account, your data center or a provider you contract, and who patches the operating system, database and application. Decidim can be installed manually as a Rails application or with Docker, and production setups configure background jobs, file storage and mail. Record each operating task against an internal team or an external provider. Done when you have a responsibility table that shows who is on call for an outage and who restores backups.
Estimate upgrade work by minor version
Plan upgrades using Decidim's update path, which asks you to move one minor version at a time, for example 0.29 to 0.30 before 0.31, and to follow each release's upgrade instructions because some change database structures. Back up the database before every upgrade. Estimate the testing effort for each step on your custom components and themes, and ask whether the vendor or partner will carry that work. Done when you have a calendar of expected upgrade steps and a quoted line for each one.
Plan security reporting and patch windows
Set up a reporting route for vulnerabilities and agree who applies patches. Decidim's security policy gives implementers a grace period of 2 months to apply patches for standard vulnerabilities and 4 months for critical ones before details are disclosed, and it only supports the last two minor versions with security updates. Treat those windows as your internal deadlines, and budget for patch testing inside them. Done when the patch process, the on-call contact and the version you run are documented and reviewed by security.
Request written quotes against the same scope
Send the same scope document to each build option, each SaaS vendor and each implementation partner. Ask for the price split into one-time work and recurring fees, and ask each party to name what it excludes. Ask vendors for fixed-scope deliverables with written acceptance criteria, and ask partners for their support and upgrade terms in writing. Done when every quote answers the same list of spaces, integrations, hosting and support items, so the totals can be compared line by line.
When building in-house, partnering or buying SaaS costs less
Building in-house means your own engineers install, customize, integrate and operate Decidim on infrastructure you control. The cost is mostly internal staff time and the cloud or data center capacity you pay for, with no vendor license fee because Decidim is free software under the AGPL-3.0. Most of the spend is recurring: upgrades, patching and security response continue for the life of the platform. This model tends to cost less when a team already runs Ruby on Rails and PostgreSQL in production, has spare capacity for minor-version upgrades, and can respond to security reports within the timelines Decidim publishes.
- Staff time: Platform, application and security engineers carry the work, so the cost is their salaries and the opportunity cost of other projects.
- Upgrade path: Decidim asks operators to move one minor version at a time with the release's upgrade instructions and a database backup first, which is a planned recurring task.
- Security response: Only the last two minor versions receive security updates before version 1.0, and implementers get a 2-month window for standard vulnerabilities and 4 months for critical ones.
- Hidden line items: Custom themes, accessibility testing and integration work with your identity and census systems are often underestimated.
Before committing, ask your team to estimate its upgrade and patch hours per year and whether those hours are already funded.",
An implementation partner plans, deploys, integrates, hardens and hands over Decidim inside your infrastructure under a written, fixed scope. The major cost is the one-time setup fee for scope, deployment, integration and documentation, which DeployOpen agrees in writing before work starts. Ongoing support, upgrades and testing can be bought as a retainer after go-live, so you pay for recurring work only at the level you need. This model tends to cost less when you need specialist delivery quickly, lack Rails or PostgreSQL depth in-house, or want the handover finished before internal staff take over operations.
- One-time setup: Scope, deployment, identity integration, theming and handover are priced once against the written deliverables.
- Retainer: Upgrades, security response and continuous testing are a recurring fee that you can size to your upgrade cadence.
- Internal oversight: You still need a named owner who approves changes, manages participants and decides on process rules.
- Exit terms: Confirm who holds the code, runbooks and infrastructure access at handover.
Ask for the fixed-scope statement, the retainer's response expectations in writing and what happens to the platform if the retainer ends.
A SaaS vendor hosts Decidim or a comparable participation product and bills a recurring subscription, usually tied to features, participants or spaces. You pay the subscription, and the vendor carries most infrastructure, patching and upgrades. The cost is predictable in form but depends on the vendor's pricing terms, which you must read against your expected number of processes and participants. This model tends to cost less when you need a fast start, have no in-house platform team, and accept the vendor's hosting location and data terms.
- Fast start: Setup is usually shorter because the vendor operates the environment, but customization is limited to what the product offers.
- Recurring fee: The subscription recurs for as long as you use the service, so compare it with a multi-year self-hosted total.
- Control trade-off: You have less say over hosting location, backup timing, encryption keys and the version you run.
- Data terms: Identity data, votes and personal data sit with the vendor under its processing terms, which need review against your legal duties.
Request the vendor's current price schedule, data processing terms, subprocessor list and the hosting regions in writing, then compare them with your own estimate.
How legal duties and accessibility deadlines change the budget
The first budget question is which legal duties apply to your organization, because they set the testing and configuration work before any software is chosen. The US Department of Justice ADA Title II rule requires state and local government web content and mobile apps to meet WCAG 2.1 Level AA. An interim final rule published April 20, 2026 set compliance dates of April 26, 2027 for entities serving 50,000 or more people and April 26, 2028 for smaller entities and special districts. Confirm your population category and whether your participation pages, proposal forms, voting screens and mobile experience fall within the rule with your legal counsel before you fix a budget line for accessibility.
Accessibility work on a self-hosted Decidim site is not a one-time theme purchase. Your team or partner will need to test custom themes, forms, maps and the voting and signature flows against WCAG 2.1 Level AA, fix the defects found, and keep the accessibility statement and feedback route current. Each Decidim minor release or custom theme change can reopen that testing, so ask any quote to show whether regression testing after upgrades is included, and who carries it after go-live. Those are recurring costs that a SaaS subscription may or may not cover, so compare the vendor's written accessibility commitments line by line.
Data protection and verification duties add a second block of effort. Identity checks for votes or signatures, retention settings for proposals and participant records, and the processing terms with your hosting provider all need configuration, documentation and sign-off. Confirm with your data protection officer which lawful basis and retention periods apply, which authorization handlers and census data you will keep, and where the database, file storage and email relay physically sit. Ask each candidate, including a SaaS vendor, for its data processing terms in writing, because these answers decide whether the work is an internal task, a partner scope item or a vendor feature you already pay for.
Questions buyers ask before hiring outside help
How much does it cost to run Decidim yourself?
The software itself is free, so the cost is what you spend on infrastructure, people and outside services. Decidim is licensed under the AGPL-3.0, which means no license fee applies to running it. The recurring costs are hosting in your own cloud account or data center, PostgreSQL and file storage, email delivery through SMTP, map and geocoding services if you use them, and the staff time to patch, back up and upgrade. The main one-time costs are the initial installation, theme and component customization, identity integration and testing. Ask any partner for a quote that splits these lines out, names who is paid for each one, and states which items recur every year. The estimate steps on this page show how to size each line before you request prices.
Can our team run Decidim without an implementation partner?
Yes, if your team already runs Ruby on Rails and PostgreSQL applications in production and has capacity for security patching. Decidim is built on Ruby on Rails and PostgreSQL, and it can be installed manually or with Docker. Your team must keep up with the project's support policy: only the last two minor versions receive security updates before version 1.0, and security patches have to be applied within a grace period of 2 months for standard vulnerabilities and 4 months for critical ones. Upgrades must move one minor version at a time with each release's database changes applied. Teams without this experience usually find the first upgrade and the identity integration the hardest parts. Decide early which work your staff can own and which you will contract out.
How long does a Decidim rollout take, and what drives the timeline?
The timeline depends mainly on how much custom work the scope includes and how quickly your identity, hosting and approval steps move. Decidim has a standard installation path, so a plain deployment with default components is shorter than one that adds custom themes, census imports, a government eID login, or integration with existing systems. Other drivers include the hosting approvals needed inside your organization, data migration from older tools, accessibility testing and the review of your legal texts and privacy notices. Ask for a timeline that lists each milestone and its dependencies, and confirm which steps depend on your staff or your suppliers. The fixed scope agreed in writing sets the deliverables and dates before work starts.
What does the work need from our staff?
Plan for named owners in four areas: a product owner who decides how spaces, phases and components are set up, an infrastructure owner for hosting and backups, a security owner for patching and access, and a communications or civic team that writes and moderates content. An implementation partner will need access to your cloud or data center accounts, a decision maker for the identity provider, and someone who can sign off on data protection documents. Staff time is often the largest hidden cost, especially during testing and the first live process. Ask any partner to list the staff hours and roles they expect from your side, and to confirm who handles incidents after go-live.
What recurs after go-live?
Recurring costs fall into four groups: infrastructure, security maintenance, upgrades and support. Infrastructure includes compute, database, storage, backups and email, which you pay to your hosting provider on whatever billing cycle you use. Security maintenance means applying Decidim releases and dependency patches within the grace periods the project defines. Upgrades follow the one-minor-version path described in the update documentation, and each upgrade requires a tested database backup and a staging run. Support covers incidents, questions from administrators and periodic testing. Ask a partner whether support is offered as a retainer, what response terms apply, and how upgrades are priced. Recurring work continues for as long as the platform is live, so include it in any comparison with SaaS.
When does a SaaS platform become cheaper than self-hosting?
A SaaS platform tends to be cheaper when you run few processes, have little internal engineering capacity, and do not need control over where data is stored or how the software is changed. Self-hosting becomes more attractive when data residency rules, custom integrations, or identity requirements mean you must run the platform in your own infrastructure. Compare the total over the period you plan to run the platform, not only the first year. The SaaS vendor's published subscription pricing should be compared line by line with your hosting, staff, partner and upgrade costs. Also check the SaaS terms for data location, exit options and whether the features you need, such as custom authorization or accessibility work, are included. Use the requirements checklist to test both options against the same list.
Which parts of a Decidim project should we fix in a written scope?
Fix the items that drive both cost and risk: the spaces and components you will launch, the authorization and identity method, the hosting location, the data migration, the theme changes, and the support terms after launch. Most engagements are fixed-scope, so scope, deliverables and timelines are agreed in writing before work starts. Anything not listed is a change request with its own estimate. Ask for a list of exclusions as well as inclusions, and confirm how acceptance testing and handover work. Items such as accessibility testing and legal review should be listed separately, so you can see who owns them. A written scope is the best protection against unplanned cost growth in a self-hosted project.
What to ask for in a quote so the numbers are comparable
A quote is only comparable to another quote if both describe the same platform. Before you compare a DeployOpen scope, an in-house estimate and a SaaS subscription, ask each party to list the same components in the same order: the Decidim version and any custom components or themes, the spaces you will run (processes, assemblies, initiatives, budgets), hosting and who operates each layer, the integrations included (identity, census or SSO, maps and geocoding, SMTP, backups), and the data migration. Ask for the list as a table with a line per component, a column for one-time work and a column for recurring fees. Without that structure, a low headline number usually means that something has been moved to a later invoice or to your own staff.
Ask every bidder to state three operating terms in writing: how upgrades and security patches are handled, including how quickly a patch is applied after a release, since Decidim supports only its last two minor versions with security updates and its security policy sets patch windows for implementers; what support hours and response targets apply, and who is on call during a live voting period; and what is excluded, such as custom identity providers, accessibility remediation of custom themes, or content moderation. SaaS vendors will describe these terms in their service agreement, so ask them to map those terms onto the same component list. Confirm each exclusion against your own requirements before signing.
Separate one-time costs (setup, configuration, integration, migration, initial testing and launch) from recurring costs (hosting, backups, patching, support retainers, licences for any commercial add-ons, and your own staff time). Ask for a three-year view with both columns so that a cheap first year does not hide a costly run rate. Your internal estimate should follow the same split, and it should price staff time explicitly, because a self-hosted platform still needs someone to own patching and incident response. Treat any quote that cannot be split this way as incomplete, and ask for a revised version before comparing totals.
How DeployOpen scopes and delivers a fixed-scope participation platform
DeployOpen helps organizations compare build, partner and SaaS options for a self-hosted Decidim platform by turning the cost structure into a written, fixed scope. Engagements are agreed in writing before work starts, so the cost lines for hosting, implementation, testing, handover and support are visible before anything is built.
How we scope
- We list the hosting, implementation, integration and support lines so each one has a named owner and a written boundary.
- We record which spaces and components are in scope, such as processes, assemblies, budgets or initiatives, and which are deferred.
- We ask you to confirm internal staff time, so the quote reflects the work your own team will carry after launch.
How we build
- We deploy Decidim inside your cloud account, data center or air-gapped network, configured for background jobs, file storage, SMTP and maps.
- We configure the social login and identity integrations in the agreed scope, and we test them before the platform opens to participants.
- We run security testing on the application and the custom theme against the scope agreed in writing before go-live.
How we hand over
- We document the deployed architecture, the upgrade path one minor version at a time, and the database backup procedure your team will run.
- We deliver runbooks for staff roles, moderation tasks and incident response, so the operating cost is clear to your team.
- We prepare the compliance evidence in scope, such as configuration records and test results, for review by your own auditors.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, which turns recurring cost into a separate, agreed line.
- We plan upgrades against each Decidim release and its security support window, so your team knows when patches are due.
- We confirm the retainer scope, response expectations and exit terms in writing, so you can compare them with a SaaS subscription.
