Product analytics cost: build, partner or SaaS

SaaS pricing is published per tier, and the tiers are not equivalent, so the first job is to compare like with like. Umami Cloud lists a Hobby plan at $0 per month for up to 100K events with 6 months of retention, a Pro plan at $20 per month for 1 million events with 2 years of retention, and a Business plan at $200 per month for 10 million events with 5 years of retention. Overage on Pro is $0.00003 per extra event and on Business it is $0.00002 per extra event. Umami also states that the self-hosted version is free to run, so the Cloud fee buys hosting, operation and the features Umami lists as Cloud-only, such as email reports and a streaming API. PostHog's pricing works differently. Its pricing page says the first 1 million analytics events are free every month, and the Free plan includes 1 project with 1-year data retention. The Pay-as-you-go plan raises the limit to 6 projects and 7-year retention. Retention is therefore a plan decision as well as a storage decision: if your compliance or investigation window is longer than one year, the Free plan may not meet it. Confirm the retention period you need before you compare event counts, because the two numbers move together on PostHog's plans. OpenReplay Dedicated, a fully managed instance, starts at $199 per month on AWS, GCP or Azure with a 7-day trial. The pricing page places SSO and SAML, SCIM provisioning, roles and permissions, audit trail, a custom SLA and dedicated support in its self-hosted Enterprise edition, which is quoted at custom pricing on multi-year contracts. PostHog also sells SSO, audit logs, custom roles and project permissions as platform packages. A lower entry price therefore may not include the access controls a regulated team needs, so price the tier that includes those controls and confirm in writing which features each published plan actually provides.

The line items that surprise budget owners are rarely the server bill. They are support, migration and the staff hours spent keeping the stack upgraded and recoverable. PostHog states that self-hosted deployments are officially unsupported and that it does not offer customer support for product, infrastructure or other questions on self-hosted instances. OpenReplay's free edition is backed by community support with self-managed retention, and its paid self-hosted Enterprise edition is quoted on custom multi-year contracts that add a custom SLA and dedicated support. Before comparing totals, ask each vendor in writing what support is included at the edition you plan to run, what a paid support tier costs, and whether it covers upgrades and incident response. If the answer is none, the support line is your team's on-call rotation, and it should be costed as staff time.

Migration limits create a second hidden cost. PostHog's managed migrations import historical events from Mixpanel or Amplitude, or from JSONL files in an S3 bucket, but each direct import job covers at most one year of data, events are not deduplicated, and there is no way to selectively delete event data once imported. Historical imports skip ingestion fees when sent with the historical_migration flag, yet a paid product analytics plan is still required to unlock the import features. Plan the migration as a project with its own owner: decide how many years of history you need, run a test import, check for duplicate counts against the old tool, and confirm the paid plan cost before any import starts. Rework after a bad import can be expensive because the data cannot be cleanly removed.

Staff time is the largest recurring line and the easiest to underestimate. Upgrades, backups, storage growth, retention jobs and incident response all land on your platform team unless a partner or retainer takes them. Note that PostHog's self-host documentation says new Kubernetes deployments of its paid self-hosted product are no longer supported, so a cluster-based design that looked reasonable at procurement may need a different target, which changes both build effort and hosting cost. Ask any implementation partner to price upgrades, restore testing and on-call coverage as separate line items in a fixed-scope quote, so you can see which hours you are buying and which you still carry internally.

An implementation partner costs less than building alone when the in-house cost is mostly recurring and the partner cost is one-time and bounded. A fixed-scope engagement puts a price on deployment, masking and retention configuration, integration and handover, and that number stays the same whatever the work turns out to take. In-house work carries costs that do not show up on a hosting invoice: engineer hours for upgrades and patches, on-call coverage for a session replay store that cannot go down quietly, and the learning curve for capture-time masking selectors, input redaction and retention settings that a team may only touch once a year. Compare those recurring lines over the period you expect to run the platform, not against the first month of a free Docker Compose install.

DeployOpen works on fixed scope agreed in writing before work starts. It does not publish a price list, so the reader should ask for a quote built from a written scope that names the platform and edition (for example, whether the team needs the open-source build or a paid edition), the hosting target, the masking and retention rules to be configured, the integrations, the handover documentation and any post-go-live support or retainer. Ask the partner to separate one-time deployment work from recurring items so the two can be compared with your internal staff time. Confirm with the vendor which features sit in paid packages before you assume they are included in the quote. Note that PostHog's self-host documentation states that it does not offer customer support for self-hosted instances, so the support line has to come from somewhere.

DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. Any partner quote should therefore cover the evidence package (configuration records, masking tests, retention settings, access reviews and architecture documentation) but not promise an outcome from an auditor. The assessor who reviews your program decides what the evidence proves. Plan for that assessment as a separate cost in your budget, and ask the partner to name the artifacts it will hand over so your compliance lead can check them against the assessor's request list before the review begins.