Digital workplace suite cost: build, partner or SaaS

A self-hosted workplace suite trades per-user licenses for infrastructure, subscriptions, implementation and operations staffing. This page breaks down each cost, what is one-time versus recurring, and how to build your own estimate.

On this page

What does a digital workplace suite cost to self-host, and what does it depend on?

When you compare a self-hosted suite such as openDesk or a Nextcloud-centred stack with a per-user productivity license, the license line is only part of the picture. Cost is set by who builds, runs and supports the stack, and that answer changes the total far more than the software fees do. Most of the open-source components in these stacks carry no license fee at all, so the budget question is really about infrastructure, subscriptions for support, the people who implement and migrate, and the staff who operate the platform after go-live.

The main cost blocks are four. First, Kubernetes infrastructure and external services: openDesk expects a CNCF-certified cluster and production-grade PostgreSQL, MariaDB, Redis, object storage, an SMTP relay, ClamAV and a TURN server, each of which you must host, license or buy as a managed service. Second, Enterprise subscriptions, which can be bought per component (for example, Nextcloud Enterprise, sold in tiers with a 100-user minimum according to the Nextcloud pricing page) or as openDesk Enterprise Edition for SLA-backed second and third level support. Third, implementation and migration of identity, files, mail and chat. Fourth, operations staffing for upgrades, backups and monitoring. The figure depends on scope, user count, edition and operating model, so no reliable total can be stated before those are fixed in writing.

Ask each bidder to price these blocks separately and to state which are one-time and which recur each year. Confirm which external services are included, which are your responsibility, and whether support covers every bundled component or only some. Check the upgrade effort too: Nextcloud requires one major version at a time, and openDesk supports only its latest minor version, so budget for recurring upgrade rehearsals. Compare the result against your current per-user license spend over the same period, using the same user count, support level and hosting assumptions, so that the comparison is like for like.

Which cost components apply in-house, with a partner, or as SaaS

This table shows who pays for each cost component of a self-hosted workplace suite under three models: your own staff, an implementation partner, or a per-user SaaS license. Read each row for the recurring or one-time nature of the cost and the source that sets its figure, then ask your partner or vendor to price each row separately in the written scope.

Cost componentIn-houseImplementation partnerSaaS per-user license
Kubernetes platform and infrastructureRecurring: your cloud or data center bill and platform staff. openDesk requires a CNCF-certified cluster at v1.33 or later (openDesk requirements docs).One-time design and build, then optional recurring support. Scope the cluster build separately from the suite install.Included in the provider's fee. Confirm data residency and where tenant data is stored.
External production services (PostgreSQL, MariaDB, Redis, Memcached, Cassandra, SMTP relay, ClamAV over ICAP, object storage, TURN)Recurring: licenses or cloud charges for managed or self-run services, plus DBA and on-call time. openDesk expects these for production (openDesk requirements docs).One-time setup and tuning, with recurring managed-service fees if the partner operates them. Ask which items are in scope.Included in the provider's fee. Ask which of these services the provider runs and how backups are handled.
Enterprise subscriptions (openDesk EE, Nextcloud Enterprise tiers)Recurring: openDesk Enterprise Edition is recommended for production and sold as SaaS or for on-premises installation (openDesk EE docs). Nextcloud Enterprise list prices start at 71.29 euros per user per year for Standard, 100-user minimum (Nextcloud pricing page).Subscription passes through the partner or is bought directly. Ask whether support tiers are included in the implementation fee.Usually bundled into the per-user price. Confirm which support level and patch guarantees are included.
Identity (Keycloak or Nubus)Recurring: staff time for realm, client and federation upkeep. Keycloak is Apache 2.0 licensed, so the software itself carries no license fee (keycloak/keycloak GitHub repository).One-time federation design and connection to your directory, then optional recurring upgrade support. Ask who owns the directory connector.Included in the provider's identity model. Confirm how external directories such as Active Directory are federated.
Implementation and migrationOne-time: internal project staff, testing, and migration of mail, files and wiki content. Effort depends on data volume and the number of components.One-time, fixed-scope work agreed in writing before start. Ask for separate lines for data migration, hardening and rollout.One-time onboarding and data import, often limited to vendor tools. Confirm what migration support is included and at what cost.
Operations staffing and upgradesRecurring: platform, security and application staff for monthly openDesk minor releases and Nextcloud major upgrades, one major at a time (Nextcloud upgrade docs).Recurring retainer for upgrades, monitoring and support, if contracted. Confirm response times and what is excluded.Recurring and mostly absorbed by the provider. Confirm the upgrade cadence, change notice and any customization limits.
Per-user productivity cloud comparisonYour team carries infrastructure, licensing and operations costs in full. Cost depends on scale and staffing, so model it per user per year.Partner fees sit on top of your infrastructure and enterprise subscriptions. Request a total cost of ownership comparison in the quote.Recurring per-user fee for every seat, with the price set by the vendor. Compare against the self-hosted total over the same number of years.

What moves the cost of a self-hosted workplace suite up or down

A self-hosted workplace suite has a few cost levers that compound: how many users and which tier they sit in, which components you run, how much support you buy, and how much identity, migration and sovereignty work sits around the platform. Each card below names one lever, the direction it pushes the cost, and what to request in a written quote.

User count and tier thresholds

Subscription pricing for Enterprise tiers is usually per user, so the headcount in scope sets the largest recurring line. Nextcloud Enterprise, for example, has a 100-user minimum and lower per-user rates from 200 users, so a population just under a threshold can cost more per head than a larger one. Infrastructure grows more slowly than users, but storage and concurrent-session peaks still rise with headcount. Ask the quote to show the price at your current count and at the next tier break, with the per-user rate written out.

Components in scope

Every bundled component adds its own database, cache, storage, backup job and upgrade path, so the number of components in scope drives both build and run costs. Chat, video, mail and wiki each bring distinct operational work even when they share one identity layer. A narrower first wave, for example files and identity only, lowers initial effort but leaves later components to be added on the same platform. Ask for a line item per component, including who operates it after handover.

Edition and support level

Community editions carry no vendor subscription, but production support then depends on your own staff or a partner's retainer. Enterprise editions add paid patches, service levels and support hours, and the openDesk Enterprise Edition is sold as SaaS or for on-premises installation. Support tiers differ widely in response time and maintenance lifecycle, so compare them against your incident obligations rather than the list price. Ask the quote to separate subscription fees from implementation and retainer fees, and to state the response times and lifecycle length each tier includes.

Production versus evaluation hardware

An evaluation deployment can run on a single modest host, but production expects a Kubernetes cluster plus externally managed PostgreSQL, MariaDB, Redis, Memcached, Cassandra, an SMTP relay, ClamAV, object storage and a TURN server. Those services are often the largest recurring infrastructure line, and they need high availability, backups and monitoring. The gap between a proof of concept and production is therefore mostly paid for in external services and operations time. Ask the quote to list each external service, whether it runs in your environment or is provided, and who patches it.

Identity federation complexity

Connecting the suite to an existing directory is a one-time integration cost that varies with how many identity sources you run. A single OIDC or SAML connection to an identity provider such as Keycloak is comparatively contained, while LDAP or Active Directory synchronization, attribute mapping and multi-domain setups add design and testing work. Identity also becomes a recurring operations duty, since joiners, movers and leavers must flow through every component. Ask for the federation design, the attribute mapping sheet and the test plan as separate deliverables with their own effort.

Migration volume and sovereignty constraints

Migration cost scales with the volume of mailboxes, files, calendars and wiki content moved from existing platforms, and with how much history must be kept. Air-gapped or sovereign hosting adds costs for mirroring signed charts and pinned images, running internal relays and services, and hosting in your own data center. Both drive one-time effort with a long tail, because cutover, coexistence and rehearsal run in parallel with normal operations. Ask the quote for migration estimates per data source, the number of rehearsal cycles and the offline mirror process as priced items.

Which costs are one-time and which recur every year

Most of the money in a self-hosted workplace suite is spent before the first user logs in, but a large share recurs for as long as the suite runs. One-time costs cover solution design, deployment into your Kubernetes platform, connecting the suite to your identity provider, migrating mail and files, hardening, writing the documentation your auditors will ask for, and rehearsing upgrades in a non-production environment. Ask any partner to price these as separate line items with named deliverables, because they are the work most likely to be underestimated when a quote is compared with a per-user license. Confirm with the partner whether migration is priced by mailbox or file volume, and whether rehearsals are included or billed as extra cycles.

Recurring costs are the ones that decide the long-term total. They include the Kubernetes infrastructure, the external PostgreSQL, Redis, object storage, SMTP, antivirus and TURN services that openDesk expects in production, backups, monitoring, and the staff time that keeps all of it patched. Subscriptions also recur. ZenDiS sells openDesk Enterprise Edition for production with SLA-backed support, and Nextcloud Enterprise is priced per user per year with a 100-user minimum on its pricing page, so the subscription line grows with headcount and tier. Nextcloud publishes a new major version every four months and supports each one for one year, which means at least one major upgrade cycle per year. openDesk ships monthly minor releases, so the rehearsal and patch cycle never fully stops.

Before you sign, ask for a quote that splits the recurring model into annual and monthly components: infrastructure, subscriptions by tier and seat count, support hours, upgrade labor per cycle, and monitoring and backup operation. Ask how the partner prices each Nextcloud major upgrade and each openDesk minor rehearsal, and what happens to the subscription when the user count falls below 100. Those answers will show you whether the recurring cost is fixed or grows with the way your organization actually uses the suite.

How build, partner and SaaS options compare on cost and effort

Your organization pays for every layer directly: Kubernetes capacity, the external services openDesk expects in production, staff to deploy and operate the components, and any support contracts you choose to buy. Licence fees for the open-source core are typically zero, but each bundled component keeps its own licence terms, so legal review is still a cost. You keep full control of data location, change timing and configuration, which is the main reason regulated buyers choose this model.

  • Infrastructure you fund: Kubernetes clusters at or above the version openDesk requires, an ingress controller, cert-manager, storage, and production-grade PostgreSQL, MariaDB, Redis, Memcached, Cassandra, SMTP relay, ClamAV, object storage and TURN services.
  • Staffing you carry: platform engineers for Kubernetes, application owners for each component, and people who track monthly minor releases and roll them out without breaking the suite.
  • Hidden effort: upgrade rehearsals, security patching across every component, and certificate and secret rotation, all of which recur for the life of the suite.
  • Support gap: without an enterprise subscription, second and third level support must come from your own team or a contracted provider.
  • Exit position: you own the exit, since the data sits in your infrastructure, but moving to another platform still means re-testing every integration.

Before committing, ask your platform team to estimate their monthly operating load in writing and compare it with the upgrade cadence in the openDesk release documentation.

How to build your own cost estimate step by step

This sequence turns a vague budget question into a line-by-line estimate that covers infrastructure, licenses, migration and staffing, so you can compare a self-hosted suite against your current per-user spend on equal terms.

  1. Fix the component list and user count

    Start by listing every workplace function in scope (files, office editing, mail, chat, video, wiki, projects and identity) and the number of named users and external guests each one serves. The owner is usually the CIO or head of workplace, with input from business units on who needs which tool. The check that closes this step is a signed-off scope sheet that maps each current license to a replacement component, so no function is priced by assumption. Note any function you plan to keep on an existing product, because its cost stays in the comparison.

  2. Pick the edition and support tier per component

    For each component, decide between the community build and a paid enterprise option, and record the support level you need. If you plan to use openDesk, ask ZenDiS-related partners to confirm how openDesk Enterprise Edition is sold (SaaS or on-premises) and which closed-source modules and SLA-backed support it includes. For Nextcloud, compare the Standard, Premium and Ultimate tiers, which carry a 100-user minimum and per-user annual list prices from the vendor's pricing page. Output: a table of components, editions, support hours and recurring license cost per user per year.

  3. Size the Kubernetes cluster and external services

    Map the production requirements to hardware and managed services. openDesk expects a CNCF-certified Kubernetes cluster at v1.33 or later, plus an ingress controller, cert-manager and an RWO volume provisioner, and it expects external production-grade PostgreSQL 15, MariaDB 10, Redis 7, Memcached, Cassandra, an SMTP relay, ClamAV over ICAP, object storage and a TURN server. Ask your platform team and your cloud or data center provider to quote each item, and separate what you already run from what is new. Note that the 12-core, 32 GB evaluation minimum is not a production sizing. The check is a bill of materials with a monthly and one-time cost per item.

  4. Price identity federation and data migration

    Estimate the work to connect the suite to the identity you already run, such as Active Directory, LDAP or an OIDC provider, and to move mail, files, calendars and wiki content from current tools. Identity federation is often a one-time project, while migration effort depends on data volume, mailbox count and how many legacy systems hold content. Ask the implementation partner for a fixed-scope quote that lists the directory sources, attribute mappings, migration waves, cutover rehearsals and validation steps. Keycloak and Nextcloud documentation both describe supported authentication backends, which helps scope the integration work. The check is a written migration plan with a fixed price for each wave.

  5. Estimate staffing for operations and upgrades

    Operations is the largest recurring cost that teams often leave out. Estimate the people who run Kubernetes, databases, backups, monitoring, security patching and user support, and note whether these roles are internal, retained from a partner or split. Upgrade cadence matters here: openDesk plans monthly minor releases and supports only the latest minor version, and Nextcloud requires one major version at a time with a backup before each upgrade. Include a test environment in the estimate so upgrades can be rehearsed. The check is a staffing table with hours per month per role and a note on which tasks a support retainer covers.

  6. Compare the total against current license spend

    Add up the one-time costs (implementation, migration, hardware setup, testing) and the recurring costs (infrastructure, external services, subscriptions, staffing, support) over the same number of years you use for your productivity cloud contract. Set this against your current per-user license invoices, including add-ons for storage, compliance and security features that you pay for today. Ask each vendor and partner to quote in a common currency, with the same user count, term and escalation assumptions. The check is a side-by-side table with a sensitivity line for user growth, so the decision holds if headcount changes.

How per-user productivity licenses compare with self-hosted run costs

A per-user license is easy to compare on paper because the price is a single line per seat, but a self-hosted suite is a set of costs with different owners and rhythms. The fair comparison puts a fixed-scope implementation (one-time), Kubernetes infrastructure and the external services openDesk expects in production (recurring), any vendor subscriptions such as Nextcloud Enterprise or openDesk Enterprise Edition (recurring, per user or per deployment depending on the product), and the internal staff time to operate, patch and support the suite. Ask each cloud vendor and each implementation partner for the same list of line items, and make sure the cloud side includes the add-ons you would need for the same functions, such as archiving, eDiscovery or advanced security. The staff line is the one most often left out. Confirm who will run the platform, how many hours per month that role needs in your environment, and whether that work competes with projects you already have.

Retention and compliance evidence can change the baseline more than the license price. If you are a broker-dealer, SEC Rule 17a-4(b)(4) requires preservation of communications relating to the business for not less than three years, so your chat, mail and file archives must be kept in a form you can produce. In a self-hosted design, that means budgeting for storage growth, backup copies, immutability or write-once controls where your records policy requires them, and the audit trail that shows retention was applied. If you handle ePHI, the HIPAA Security Rule at 45 CFR 164.312(b) requires audit controls that record and examine activity in systems containing ePHI, and 164.312(e)(1) requires protection of ePHI in transit. Some SaaS plans include these features only in higher tiers, so compare tier to tier, not list price to list price. Keep in mind that DeployOpen prepares controls and evidence, while auditors issue the assessment.

Sovereignty and data residency can move the baseline in either direction. If a regulator, ministry or customer contract requires that data, keys and administrative access stay in named jurisdictions, a US-hosted productivity cloud may need extra contractual or technical controls, or may not qualify at all, which turns the license comparison into a compliance cost question. A self-hosted or EU-hosted stack adds infrastructure and operations cost but removes some of that exposure. Before you compare totals, confirm the data residency of each component, the location of backups and logs, and who holds administrative credentials. Those answers determine whether the cloud option is even in the comparison set, and they should be written into the quote scope so the two models are measured against the same requirements.

What do buyers ask before they hire help for a workplace suite?

How much effort does a self-hosted workplace suite take to run?

Effort depends less on the initial install than on the number of components, the identity integration and how often you upgrade. openDesk is deployed with Helmfile and Helm on a CNCF-certified Kubernetes cluster, and it bundles many separate applications, each with its own database, cache, backups and patch cycle. The openDesk release management documentation describes monthly minor releases and annual major releases, and only the latest minor version is supported. That cadence is the main recurring workload. Ask any partner to size the effort per component and per release, and to show how a monthly upgrade is tested before it reaches production.

How long does a workplace suite implementation take?

No reliable duration can be given here without a defined scope, because timing depends on the components in scope, the number of users, the identity sources to connect, the data to migrate and the hosting platform that already exists. Those inputs vary widely between organizations. Most DeployOpen engagements are fixed-scope, so the duration, milestones and deliverables are written into the agreement before work starts. Ask for a written plan that separates the platform build, identity integration, migration waves, user acceptance and the go-live window, and confirm which of these depend on work your own teams must deliver.

Can our internal team deploy and run the suite without a partner?

Yes, some teams do, provided they have the skills to operate the stack. The openDesk requirements expect a Kubernetes platform at v1.33 or later, an ingress controller, cert-manager, a volume provisioner and external production-grade services such as PostgreSQL 15, MariaDB 10, Redis 7, an SMTP relay, ClamAV over ICAP, object storage and a TURN server. Your team needs people who can operate each of these, plus identity and security staff. Assess honestly whether you already run that combination and how many people can cover on-call and upgrades. A partner can run the build, the hardening and the handover, or take on ongoing operations under a retainer.

What does our side need to provide during implementation?

Three groups of people are needed from your organization. Identity owners must decide how users, groups and roles are sourced, and they must approve the federation design, for example against Active Directory, Entra ID or an existing Keycloak realm. Platform staff must provide the Kubernetes cluster, network paths, DNS, certificates and access to the external services. Data owners must confirm which files, mailboxes, wiki spaces and projects move, who approves retention rules and who signs off on acceptance testing. Confirm the time commitment for each role in the written scope, because delays on these inputs are a common source of schedule slippage.

Is Enterprise support required before running openDesk in production?

ZenDiS recommends openDesk Enterprise Edition for production. It uses the same open-source core licenses but adds closed-source modules, an Enterprise-only registry and license file, and SLA-backed second and third level support and patches, sold as SaaS or for on-premises installation. Whether your organization needs it depends on your risk tolerance, support obligations and whether you can supply equivalent patching and second-level expertise yourselves. For Nextcloud, the Enterprise tiers are a separate commercial choice. Check the openDesk Enterprise Edition documentation and confirm the exact support terms with ZenDiS or your reseller before deciding.

How does the cost change after go-live?

After go-live, costs shift from one-time build work to recurring items. Recurring costs include cloud or data center infrastructure, managed database and storage services, SMTP and antivirus capacity, support subscriptions if chosen, and staff time for upgrades, monitoring and user support. Nextcloud Enterprise, for example, is priced per user per year from 100 users, according to Nextcloud's pricing page, so per-user subscriptions grow with headcount. Upgrades also recur: Nextcloud does not allow skipping major releases, so each one needs its own rehearsal. Ask for a quote that splits one-time and annual costs, and shows what changes when user numbers grow.

How do self-hosted suite costs compare with per-user productivity cloud licenses?

The comparison is not just license price against infrastructure price. A self-hosted suite replaces per-user fees with infrastructure, subscriptions for components that need them, implementation work and operations staffing. A productivity cloud shifts most of that work to the vendor but keeps charging per user every year. Build a comparison over the same period and user count, including exit costs, data residency needs and the staff you must keep. Ask bidders to show each cost line, identify which items are one-time and which recur, and state the assumptions for user growth and upgrade frequency.

What a fixed-scope quote from DeployOpen covers

DeployOpen plans, implements, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure, whether that is your cloud accounts, data centers or air-gapped networks. For a digital workplace suite, that means the work covers the components you choose, the identity layer they share, the Kubernetes deployment and the external services they depend on, not only the installation. Most engagements are fixed-scope, so the components in scope, the deliverables and the timeline are agreed in writing before any work starts. Before you request a quote, settle the component list, the number of users, the identity source, the migration sources and the hosting location, because each one changes the effort that the written scope must describe.

DeployOpen does not publish a price list. A quote follows from the written scope, so the same suite can be priced very differently depending on whether it covers a single evaluation environment or a production deployment with migration, hardening and documentation. Ask the partner to show, line by line, which items are one-time (design, deployment, data migration, acceptance testing) and which recur (operations, patching, backups and support). Ask also how the quote treats third-party subscriptions such as Enterprise support or external database and mail services, which are paid to their vendors rather than to the implementation partner. Confirm who owns the Kubernetes platform, since a suite cannot run without it.

Ongoing work after go-live is handled separately from the initial scope. DeployOpen offers retainers for ongoing support, upgrades and continuous testing, so ask for the retainer terms in writing: which upgrade cadence is covered, how major version moves are planned, what response commitments apply and whether backup restore tests are included. Because platforms such as Nextcloud and openDesk release on their own schedules, a retainer that names the upgrade windows and the rehearsal environment is easier to budget than an open-ended support arrangement. Treat the retainer as the recurring line in your cost model and check that it matches the operating model your own team has decided to keep.

How DeployOpen works on this

DeployOpen treats the build, partner or SaaS decision as a written scope question first. We plan, implement, customize, integrate, harden, document and support self-hosted open-source workplace components inside your own cloud accounts, data centers or air-gapped networks, so the cost lines in your quote map to specific deliverables you can review before work starts.

How we scope

  • Written scope lists the components in scope, such as files, office, mail, chat, video, wiki and projects, and which ones stay on a SaaS or existing service.
  • Cost lines are tied to named deliverables: Kubernetes setup, external database and cache services, identity integration, migration waves and operations handover.
  • Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that written scope.

How we build

  • Deployment is planned against the platform's stated prerequisites, including Kubernetes version, ingress, certificate management and external production-grade services.
  • Identity federation, SMTP relay, antivirus, TURN and object storage are configured and tested as part of the build, not left as open items.
  • Security testing of applications, APIs and infrastructure can be scoped alongside the build so hardening findings are resolved before users arrive.

How we hand over

  • Handover covers configuration, runbooks, upgrade procedures and backup and restore steps, written for the staff who will run the platform.
  • Compliance evidence is prepared as documentation and configuration records for your assessors. DeployOpen does not issue audit reports or certifications.
  • Staffing needs for ongoing operations are documented so you can compare in-house running costs with a retainer before the build closes.

How we support

  • Ongoing support, upgrades and continuous testing are available as retainers, scoped separately from the implementation quote.
  • Upgrade planning follows each vendor's release and major-version rules, with rehearsals in a non-production environment before production changes.
  • Ask any partner, including DeployOpen, to confirm in writing which component versions, release cadence and support tiers the retainer covers.

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.