What remote desktop costs when you build, partner or buy SaaS
For most remote desktop programs, the software license is the smallest line in the budget. The larger costs come from how many users and devices you manage, how deeply the platform is integrated with your identity provider, how long session recordings are kept, and who operates the gateway and relay servers once they are live. Apache Guacamole is licensed under Apache-2.0, so there is no license fee to pay for the gateway itself. The open-source RustDesk server is licensed under AGPL-3.0 and can also be run without a license fee, but RustDesk Server Pro is a separate, paid option billed annually, and the RustDesk pricing page states it is not a SaaS subscription. Confirm the current edition, seat limits and renewal terms directly on the pricing page before you put them in a business case.
Costs fall into one-time and recurring groups. One-time work includes requirements, architecture, placement of the gateway in a DMZ or equivalent network zone, identity and MFA integration, hardening, and handover. Recurring costs include the compute and storage for gateway, relay and recording infrastructure, patching and version upgrades, monitoring, backups, access reviews, and the staff time to run them. Recording storage deserves its own line, because retention periods set by your regulator or contracts multiply the volume you keep. When you request a quote from an implementation partner, ask for each component separately: infrastructure sizing assumptions, identity integration, recording and retention, hardening evidence, and whether support and upgrades are a fixed-scope project or a retainer.
The fair comparison is between total cost over the period you plan to use the system and a per-seat SaaS remote access tool priced for the same users, devices, audit logging and session recording. Per-seat pricing can be simpler to start with, but it may not include the controls your auditors ask for, and it adds a third party to the access path for vendor and privileged sessions. A self-built program carries the labor cost of running the platform in-house. A partner shifts part of that work into a written scope, but you still own the risk and the evidence. Before deciding, check each option against the data your SaaS vendor would store, the logs you can export, and how you would exit the contract.
Which cost components sit in-house, with a partner, or in SaaS
This table maps each cost component of a self-hosted remote desktop service to the party that usually pays for it and whether the cost is one-time or recurring. Read it as a checklist for a quote: confirm where each line sits before comparing totals, because the same component can be a licence in one model and a labour line in another.
| Cost component | Who pays and how | One-time or recurring, and what drives it |
|---|---|---|
| Gateway and relay infrastructure | Your organization pays the cloud or data center bill for Guacamole, guacd and RustDesk hbbs and hbbr hosts, including DMZ or relay placement | Recurring. Driven by concurrent sessions, relay bandwidth and whether you run redundant nodes |
| RustDesk Server Pro licences | Your organization pays RustDesk for Pro plans; RustDesk lists Individual at $11.88 per month and Basic at $23.88 per month, billed annually (RustDesk pricing page) | Recurring annual billing. Driven by login users and managed devices; licences do not auto-renew and monthly billing is not offered |
| Open-source server and Guacamole licences | No licence fee: Apache Guacamole is Apache-2.0 and the open-source RustDesk server is AGPL-3.0 | One-time build effort. Cost moves to labour for setup, patching and support |
| Identity and MFA extensions | Open-source authentik has no licence fee; authentik Enterprise lists $5 per user per month billed annually plus $0.02 per external user per month (authentik pricing page) | Recurring for Enterprise features such as Entra ID, mTLS and privileged access management. Driven by user count and external users |
| Implementation and hardening | A partner or in-house team is paid for architecture, configuration, integration, hardening and testing against your policies | One-time, with some re-work at each upgrade. Driven by protocol count, number of identity sources and required evidence |
| Session recording storage | Your organization pays for storage, backup and retention of recordings and logs; the Guacamole manual documents a session recording player extension | Recurring and growing. Driven by session volume, recording length and retention period set by your rules |
| Ongoing operations and upgrades | In-house staff or a retainer partner pays for monitoring, patching, certificate renewal and version tracking | Recurring. Driven by security release frequency and the number of gateways and relays under management |
| Per-seat SaaS remote access fees | The subscription provider is paid per seat or per device, and your organization often pays integration and policy work separately | Recurring per seat. Driven by headcount, vendor-user count and feature tiers; confirm the price in each vendor quote |
How the open-source and licensed components are priced
Apache Guacamole and guacd carry no license fee. Guacamole is released under the Apache License, Version 2.0, and the apache/guacamole-server repository, which holds guacd and the protocol plugins, is licensed Apache-2.0. Your costs for the gateway are therefore the servers, the database, the identity layer and the people who build and run them, not a per-user or per-connection charge from the software. The RustDesk open-source server is different in kind: hbbs and hbbr are licensed AGPL-3.0, which costs nothing to download but carries source-availability obligations that your legal team should review before you modify the code. Confirm current license terms directly in the repositories before you commit.
RustDesk Server Pro is a paid, annually billed product, not a SaaS subscription. The pricing page lists Individual and Basic plans billed annually, and Individual adds 2FA, a web console, an audit log and access control, while Basic adds OIDC single sign-on and LDAP integration. Customized plans add users and devices on top of the Basic base price, so the per-user and per-device add-ons scale the bill as your technician population or managed fleet grows. RustDesk licenses do not auto-renew and there is no monthly billing, which means someone must own the renewal date. Confirm the current figures on the RustDesk pricing page before you build a budget model.
authentik splits its features between Open Source and Enterprise. The Open Source edition is free and supported through the community Discord, while Enterprise is priced per user with a smaller charge per external user, and Enterprise Plus is priced annually with dedicated support. Features that matter for remote access, including Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history and enhanced audit logging, sit behind the paid tiers. Check the authentik pricing page for current figures and confirm which provider types your gateway flow needs, since OIDC and LDAP availability should be verified against the edition you select.
What moves the remote desktop cost up or down
Most of the cost of self-hosted remote desktop follows from a handful of design choices: how many people and machines connect, how they connect, and how much evidence you must keep. Each card below names one driver, the direction it pushes the cost, and what to confirm in a quote before work starts.
User and device count
Licensing and capacity both scale with the number of people who log in and the number of machines they reach. For RustDesk Server Pro, the published plans are sized by login users and managed devices, and the Customized plan adds cost per user and per device on top of the Basic base price. For Guacamole, the main recurring effect is host capacity and the number of connection definitions to maintain. Ask the partner how the quote scales if headcount or device inventory grows.
Browser versus agent access
Browser access through Guacamole needs a gateway server and a target-side protocol such as RDP, VNC or SSH, but no software installed on each user endpoint. Agent-based access through RustDesk needs a client on every managed device and a rollout process for installs and updates. The agent rollout effort is usually the larger one for a large device fleet, so ask who packages, signs and updates the clients and at what cadence.
Identity and MFA integration
Connecting the remote access layer to your identity provider adds design and test work, and some of the features that matter for SSO sit behind paid editions. authentik's Open Source edition is free, while its Enterprise edition is priced per user and Enterprise Plus starts at an annual figure. Confirm which SSO protocols, MFA methods and provisioning features your target design needs, then check whether they fall in a community or paid tier before comparing totals.
Recording retention volume
Session recording is often the cost line that grows silently. Storage consumed depends on how many sessions you record, how long each lasts, and how long you must keep them, so a retention rule set by a regulator or by your own policy sets the size of the store. For example, a broker-dealer must preserve certain communications for at least three years, and access logs in healthcare follow similar retention thinking. Ask the partner to model storage from your session volume and retention period, and to state where recordings are encrypted and backed up.
High availability and relay placement
Each remote access path that must stay up needs redundant components, and every extra site adds infrastructure. RustDesk's open-source server runs two services, hbbs for ID and rendezvous and hbbr for relay, and Server Pro adds distributed relay servers. Relays placed close to users or in a DMZ raise infrastructure and operations cost, while a single relay keeps the bill low but creates an outage risk. Ask for the proposed node count, placement, failover design and the monitoring that covers each component.
Compliance evidence scope
The more controls you must evidence, the more time goes into logging, access reviews, configuration baselines and retained proof for an assessor. Requirements for remote access under HIPAA, PCI DSS, CMMC or NERC CIP each add distinct evidence, and a SaaS tool may or may not supply the same artifacts. DeployOpen prepares systems and evidence for assessments but does not issue audit reports, so ask your assessor which evidence they will sample and budget the collection work into the scope.
When in-house build, a partner or SaaS fits best
Building in-house means your own engineers select, install, configure, harden and operate the gateway, relay and identity components. With Apache Guacamole, the work centers on the web application, the guacd daemon, the authentication extensions and the database backend. With RustDesk, it centers on the hbbs and hbbr services and, if you buy Server Pro, the license and console. Licensing costs for the open-source components are typically zero, so the spend shifts to people, hardware and time.
- Skills: Staff need working knowledge of Linux, reverse proxies, TLS, identity protocols such as SAML or OpenID Connect, and the remote desktop protocols you publish (RDP, VNC or SSH).
- On-call: Someone must own outages, certificate expiry and failed logins at any hour that remote access is needed, including for vendors in other time zones.
- Upgrade ownership: Your team tracks security releases for every component, tests them and schedules maintenance windows, including for the identity provider behind the gateway.
- Evidence: Your team writes the configuration baselines, change records, access reviews and session recording retention rules that an auditor will sample.
- Hidden recurring cost: Staff time is the largest recurring line, and it is easy to underestimate when the first deployment works.
Before choosing this model, confirm how many named people can cover the service, who approves emergency access and whether your change process can absorb monthly security patches.
An implementation partner plans, deploys, hardens, integrates and documents the service inside your own cloud account, data center or air-gapped network, and then hands it over. Your organization keeps custody of the infrastructure and data. The partner's work is defined in a written scope with deliverables and timelines agreed before work starts, so the cost is bounded by that scope rather than by a seat count. DeployOpen works this way and does not publish a price list; a quote follows from the written scope.
- Fixed-scope delivery: Define the protocols, user groups, hosts, MFA method, recording rules and integrations up front, so changes are priced as change requests.
- Handover: Require runbooks, configuration records, restore tests, monitoring setup and training for your staff before acceptance.
- Retainers: Ongoing upgrades, patching, testing and support can be bought separately, which covers the on-call gap without a permanent internal hire.
- Your retained skills: You still need a named owner who approves access, reviews logs and decides policy.
- Dependency risk: Ask how configuration is documented and whether your staff can operate the system without the partner.
Ask for the scope, the acceptance criteria, the handover list and the retainer terms in writing, and confirm which costs recur after go-live.
A per-seat SaaS remote access tool gives you a hosted service billed per user or device, usually on a subscription. Setup is fast because the vendor runs the relay, the console and the upgrades. The trade-off is that session metadata, logs and sometimes recordings sit in the vendor's environment, and your access continues only while the subscription does. Check the vendor's data location, subprocessors, audit reports and contract terms before relying on it for regulated access.
- Fast start: Procurement and onboarding can be quick, and the vendor handles uptime and feature updates.
- Vendor-held data: Logs, recordings and connection history may be stored outside your control, which affects retention, legal hold and incident response.
- Subscription exposure: Cost rises with headcount and devices, and a price change or a lapsed contract can cut off access you depend on.
- Network placement: A hosted relay may not reach systems in isolated segments, OT zones or air-gapped networks.
- Vendor access: Confirm whether the vendor's own staff or support tooling can reach your sessions.
Before signing, ask for the data processing terms, the recording and log retention options, the list of subprocessors and whether the product can run in your own network.
How to build your own remote desktop cost estimate
This sequence turns a vague budget question into a costed scope that several partners and vendors can price against the same requirements. Each step produces a figure or a written decision that feeds the next one, so the final comparison reflects your environment rather than a generic estimate.
Count users, devices and concurrent sessions
Start by listing every group that will connect: employees, contractors, device vendors and help desk staff. For each group, record the number of named login users, the number of managed endpoints they will reach, and the peak number of sessions open at the same time. Concurrency drives gateway and relay sizing, while named users and devices drive licensing, so keep these three numbers separate. The step is done when your IT team and the business owner agree on one table with these counts and the peak month or shift they occur in.
List protocols and access models
Record which protocols must work, such as RDP, SSH and VNC, and whether each target is reached through a browser gateway, a installed agent, or both. Note which targets are servers, workstations, clinical or lab machines, and industrial or vendor-owned equipment, because each category may need a different network placement and a different number of gateway instances. Confirm with the platform owner which protocols and access modes the chosen software supports in your version. The step closes when you have a target inventory that maps each system to a protocol and an access model.
Choose identity and MFA tiers
Decide where user accounts live and which sign-in methods are required, such as Active Directory or LDAP, SAML or OpenID Connect single sign-on, and multi-factor authentication for all users or only for privileged and vendor accounts. Identity features are not equal across editions of the same tools, so ask each candidate which login integrations and MFA methods are included in the tier you would buy. If you plan to place an identity provider such as authentik in front of the gateway, add its edition cost and its own run costs to the estimate. The step is complete when each user group has a documented sign-in path and a tier named for it.
Size recording storage from retention rules
Work with your compliance and legal owners to set how long session recordings and audit logs must be kept, and who may read them. Retention rules come from your obligations, not from the tool. For example, SEC Rule 17a-4(b)(4) requires broker-dealers to preserve communications relating to the business for not less than three years, and the HIPAA Security Rule at 45 CFR 164.312(b) requires audit controls that record and examine activity in systems containing ePHI. Where neither rule applies, record the retention period your policy sets. Multiply expected session hours by the recording size you measure in a pilot, then add headroom for growth and backups. The step is done when you have a storage figure per year and a written retention schedule.
Add implementation, hardening, testing and handover
List the one-time work needed to put the platform into production: architecture and network placement, installation, identity and MFA integration, TLS and certificate setup, host and container hardening, logging and monitoring, penetration or configuration testing, documentation, and operator training. Each item should name who performs it, whether that is your staff or an implementation partner, and what deliverable closes it. Ask partners to price these items in a fixed-scope statement of work so you can compare them line by line. The step is done when every item has an owner, a deliverable and a written acceptance check.
Add run costs and upgrade cadence
Estimate the recurring cost of keeping the service running: infrastructure for gateways and relays, backups, monitoring, log storage, vendor license renewals, identity tier fees, security patching and version upgrades, and support hours. Record how often each component receives security releases and who applies them, because a platform that falls behind on updates creates its own risk. Separate licenses that renew annually from one-time setup charges, and note any license terms that do not auto-renew. The step produces an annual run budget and a patch calendar that the operations team has accepted.
Request written quotes against the same scope
Send one written scope document, built from the previous steps, to each self-hosted implementation partner and to the SaaS remote access vendors you are evaluating. Ask every bidder to state assumptions, exclusions, recurring fees, and what changes the price, such as user growth, added protocols or extra recording storage. Compare the quotes on total cost over the planning horizon you choose, not on the first invoice alone, and check that the SaaS quotes include the same MFA, audit and retention features. The step is complete when you hold comparable written quotes and can explain every difference between them.
Which costs are one-time and which recur every year
The most useful split for a remote desktop budget is one-time work versus costs that repeat every year. One-time costs cover the design of the gateway and relay placement, the build of the Apache Guacamole or RustDesk stack, identity and MFA integration, hardening, migration of existing connections and vendor accounts, and the initial training of help desk and support staff. These are paid once to a partner or your own engineers, though they can be reopened when scope changes. Recurring costs include cloud or data center capacity for the gateway and relay hosts, storage growth for session recordings (which rarely shrinks once retention rules are set), operating system and application patching, monitoring, backups, staff time for access reviews, and any support retainer. For RustDesk Server Pro, the license is itself recurring: RustDesk's pricing page bills annually and states that licenses do not auto-renew, so the renewal date belongs in the budget calendar.
Per-seat SaaS remote access fees recur because the vendor sells the platform as a service and bills for each user or device every period, so cost grows with headcount, vendors and contractors. Self-hosted costs follow a different pattern. Software licensing may be zero for the core open-source components, but the cost moves into operations: someone must run the hosts, rotate certificates, apply security updates and keep session logs for the retention period your regulator or contract requires. That work is recurring even though no subscription appears on an invoice. Ask every bidder for two views: a five-year total cost table separating one-time line items from annual run costs, and a staffing table showing which roles (platform engineer, security analyst, service desk) carry each recurring task and how many hours per month they are expected to need. Ask the SaaS vendor for the same breakdown, including overage charges for recordings and extra devices.
Before accepting any quote, confirm the assumptions behind each recurring line: the expected number of concurrent sessions, the number of managed devices, the recording retention period, the storage growth per year, the patch cadence, and the support hours included. Ask the partner which of these figures came from your environment and which are placeholders. A quote that cannot show the recurring workload in writing will look cheap in year one and become hard to compare in year three.
Questions buyers ask before hiring help with remote desktop cost
How much effort does self-hosted remote desktop actually take?
The effort depends less on the gateway software than on the controls you wrap around it. Apache Guacamole is an Apache-2.0 licensed gateway that runs in a browser, and its web application, guacd daemon and database backend each need installing, connecting and hardening. RustDesk's open-source server adds two services, hbbs for ID and rendezvous and hbbr for relay, which need their own placement and firewall rules. The larger share of work is usually identity integration, MFA, session recording, network placement and monitoring. Ask any partner to split its estimate along those lines so you can see what each part of the work includes.
Can an internal team run self-hosted remote desktop without a partner?
A team with Linux, container and identity skills can build a working lab, and Guacamole's documentation covers native and Docker installation. Production use is a different matter. Your team must own patching, certificate renewal, backup and restore, monitoring, and the handling of session recordings. It also needs someone who can answer for the design during an assessment. Decide which of these your staff can carry on an ongoing basis. A partner is most useful for the parts you cannot staff, such as hardening reviews, evidence preparation or a handover that your own engineers can operate.
How long does a remote desktop rollout typically take?
No duration is established for this work in the sources available to us, so treat any single number with caution. The timeline is driven by the number of protocols (RDP, SSH, VNC), the identity provider you connect to, whether you need an agent-based path for attended support, and how long your change process takes for placing a gateway in a DMZ. Ask a partner for a phased plan with written milestones, and confirm what counts as done for each phase, including testing with real users and handover to your operations team.
What does the work need from our internal staff?
Plan for named time from several groups rather than a single owner. Identity engineers connect the gateway to directory and single sign-on services, and authentik's provider types, including RAC, are one option to confirm for your environment. Network and firewall staff handle placement and routing. Security staff define MFA, recording and access approval rules. Infrastructure staff own the hosts, backups and monitoring. Ask a partner to list the decisions it needs from each group and the date by which it needs them, because delayed approvals are a common cause of schedule slips.
How should we size storage for session recordings?
Recording storage scales with three inputs: how many sessions you record, how long each lasts, and how long you keep the files. Guacamole's manual includes a session recording player extension, so recordings can be captured at the gateway, but the size of the output depends on your settings and workload. Retention is the decision that drives most of the cost. Retention periods depend on your regulator, so confirm the requirement before sizing. The financial rule in 17 CFR 240.17a-4 sets a three-year minimum for certain broker-dealer communications, and HIPAA's audit control requirement in 45 CFR 164.312 covers activity records for ePHI systems. Ask your partner to model storage from your own session counts and retention.
How do self-hosted totals compare with per-seat SaaS remote access?
Compare total cost of ownership over the same period and the same user and device counts, not list price per seat. For self-hosted tools, cost falls into one-time items (design, implementation, hardening, testing and handover) and recurring items (infrastructure, storage, licenses, patching, on-call support and staff time). RustDesk publishes self-hosted Server Pro prices: Individual at $11.88 per month for 1 login user and 20 managed devices, and Basic at $23.88 per month for 10 login users and 100 managed devices, billed annually and not a SaaS subscription. Build your own model with your device counts, the license tier you need and the SaaS quote for the same scope, then ask for the written scope behind any implementation quote.
Which quote items should we ask a partner to itemize?
Ask for a written quote that separates one-time work from recurring costs. Request line items for architecture and placement, identity integration, hardening and security testing, recording storage design, backup and restore testing, monitoring setup, documentation and handover, and ongoing support or upgrades if you want them. DeployOpen works on fixed scope agreed in writing before work starts, and ongoing support is offered as a retainer. DeployOpen does not publish a price list, so a quote follows from the written scope. Ask each partner to state exclusions, the assumptions behind any licence tier, and what happens when your user or device count grows.
How DeployOpen scopes and delivers a fixed-scope remote desktop implementation
DeployOpen plans, implements, hardens, documents and supports self-hosted remote access inside your own cloud accounts, data centers or air-gapped networks. For remote desktop cost, we start from a written scope that separates one-time build work from recurring operations, so the cost comparison with per-seat SaaS tools rests on your actual numbers.
How we scope
- We confirm which gateway (Apache Guacamole, RustDesk or both) fits the protocols, user counts and device counts you need to support.
- We list the infrastructure you will pay for, including gateway hosts, relay servers, database, and recording storage.
- We document which licenses are required, such as RustDesk Server Pro plans, and which open-source components carry no license fee.
How we build
- We deploy the gateway and identity layer in your environment and wire in your existing SSO and multi-factor methods.
- We harden the hosts, configure connection permissions and recording, and test session behavior against the written acceptance criteria.
- We size the recording retention and log storage so the ongoing storage cost is visible before go-live.
How we hand over
- You receive architecture diagrams, configuration records, runbooks and a cost model that separates one-time and recurring items.
- We walk your operations team through patching, license renewal, backup and restore, and access review tasks.
- Handover is complete when the agreed deliverables are accepted in writing, so you know exactly what you own.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, priced from the scope you agree.
- We can plan version upgrades against the release notes of the platforms in your stack, with changes tested before rollout.
- Ask any partner, including us, to show the recurring operations effort in writing before you compare totals with a SaaS quote.
