Sovereign, Cheap, Easy — Pick Two: The 2026 Hosting Economics Report

Every few months a new number goes around. Cloud is forty percent cheaper. On-premises is fifty percent cheaper. Both claims get published, both cite real data, and both are useless on their own — because they are answering different questions, for different companies, with different things left out of the spreadsheet.

So we priced it properly. One company, fifty people, one honest specification, and every option costed against it at public list prices: two hyperscalers, a European discount provider, building it yourself in a Prague data centre, and our own managed platform. Every figure below is traceable to a source, and the two figures that are estimates rather than list prices are marked as such.

The answer is not the one either side of the argument usually gives.

What a fifty-person company actually needs

Most cost comparisons start with a server size. That is the wrong end. Start with the people, work out what they do all day, and the server size falls out of it.

A fifty-person business — a manufacturer, a distributor, a professional services firm — typically runs four things that must not stop: the business system that holds orders and invoices, the file store everyone works from, the identity and network services that let people log in at all, and a web or application front end. Mail is almost always a subscription now and sits outside this comparison, as does anything running on a laptop.

Building it yourself, priced properly

The self-hosting case usually opens with a server quote and closes there. That is where it goes wrong, and the first mistake is not financial — it is a counting error.

Two servers is not redundancy. A two-node cluster cannot tell the difference between "the other node has failed" and "I cannot reach the other node", so it either refuses to act or both halves try to take over the same storage. The minimum honest number for a cluster that survives losing a node — and survives you patching a node on a Tuesday afternoon — is three.

With three nodes, redundant switching, a UPS and a rack in a Prague data centre, the capital cost lands near €37,000 and the recurring costs are modest. Spread over a five-year life, the infrastructure looks like this.

Sources10 Colocation price list11 Proxmox pricing12 Backup licensing3 ČNB rates

The engineer nobody budgets for

Servers do not administer themselves, and this is the line that decides the whole comparison. The Czech Statistical Office publishes what these people actually earn. For 2025, released in July 2026, the average gross monthly pay for database and network specialists in the Czech Republic was 86,572 CZK; across all ICT specialists in the private sector it was 101,729 CZK.

Gross pay is not the cost. On top of it an employer pays 24.8% social insurance and 9% health insurance — 33.8% before anyone has bought a laptop, a training course or a certification exam.

That is €57,400 a year for one person, and one person is not a service. A full-time employee covers forty hours of a week that contains one hundred and sixty-eight. The remaining one hundred and twenty-eight hours — every night, every weekend, the whole of August — are covered by hope, or by that person's mobile phone.

Sources1 Czech Statistical Office2 Social insurance rates3 ČNB rates

GDPR, the CLOUD Act, and a sentence said under oath

Ask most people where their company's data is and they will name a city. Frankfurt, Dublin, Amsterdam. That answer describes geography, and geography is not the question the law asks. The question is whose courts can compel the company holding the data to hand it over.

The United States CLOUD Act, in force since 2018, answers that plainly. The Department of Justice's own white paper on the Act states that a provider subject to US jurisdiction must produce data in its custody or control regardless of whether that data is stored inside or outside the United States. A German data centre operated by an American corporation is inside the reach of an American order.

This is not a theoretical reading. On 10 June 2025, in a hearing of the French Senate, Microsoft France's legal director was asked under oath whether he could guarantee that French citizens' data held in Microsoft's cloud would never be passed to US authorities without French approval.

Sources13 DOJ CLOUD Act paper14 French Senate hearing

EU, US, Asia: where your data really lives

Every large provider now offers a European region, and several offer a "sovereign" one. These are real engineering efforts and they genuinely reduce risk. They do not all answer the same question, and the differences matter more than the names suggest.

Three things are worth separating. Can you pin the data to an EU location? Is the entity that controls it governed solely by EU law? And can engineering or support staff outside the EU reach the systems in the course of ordinary operations?

The first column is the easy one — every provider in that list can now keep your data at rest inside the EU, and most European businesses stop reading there. The second column asks whether the entity controlling the data answers to EU law alone; sovereign offerings genuinely improve this through separate operating companies and local staffing, but they do not sever the ownership chain, which is why those marks are partial rather than full. The third column is simply whether a company outside the EU exists that can be ordered to act. That is the question the CLOUD Act turns on, and no amount of regional engineering changes the answer.

Asia adds a further layer. In mainland China the law requires cloud services to be operated by a licensed local entity, which is why Microsoft's Chinese cloud is a physically separate system run by 21Vianet rather than a region of global Azure, and why Google has no mainland region at all. If your data touches an Asian operation, "the same provider" frequently means a different company under a different legal system.

Sources15 Azure China regions16 AWS European Sovereign Cloud17 Gartner sovereign cloud

The transfer framework has been struck down twice. It is being challenged again.

If your provider transfers personal data to the United States, the legal basis is usually the EU-US Data Privacy Framework — the European Commission's 2023 decision that the US offers adequate protection. It is valid law today. The General Court upheld it in September 2025.

It is also the third such arrangement in twenty-five years, and the first two were annulled by the Court of Justice.

A new question arrived on 29 June 2026. In Trump v. Slaughter the US Supreme Court ruled on the removal protections that underpin the independence of the Federal Trade Commission — the body the adequacy decision leans on for enforcement on the American side. Within days the privacy group noyb called for the decision to be withdrawn in an orderly way, and a separate appeal by a French legislator is already pending before the Court of Justice.

Sources18 Adequacy decision 2023/179519 DPF after the ruling

NIS2 and DORA turned "what if they fail" into paperwork

Until recently, asking what happens if your cloud provider disappears was a thought experiment. For a growing share of European companies it is now a documented obligation with a named owner.

NIS2 extends cyber security duties across a wide range of sectors and makes supply chain security an explicit requirement — you are answerable for the security of your direct suppliers, not only your own systems. DORA goes considerably further for financial entities: a register of every ICT third-party arrangement, an assessment of concentration risk, mandatory contract terms covering data location and audit rights, and a tested exit strategy for every critical service.

There is a piece of good news attached. Under the EU Data Act, the fees providers charge for switching away are being phased out entirely: from 12 January 2027 switching charges, including the egress fees historically used to make leaving expensive, are prohibited for cloud services in the EU. The lock-in that made these obligations painful is being legislated away.

Sources20 NIS2 Directive21 DORA Regulation22 EU Data Act

When the hyperscaler is genuinely the right answer

An article that concluded "always choose the smaller provider" would not be worth reading, because it is not true. There are workloads where a hyperscaler is not merely defensible but obviously correct, and the pattern is consistent: the cloud wins whenever the shape of the demand is more expensive to own than to rent.

How we priced it

Comparison tables are easy to rig, so here are the rules we used. Every option delivers the same specification from section 01, every price is the published list price on the date shown, and where a figure is our own estimate it is labelled.

The table

Here is the same workload, five ways.

Three things in that table are worth saying out loud, because none of them is the headline anyone expects.

Hetzner has the cheapest infrastructure by a distance, and it is not close. At €425 a month it undercuts everything else here, including us. If you have an engineering team already, and jurisdiction beyond "somewhere in the EU" is not a requirement, that is an excellent answer and we would say so to your face.

Self-hosting is the most expensive option, and the hardware is not why. The equipment is €1,429 a month; the person is €4,785. Seventy-seven percent of the cost of running your own servers is a salary. This is the number that turns the usual argument on its head — the capital cost people worry about is the part that barely matters.

The hyperscaler's discount does not close the gap, because it does not touch the largest line. Committing for three years cuts AWS compute by roughly half and moves the total by ten percent, because the operating cost is unchanged and the operating cost is most of the bill.

Sources4 AWS on-demand pricing5 eu-central-1 rates6 AWS EBS pricing7 AWS egress8 Hetzner repricing9 Hetzner rates23 DEXA-IT pricing