Managed Self-Hosted Bitrix24: We Deploy, Host and Maintain It for You

The Problem with DIY Self-Hosted

Self-hosted Bitrix24 delivers genuine data control, but the operational overhead - OS hardening, PHP patching, update testing, backup verification, and 24/7 uptime monitoring - demands a dedicated Linux administrator and a mature DevOps process that most business teams simply do not have.

Many organisations choose Bitrix24 (Alaio) on-premise precisely because they want their CRM, tasks, and collaboration data to stay inside their own environment - not in a vendor's multi-tenant cloud. That motivation is entirely sound. The friction appears the moment someone has to actually run the server.

A few realities the DIY path involves:

• OS and runtime patching - CentOS Stream 9 (the current supported base), PHP, MySQL/MariaDB, and nginx all release security patches on their own schedules.
• Core updates - Bitrix24 on-premise releases major updates periodically. Applying them without a staging environment risks breaking custom modules and integrations.
• SSL certificate lifecycle - Let's Encrypt certificates expire every 90 days; renewal automation can and does fail silently.
• Backup verification - writing a backup is not the same as being able to restore from it. A backup strategy without tested restores is a false safety net.
• Performance degradation - without ongoing tuning, portals slow down as data and user counts grow.

If your team lacks a dedicated administrator, these tasks accumulate until they become incidents. Managed self-hosted is the answer.

What 'Managed Self-Hosted' Actually Means

Managed self-hosted is a remote-operations model: Bitrix24 runs on your server or private cloud, your data never leaves your jurisdiction, but ACP Group's engineers handle the full operational lifecycle - deployment, patching, updates, security monitoring, backups, and incident response.

It sits between two imperfect alternatives:

The result is the best of both worlds: you retain the compliance, customisation, and data-residency benefits of on-premise while delegating the operational burden to specialists who have deployed Bitrix24 on-premise across more than 1,300 projects.

This is especially relevant if your organisation is subject to data-residency requirements - such as the UAE Personal Data Protection Law, GDPR, Brazil's LGPD, or similar local frameworks - where storing CRM data in a third-party cloud is either restricted or creates audit risk. See also why growing companies move Bitrix24 to self-hosted for a deeper look at the drivers.

What ACP Group Covers - and What Stays With You

ACP Group takes full responsibility for every operational layer below your Bitrix24 application, while you retain ownership of your data, your domain, your licence key, and all business configuration inside the portal.

The table below shows exactly where the line falls.

Practical note: if you do not yet have a server, ACP Group recommends and helps procure a suitable private cloud or dedicated server - you hold the account; ACP holds the SSH access needed to operate it.

Deployment Architecture: Your Server, Our Operations

ACP Group deploys Bitrix24 on-premise using a hardened CentOS Stream 9 base or a pre-configured virtual machine image, then configures all required services - web server, database, Push & Pull, document converter, and SSL - before handing you a production-ready portal.

The managed service layer sits between your infrastructure and your users.

Client infrastructure (dedicated server or private cloud) runs the Bitrix24 application stack, managed remotely by ACP Group's operations team, while end users access the portal over HTTPS and ACP monitors everything via secure SSH and monitoring agents.

flowchart LR
    subgraph CLIENT_INFRA["Client Infrastructure (your server / private cloud)"]
        OS["CentOS Stream 9\n+ nginx / PHP / MySQL"]
        B24["Bitrix24 On-Premise\nApplication"]
        BACKUP["Backup Storage"]
        OS --> B24
        B24 --> BACKUP
    end

    subgraph ACP_OPS["ACP Group - Remote Operations"]
        PATCH["OS & PHP\nPatching"]
        STAGING["Staging\nUpdate Tests"]
        MON["Uptime &\nSecurity Monitoring"]
        DR["Backup &\nDisaster Recovery"]
    end

    USERS["Your Team\n(browser / mobile)"] -->|HTTPS| B24
    ACP_OPS -->|SSH + monitoring agents| CLIENT_INFRA
    STAGING -->|Tested update| B24
    DR -->|Verified restore| BACKUP

Supported deployment targets (as of 2026):

• Dedicated physical server (client-owned or leased)
• VMware / VirtualBox virtual machine
• Private cloud (any provider the client controls)
• Public cloud instances scoped to a specific region - see deploying self-hosted Bitrix24 on AWS, Azure, or a private cloud for architecture detail

Ports 80, 443, and 22 (SSH) are required to be reachable by ACP's operations infrastructure. The portal domain is pointed to a dedicated external IP, and SSL is provisioned and auto-renewed.

For sizing guidance - CPU cores, RAM, and SSD capacity by user count - refer to our hardware sizing guide, which covers configurations from 50 to 1,000 users.

Security Hardening, Patching and Tested Updates

ACP Group applies a multi-layer security approach: hardened OS configuration, Bitrix24's native access-control policies, session-binding rules, and continuous monitoring - combined with a staged update process that tests every Bitrix24 release on a non-production environment before it reaches your live portal.

OS and runtime security

• Regular security patches applied to the operating system, web server, PHP interpreter, and database engine
• Unused services and ports disabled at the OS level
• SSH access restricted; root login disabled in favour of key-based authentication
• Firewall rules configured to allow only necessary inbound traffic

Bitrix24 application security

The Bitrix24 on-premise platform ships with a structured security architecture covering:

• Access control policies - granular user and group permissions across all modules
• Session binding - sessions can be tied to IP address or subnet mask, neutralising XSS-based session hijacking
• Concurrent session limits - administrators are limited to a single remembered authorisation by default
• Password-recovery token expiry - time-bounded reset tokens reduce interception risk
• Elevated policy for admin accounts - the strictest rule in any group membership applies automatically

Update management

Bitrix24 on-premise requires a valid, active licence to receive core updates and marketplace modules (as of 2026, an expired licence blocks update access, marketplace installs, and certain API methods). ACP Group tracks licence validity and applies updates through a tested staging-first workflow, ensuring your production portal never receives an untested release.

For a full breakdown of the hardening steps ACP applies, see the self-hosted Bitrix24 security hardening checklist.

Backups and Disaster Recovery

ACP Group configures automated, scheduled backups of your Bitrix24 database and file storage, stores copies in at least one location separate from the primary server, and performs regular restoration tests - so that your recovery time objective is a known, verified number rather than an assumption.

A backup strategy that has never been tested is not a recovery strategy. Our managed service includes:

• Automated backup scheduling - frequency and retention period scoped to your requirements
• Off-site copy - backup data stored separately from the primary server to survive host-level failures
• Restoration drills - periodic test restores to confirm backup integrity and measure actual recovery time
• Incident response - in the event of corruption, ransomware, or hardware failure, ACP engineers lead the recovery process

Bitrix24 on-premise supports storing backups directly on the server or on a separate company-controlled storage target - ACP configures whichever topology fits your infrastructure. For the full strategy framework, see on-premise Bitrix24 backup and disaster recovery.

Is Managed Self-Hosted Right for You? A Checklist

Run through this checklist honestly. The more boxes you tick, the stronger the case for managed self-hosted.

You are a good fit if:

• ☑ Your organisation handles sensitive data (personal data, contracts, financials) and wants it stored on infrastructure you own or control
• ☑ Local regulation - GDPR, UAE PDPL, LGPD, or sector-specific rules - requires or strongly favours in-country data residency
• ☑ You want the open codebase, full API access, and deep customisation of Bitrix24 on-premise, but not the sysadmin overhead
• ☑ You do not have a dedicated Linux/DevOps administrator on your payroll, or your IT team is stretched across other priorities
• ☑ You have previously been on Bitrix24 Cloud and are considering a move to self-hosted for compliance or cost reasons
• ☑ You need custom integrations with internal ERP, accounting, or AD/LDAP systems that are only available in the on-premise API
• ☑ You want predictable infrastructure costs without per-seat cloud pricing at scale
• ☑ A previous DIY self-hosted deployment has fallen behind on updates or is running on an end-of-life OS

Managed self-hosted may not be the best fit if:

• ☐ You have fewer than ~15 users and no compliance requirement - Bitrix24 Cloud is likely more cost-effective
• ☐ You already have a competent in-house DevOps team - DIY self-hosted with occasional partner support may suffice
• ☐ Your organisation is not permitted to grant any external party SSH access to servers - a fully air-gapped deployment requires a different engagement model (contact ACP to discuss)

Why ACP Group as Your Managed Bitrix24 Partner

ACP Group is a Bitrix24 Gold partner with a delivery record of more than 1,300 projects across the UAE, Brazil, Portugal, and the MENA region - giving our operations team real-world experience with the edge cases, upgrade failures, and recovery scenarios that only appear at scale.

What sets the managed service apart

• Gold partner technical access - direct escalation paths with the Bitrix24 vendor for licence, update, and platform issues
• Staging-first update policy - no core release goes to your production environment without being tested first
• Scope transparency - the responsibilities table in this page is not aspirational; it is how engagements are structured and contractually reflected
• International delivery - teams operating in different time zones and regulatory environments; no Russia-specific tooling or dependency
• Flexible infrastructure - we work on your existing server, help you procure a new one, or deploy on the private cloud of your choice

How engagements start

Every managed self-hosted engagement begins with a scoping call to establish:

1. Current infrastructure (or procurement plan if starting fresh)
2. User count, expected data volume, and growth trajectory
3. Compliance requirements and data-residency constraints
4. Integration dependencies (ERP, AD/LDAP, telephony, etc.)
5. Preferred backup topology and recovery time objectives

From there, ACP Group provides a written proposal covering deployment scope, ongoing managed-service scope, and pricing. Exact figures depend on server specifications, user count, region, and required SLA - ACP quotes these per engagement.

For context on overall implementation investment, see Bitrix24 implementation cost and timeline data from 1,300+ projects.

If you are evaluating whether on-premise or cloud is the right direction from a total-cost perspective, the self-hosted vs cloud Bitrix24 three-year TCO analysis provides a structured framework.

Ready to stop worrying about your Bitrix24 server? Request a managed self-hosted proposal from ACP Group - use the contact form on this page.

Prefer someone else to run it? See our managed Bitrix24 optimization service - monitoring, updates and continuous improvement under SLA.