Self-Hosted CRM: Why Choose Bitrix24 On-Premise for Data Sovereignty

Cloud vs. On-Premise: Differences That Matter for Regulated Industries

The core difference between cloud and on-premise is not technological - it is about governance: with self-hosted, the organization physically owns its data, controls who can access the backend, and can audit every layer of the infrastructure - something shared cloud environments cannot offer by design.

The cloud version of Bitrix24 (Alaio) requires no installation and is ready within minutes. For startups and sales teams with no sector-specific compliance requirements, this is generally the most practical choice. The on-premise version, on the other hand, is installed on the company's own servers (or a dedicated private cloud), and everything - databases, files, logs - remains under the organization's direct custody.

The table below summarizes the key differences relevant to an IT director operating in a regulated environment:

Feature	Bitrix24 Cloud	Bitrix24 On-Premise
Data location	Vendor's servers	Company's own servers
Source code access	REST API only	REST API + Bitrix API + D7 API
Interface customization	Limited by plan	Via modules, PHP, and JavaScript
AD/LDAP/SSO integration	Limited	Native
Group-level security policy	Plan-defined settings	Granular backend configuration
Backup control	Managed by vendor	Policy and destination defined by you
Data storage	Limited by plan	Unlimited (server capacity)
Air-gapped network operation	No	Partially possible
Multiple branches	Enterprise cloud only	Enterprise on-premise

Air-gapped operation (fully isolated from the internet) deserves particular attention: Bitrix24 on-premise can function in an isolated environment, but certain modules that rely on external Bitrix24 servers will be unavailable in this mode. Tools that normally communicate with external servers can be reconfigured for internal operation by contacting support.

---

Data Sovereignty and Regulatory Compliance

For organizations subject to the LGPD (Law No. 13.709/2018), the European GDPR, or sector-specific regulations governing financial services and healthcare, self-hosted deployment eliminates reliance on third-party contractual clauses: data resides wherever the organization chooses, with no implicit cross-border transfer.

Data protection regulations require the data controller to be able to demonstrate the technical and organizational measures in place to safeguard personal information. In shared cloud environments, part of that demonstration depends on vendor-supplied documentation - which may fall short during rigorous sector audits in industries such as financial services and healthcare.

With an on-premise deployment, the organization can:

• Choose which datacenter (owned or colocation) stores the data
• Implement its own encryption at rest and in transit
• Control both physical and logical access to the database
• Generate internally auditable access logs without relying on the vendor
• Integrate with internal identity management systems (AD/LDAP) without exposing credentials to third parties

For organizations that handle health data, financial data, or information relating to minors, this level of direct control is often mandated by internal policy or external auditors - regardless of the minimum legal requirement.

See also: CRM em Conformidade com LGPD/GDPR: Por Que Bitrix24 Self-Hosted Vence

---

Bitrix24 Self-Hosted Security Architecture

Bitrix24 on-premise is designed with security across multiple layers: granular group-based access policies, IP-bound sessions, a configurable WAF, two-factor authentication, and code security audits conducted by the product's internal security team.

The access control flow in the on-premise architecture:

flowchart LR
    U[Usuário] --> WAF[Firewall de Aplicação WAF]
    WAF --> WS[Servidor Web Apache/nginx]
    WS --> PHP[PHP 8.2+ / OPcache]
    PHP --> DB[(Banco de Dados MySQL/MariaDB)]
    PHP --> FS[Sistema de Arquivos]
    PHP --> AD[AD / LDAP Corporativo]
    PHP --> POL[Política de Segurança por Grupo]
    POL --> SESS[Sessão vinculada a IP]
    POL --> 2FA[Autenticação 2 Fatores]
    POL --> LOG[Logs de Auditoria]

Every request passes through the WAF before reaching the web server, which triggers PHP with OPcache for performance. PHP queries the local database and file system, and can integrate directly with the corporate Active Directory. The group-level security policy governs sessions, two-factor authentication, and log generation - all within the company's own network.

The main configurable security layers in the on-premise deployment include:

• Session binding to IP or network mask - neutralizes XSS/CSRF session hijacking attacks
• Session activity timeout - fully configurable by the administrator
• Concurrent session limit per user - the default for administrators is 1 device
• Password recovery link expiry - reduces the attack window in the event of email interception
• Differentiated security policy by group - when a user belongs to multiple groups, the most restrictive rule always applies
• Fully customizable WAF with complete backend access - unlike the cloud, where the WAF is configured by the vendor
• SSL encryption managed entirely by the organization, including custom certificates beyond Let's Encrypt

The product code undergoes internal security audits, and every update is tested against known threats before release.

Further reading: Hardening de Segurança para Bitrix24 Self-Hosted: Checklist de 25 Pontos

---

An Honest TCO Analysis: When Cloud Is Actually Cheaper

For up to 50 users over a 3-year horizon, cloud is typically less expensive than on-premise: the Business on-premise license ($3.590) plus two annual renewals ($1.795 each) already exceeds $7.000 before factoring in server and maintenance costs. Self-hosted becomes cost-competitive at higher user volumes or when there is a regulatory requirement that cloud cannot meet.

This is the calculation every IT director needs to run before deciding:

Scenario 1 - Up to 50 users, 3 years

Item	On-Premise Business	Cloud (market reference)
Initial license	$3.590	-
Renewals (2 × 50%)	$3.590	Annual subscription × 3
Dedicated server (estimate)	Additional cost	Included
Infrastructure maintenance (estimate)	Additional cost	Included
Advantage	Data control and residency	Lower total cost

Note: cloud subscription pricing varies by region and plan. Always refer to the latest pricing at bitrix24.com/prices for on-premise.

Scenario 2 - When On-Premise Breaks Even or Wins

The balance shifts when:

• The user base grows into the hundreds - the on-premise license does not scale linearly the way cloud subscriptions do
• The organization already has datacenter infrastructure where adding Bitrix24 carries marginal cost
• There is a need for deep code-level customization (PHP/D7 API) that the cloud does not permit
• Sector regulations mandate data residency on company-owned servers - in which case price comparison becomes secondary

The honest conclusion: for smaller teams with no regulatory requirements, cloud frequently wins on 3-year TCO. On-premise is primarily justified by control, compliance, and customization - not by immediate cost savings.

For a detailed scenario-based analysis: Bitrix24 Self-Hosted vs Nuvem: Análise TCO Completa de 3 Anos

---

Infrastructure Requirements by User Range

Minimum server requirements scale with the number of active users: from a 4-core server with 8-12 GB RAM for up to 50 users, to a 6-core server with 48-64 GB RAM for 500-1.000 users.

Based on typical deployment projects, the recommended reference configurations are:

User range	CPU (reference)	SSD storage	RAM
Up to 50	4 cores, ~3.4 GHz	128 GB	8-12 GB DDR4
50-100	4 cores, ~3.4 GHz	256 GB	16-24 GB DDR4
100-500	4 cores, ~3.4 GHz	512 GB	24-32 GB DDR4
500-1.000	6 cores, ~3.6 GHz	1 TB	48-64 GB DDR4

Software requirements:

• Operating system: CentOS Stream 9 (recommended for new installations) or equivalent Linux distribution
• Web server: Apache 2.4.x (recommended) or nginx (requires manual configuration)
• PHP: version 8.2 or higher, with GD, XML, FreeType, Zlib, and OPcache extensions
• Database: MySQL/MariaDB with UTF-8 charset
• PHP memory: minimum 256 MB per process (memory_limit = 256M)

Deployment options:

1. Virtual machine (VMware, VirtualBox) - simplifies snapshots and portability
2. Direct Linux installation - higher performance, requires a systems administrator

In both cases, ports 80 and 443 (HTTP/HTTPS) must be externally accessible, along with port 22 for SSH administration. A domain with SSL is mandatory for the portal to function correctly.

If the organization does not have its own infrastructure, an alternative is to host Bitrix24 on-premise on a dedicated private cloud - maintaining full data control without the burden of physical hardware. See: Bitrix24 Self-Hosted em AWS, Azure ou Nuvem Privada: Guia de Implantação

For detailed sizing above 1.000 users: Bitrix24 Self-Hosted: Guia de Dimensionamento de Hardware para 50 a 1.000 Usuários

---

On-Premise Editions, Licensing, and Pricing

Bitrix24 on-premise is available in two editions - Business and Enterprise - with an annual renewal fee of 50% of the license value. The previous 25% renewal rate no longer applies; that condition ended in October 2024.

The editions available at bitrix24.com/prices/self-hosted.php:

Edition	Starting price	Included users	Highlights
Business	$3.590/year	50 (tiers: 100, 250, 500)	CRM, portal, automations, full API
Enterprise	$24.990/year	1.000+	Multiple branches, web cluster, 24/7 support

Annual renewal: 50% of the contracted edition price, effective from 1 October 2024.

Grace period after expiry: 14 days. After this period, the portal is locked until the renewal is completed.

What is included in the license:

• Bitrix24 technical support for the duration of the license (accessible directly from the control panel via the support chatbot)
• Updates and security patches
• Full access to the source code (PHP, D7 API, REST API)

The Enterprise edition adds support for multi-branch structures, high-availability clustering, and 24/7 support - relevant for corporate groups with operations across multiple locations.

For a full breakdown of each edition: Edições e Licenciamento do Bitrix24 Self-Hosted: Guia Completo para 2026

---

When Self-Hosted Is the Right Choice (and When It Is Not)

On-premise is the right choice when the organization faces data residency requirements, backend security auditing obligations, deep integration with legacy systems, or customization needs that go beyond the REST API - not when the primary goal is to reduce licensing costs.

Choose on-premise when:

• Sector regulations require that customer data reside on servers under the organization's control (healthcare, financial services, government)
• External auditors need to verify access policies at the operating system level
• The organization needs to integrate the CRM with internal systems over a closed network (no external traffic)
• Modifications to the platform's source code are required (custom interfaces, custom modules)
• The user volume makes the TCO competitive with cloud, given existing infrastructure
• Internal security policy prohibits storing data on third-party cloud infrastructure

Stay with cloud when:

• The team is small (up to ~50 users) and there is no specific regulatory requirement for data residency
• There is no internal IT team to manage servers and apply patches
• Deployment speed and automatic updates are more valuable than direct control
• The 3-year budget clearly favors the cloud subscription (see the TCO analysis above)

For teams that need the control of on-premise but do not want to manage infrastructure, there is a managed self-hosted option - where a partner handles deployment, hosting, and maintenance: Bitrix24 Self-Hosted Gerenciado: Implantamos, Hospedamos e Mantemos para Você

If you are migrating from cloud to on-premise, the process follows defined steps and typically takes several weeks depending on data volume: Migrando do Bitrix24 Nuvem para Self-Hosted: Plano Passo a Passo