Should our customer portal be open source — what technical responsibilities do we take on?

We went through the exact same thing two years ago and had someone build us an open-source customer portal. The dev who set it up moved on six months later. One day the database locked up, clients couldnt get their invoices, and we spent 1,000 Euro in a blind panic hiring someone external just to bring it back online. Speaking from experience, a SaaS solution will give you so much more peace of mind.

If you go the open-source route, it's not just the application itself—you have to manage web server configs, database optimization, and firewall rules as well. On top of that, the authorization layer for stored PDFs must be airtight; otherwise, someone can easily tamper with the URL and pull up another customer's delivery slip.

We pay 160 Euro a month for an off-the-shelf cloud solution. Previously, between server rental for open source software, external backup storage, and paying a freelance dev 90 Euro an hour whenever issues came up, our annual costs were almost identical—plus all the added stress was just not worth it.

Off-the-shelf cloud services seem super tempting at first, but when they unilaterally double their prices two years down the road, you're completely helpless. Your customer data ends up locked in their system, and trying to export it when you want to leave can turn into a total nightmare.

edit: typed from phone, sorry for typos.

If you're on the fence, test out the one-month free trials of off-the-shelf cloud systems with 5-10 clients. See if customers actually even log in. It's much smarter to validate real demand before sinking 4.000 Euro into an open-source setup.

if you're holding customer data in germany the data protection compliance and security liability is 100% on you. the slightest vulnerability on your own server and the legal penalties land straight on the company, imo don't even mess with it just get a managed service.

Edit: asked below, I wrote the answer in the second message.

The four primary burdens draining in-house manpower in an open-source setup are: 1) Tracking server security patches, 2) Routinely running restoration tests on database backups, 3) Preventing the email notification server from getting blacklisted, and 4) Investigating user permission errors individually.

150 clients is a very manageable number. Go with an off-the-shelf cloud solution at the start to nail down your operational needs. If your volume exceeds 500 down the line and managed systems fall short, then you can look into investing in dedicated open-source software.

The most overlooked point about customer portal open source is this: Start with a small trial; don't commit to everything at once.

I've been down this road, let me tell you. Code without setup documentation isn't yours, even if you have it.

Start with a small trial; don't commit to everything at once. If I were you, I'd go this route.

My questions are cleared up, thanks. The system lives on after delivery; maintenance is a separate line item.

timelly topic.

Don't miss this: People defend habits, not processes. Resistance comes from there.

The system lives on after delivery; maintenance is a separate line item. Just leaving this note, it might be useful.

The most overlooked point about customer portal open source is this: Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Heres how it went for us... btw the cheapest quote is usually the least thought-out one.

If I were you Id go this route.

sorry, but this doesn't apply in every case. if you get three different answers on a topic, the question was asked wrong.

if I were you, I'd go this route.

I was thinking the same thing. If code ownership isn't in the contract, you have no bargaining power when leaving.

Hasty decisions become decisions you have to fix six months later. If you have questions, write them; I'll answer as best I can.

Quick summary for newcomers: Don't hesitate to ask; those who don't ask always pay more.

When making decisions, write down the worst-case scenario too, not just the best. That's all, sorry if I went on too long.