Self-hosting readiness checklist: backups, upgrades, observability, security, and an exit plan

Before you self-host a production dependency, answer these questions in writing.

Data and recovery

  • Where is authoritative data stored?
  • Are backups automatic, encrypted, and tested by restoration?
  • What are the recovery point and recovery time targets?

Upgrades

  • How are releases and breaking changes tracked?
  • Can you test against production-like data?
  • Is rollback documented and rehearsed?

Observability

  • Which health, latency, error, capacity, and queue signals matter?
  • Who receives an alert, and what can they actually do?

Security

  • How are secrets, network access, admin roles, dependencies, and audit logs managed?
  • Is there a supported security-reporting path?

Ownership and exit

  • Who patches incidents on a weekend?
  • Can data be exported in an understandable format?
  • What would trigger a move back to managed service or another project?

Self-hosting is most sustainable when ownership is explicit and recovery is boring. What item on this checklist do teams most often discover too late?