Before you self-host a production dependency, answer these questions in writing.
Data and recovery
- Where is authoritative data stored?
- Are backups automatic, encrypted, and tested by restoration?
- What are the recovery point and recovery time targets?
Upgrades
- How are releases and breaking changes tracked?
- Can you test against production-like data?
- Is rollback documented and rehearsed?
Observability
- Which health, latency, error, capacity, and queue signals matter?
- Who receives an alert, and what can they actually do?
Security
- How are secrets, network access, admin roles, dependencies, and audit logs managed?
- Is there a supported security-reporting path?
Ownership and exit
- Who patches incidents on a weekend?
- Can data be exported in an understandable format?
- What would trigger a move back to managed service or another project?
Self-hosting is most sustainable when ownership is explicit and recovery is boring. What item on this checklist do teams most often discover too late?