Short answer
Customer-hosted software runs in infrastructure the retirement firm controls, such as its own AWS account in a US region or its own servers. It gives the firm control over where participant data lives, who can access it and when updates happen, in exchange for more responsibility. Put the split of responsibilities in writing before choosing.
Definitions
Vendor-hosted (SaaS) software runs in the vendor’s infrastructure; customers share it and the vendor controls hosting, access and updates. Customer-hosted software runs in infrastructure the customer controls: its own cloud account (for example AWS, in a region it chooses) or its own data center. Customer-hosted does not mean on-premise only; most customer-hosted deployments today are in the customer’s cloud account.
Why it matters for retirement data
A TPA or recordkeeper holds SSNs, dates of birth, compensation and account balances for many employers’ employees. Plan sponsors, as fiduciaries, are expected to prudently select and monitor service providers, and the US Department of Labor has published cybersecurity best practices for service providers. Customer hosting can make some of those conversations simpler: the firm can state exactly where data is stored, which keys encrypt it, who has access, and how backups are tested, because it controls all of them.
Trade-offs
| Factor | Customer-hosted | Vendor-hosted |
|---|---|---|
| Data location | Chosen by the firm (for example a US region) | Vendor’s choice, disclosed in contract |
| Access control | Firm’s identity provider and policies | Vendor’s, with customer roles |
| Updates | Scheduled by the firm, tested before rollout | Vendor’s schedule |
| Operational effort | Higher: infrastructure, monitoring, backups | Lower |
| Cost model | License plus the firm’s cloud bill | Subscription |
| Integrations | Direct access to the firm’s other systems | Through vendor APIs |
| Exit | Data already in the firm’s account | Depends on export terms |
Put shared responsibility in writing
Customer-hosted only works when everyone knows who does what. A responsibility matrix should cover: infrastructure provisioning, identity and access management, encryption keys, patching of operating systems and dependencies, application updates, monitoring and alerting, backups and restore tests, incident response and vendor support access (time-limited and logged).
Questions to ask any vendor
- Can the software run in our own cloud account, in a region we choose?
- How are updates packaged, tested and rolled back?
- What access does the vendor need for support, and how is it granted and revoked?
- What security attestations exist today, and which are planned? (Ask for reports, not logos.)
- How do we export all our data in a usable format?
- Which features depend on vendor-hosted services, if any?
KinetiPlan, Software Home’s platform for independent TPAs, is customer-hosted by design: in the TPA’s own AWS account in a US region of its choice, or on-premise. It follows SOC 2-aligned practices and has no SOC 2 report; responsibilities are agreed in writing with each customer.
References
Written by the Software Home engineering team, which builds 401(k) software and the KinetiPlan platform; we have an interest in some of the choices discussed. General information only, not legal, tax or investment advice.