Most awards do not need self-hosting. The vendor runs the platform in an EU data centre, you sign a data processing agreement under Article 28 GDPR, and the matter is closed. Running it yourself costs more, creates work and unlocks no feature the hosted version lacks.
For some organisations it is not a preference but a condition, settled before the first vendor call. This article covers three of those situations, what operating the software involves — Docker, updates, backups, TLS — and an honest comparison of the two models.
Scenario 1: A public authority or a chamber
In German-speaking Europe many awards are run by bodies that are not free to choose. Chambers of commerce, professional chambers and public authorities work to a written IT security policy. If it says personal data must not leave their own data centre, the vendor discussion ends before it starts.
The approval path matters as much. An external service needs supplier assessment, a data protection impact assessment, often formal procurement and sign-off from the data protection officer. In-house software is reviewed like any other internal application: not less work, but a familiar route with known owners.
The binding constraint is the calendar. Approvals take months and the entry deadline does not move for them. If entries open in autumn, IT needs the question in spring; the award timeline shows how that fits.
Scenario 2: A corporate IT policy
In large companies, award software rarely fails on technical grounds. It fails on process. There is an approved list of cloud services, a single sign-on requirement and a security review for every new processor. The department running the award, usually communications or HR, has no mandate to add one.
Self-hosting changes the question. “May we send personal data to another supplier?” becomes “Can we run one more application?” IT operations often answer the second within a week, because they answer it every week.
The honest caveat: if your IT team has no spare capacity, self-hosting is the slower route, not a shortcut. Pursue both paths and take whichever clears first.
Scenario 3: Genuinely sensitive entry data
Not every award is a marketing prize. Research, innovation and medical awards attract entries with unpublished results, inventions filed before patent publication, financial figures or case notes containing health data. Employer and HR awards gather workforce data in the same dossiers.
That changes the risk calculation. A leak does not cost reputation; it costs novelty, competitive advantage, or triggers a notifiable data breach. The trade-off looks different from a readers' choice award.
One honest boundary belongs here. Self-hosting protects the route out of your organisation. The more common exposure is internal: a jury including someone from the entrants' own market. No server solves that; assignment rules, declarations of interest and the guarantee that jurors see only their assigned entries do. Which legal basis fits which data flow is covered in GDPR and award entries.
What running self-hosted jury software involves
Award platforms ship as containers, usually via Docker Compose: application, database, a renderer for PDF invoices and certificates, and a reverse proxy for HTTPS. Installation takes an afternoon. Operation is the real commitment, and it lasts the whole season.
Award traffic also has an unusual shape: little happens for months, then a large share of entries arrives on the final day. That is the night when nothing may break and nobody may deploy.
| Task | What it involves | Cadence | If it slips |
|---|---|---|---|
| Updates | Deploy new container versions; bring security patches forward | regularly, never in deadline week | Known vulnerabilities stay open |
| Backups | Automated, encrypted database dumps on a separate system | daily | An outage costs you the live entry phase |
| File uploads | Attachments, images and video sit outside the database and need separate backup | daily | The records survive, the submitted material does not |
| TLS | Automatic certificate renewal plus expiry monitoring | automated, with an alert | Browser warnings on deadline day, abandoned forms |
| SPF, DKIM and DMARC records for the sending domain | once, recheck on domain changes | Jury invitations and invoices land in spam | |
| Availability | Monitoring plus a named person reachable on deadline night | throughout the entry phase | You learn about the outage when entrants ring |
Two items are routinely underestimated. A backup never restored is an assumption, not a backup: rehearse the restore before every season. And a self-hosted instance sends its own invitations, reminders and invoices; without correct domain records, part of that mail never reaches the jury.
The data protection picture shifts too. You remain the controller, but the vendor's ongoing role as processor largely falls away, because the data never leaves your estate. The moment support looks at your system to debug an issue, you need a contractual basis: put it in the maintenance agreement, not in the incident.
Managed or sovereign: the honest comparison
Both are legitimate. They differ not in what the software can do, but in who is accountable on the night before the deadline.
Vendor-operated (managed)
- EU hosting with a data processing agreement under Article 28 GDPR
- Updates, backups, TLS and monitoring happen without you
- Live within days, no ticket to IT
- Market rates around € 2,500–5,000 per year; some vendors charge € 2–3 per entry
- Limit: the data sits with a third party. Where a written policy rules that out, this path ends
Self-operated (sovereign)
- Application and database stay behind your firewall
- Your IT sets network access, backup strategy and retention
- Availability and recovery are yours to own
- Higher licence price plus internal effort across the season
- Limit: the premium buys control and approvability, not features
Signs that self-hosting is the wrong call
- Nobody can show you the clause. “We cannot use the cloud” is often a feeling, not a written rule.
- There is no named person reachable on deadline night. Without that name you have a hope, not an operating plan.
- The motive is saving money. Once internal hours are counted, self-hosting is the dearer option; the method is in what an award costs.
- Entries open in six weeks. Server, certificate, DNS records and a dry run need lead time you do not have.
How Laureo handles both
Laureo comes in both shapes with the same feature set. In Starter (€ 1,790) and Professional (€ 3,490 net per award season) we run the platform in the EU, data processing agreement included. Sovereign starts at € 7,900 net per season, ships as a Docker Compose package for your own infrastructure, with an SLA and an onboarding workshop for your IT.
Self-hosted instances keep the full toolset: multiple jury rounds, assignment with conflict-of-interest handling, score normalisation across strict and lenient jurors, staged publication from shortlist to winners. Details on features and self-hosting.
And because it belongs here: we do not recommend Sovereign where no policy requires it. If you are free to choose, EU hosting gets you live faster and costs less across the season. The other criteria that matter in a vendor selection are in the award software comparison.
Frequently asked questions
Is self-hosted jury software GDPR compliant?
You are the controller either way. Hosting it yourself removes the vendor's ongoing role as processor, because entry data never leaves your infrastructure. You still need a written basis under Article 28 GDPR for any support access, plus your own rules for retention and deletion after the season.
What does it cost to self-host award software?
The licence is only part of it. Laureo Sovereign starts at € 7,900 net per season against € 3,490 for the vendor-run Professional package, and internal time for servers, updates, backups and availability comes on top. Self-hosting is the dearer route; it buys control rather than extra features.
Who installs updates on self-hosted award software?
Your IT does. The vendor supplies new container versions and security patches, your team deploys them. Schedule maintenance windows outside the entry phase: most entries arrive in the final days before the deadline, and an update at the wrong moment costs you exactly those hours.
What do I need to run jury software on my own server?
A Linux host with Docker, your own domain with an automatically renewed TLS certificate, a reverse proxy, daily backups of both the database and uploaded files, and SPF, DKIM and DMARC records so jury mail is delivered. Above all, a named person reachable on deadline night.
Related reading
Planning an award right now?
In 20 minutes we walk through your process: entry, jury round, invoice.
Book a demo