Self-Hosted vs Cloud LMS: How to Choose the Right Deployment

The deployment question is usually settled by someone who never opens the course catalog. L&D shortlists a platform on features, then the security review asks where learner data lives, who can reach the database and how a restore works, and the shortlist changes. Answer those questions first and you save weeks.

This article compares running an LMS in a vendor's cloud with running it on infrastructure you control. We build and support both, so we will try to be straight about what each one really costs you.

Three options, not two

• Vendor cloud (SaaS). The vendor hosts, patches, backs up and monitors. You get a URL and an admin login.
• Self-hosted on your own hardware. On premises or in a data center you already run. Your network, your firewall, your backups.
• Self-hosted in your own cloud account or with a hosting provider. A VPS, an AWS or Azure account, or ordinary managed hosting. You own the application and the data, and someone else owns the hardware.

The third option is what most organizations actually mean by "self-hosted". It removes much of the hardware worry people associate with the term, while keeping the data under your account and your policies.

Where the data lives, and who can reach it

LMS data is more sensitive than it looks. Beyond names and email addresses, you may hold assessment results tied to hiring or promotion, completion records an auditor will ask for, uploaded assignments and, if you run proctored exams, webcam snapshots, ID photos and audio clips. That last group is the one that gets a privacy officer's attention.

With a cloud LMS your controls are contractual: the vendor's hosting regions, their subprocessors, their data processing agreement and whatever audit reports they can share. With self-hosting, the data sits inside your environment under policies you already enforce, which often shortens data-residency discussions and internal approvals.

In both models, check which features send data to third parties anyway. AI is the obvious one. If the LMS calls an external AI provider for course drafting, tutoring or grading, that content leaves your server even when the LMS itself is self-hosted. In LMS Advisor the admin chooses Anthropic or OpenAI as the provider, and AI can be switched off entirely. Proctoring audio is transcribed with OpenAI Whisper. Coding questions run candidate code through Judge0 or Piston, which you can use as a hosted service or run on your own server. Put a list like that in front of your security team early, because it is the first thing a careful reviewer asks for.

Security is shared in both models

Neither model is automatically more secure. A good cloud vendor usually patches the operating system and database faster than a stretched internal team. A self-hosted install lets you apply controls you already trust, like network segmentation, central logging and your own backup regime, and every one of those becomes your job.

The application-level controls tend to matter more than the hosting model, and the questions are the same either way:

• SAML 2.0 single sign-on with your identity provider.
• SCIM provisioning, so a leaver loses LMS access when they are removed from your directory, not when someone remembers.
• Two-factor authentication or passkeys, at least for admins.
• Roles and permissions fine enough that a branch manager sees only their branch.
• Audit logs for admin actions.
• Data retention settings and a way to process GDPR and CCPA access and deletion requests.
• How uploads are checked. SCORM packages are zip archives from outside your organization, and a platform should inspect them before unpacking anything.

If procurement requires an attestation report, ask a cloud vendor for it on the first call. For self-hosted software the questions shift toward how the vendor handles security fixes and how quickly you can apply them. Our security and data ownership page covers the LMS Advisor side of these questions in detail.

What it really costs

Do not compare a cloud subscription quote with a server bill. That comparison always flatters self-hosting. List the real line items over three years instead.

Two costs catch people out. Storage grows faster than expected once you add video lessons, recorded sessions and exam evidence. And staff time is real: someone has to own updates, backups and the occasional late-night disk-space alert. If nobody on your team wants that job, the cheaper option on paper is not the cheaper option.

Audience shape matters too. Per-user cloud pricing is easy to budget for a stable internal workforce. For large, seasonal or external audiences (customers, partners, exam candidates) it can climb quickly, and that is one of the more common reasons teams look at self-hosting in the first place.

What self-hosting means week to week

Here is the checklist we run through before any self-hosted go-live. When every line has a named owner, you are ready.

• Server sized for your peak concurrent learners, with PHP upload and memory limits raised enough for SCORM zips and video files.
• A TLS certificate with automatic renewal.
• Outbound email set up with SPF and DKIM, so enrollment and reminder emails reach inboxes instead of spam folders.
• Scheduled jobs running on cron: email sending, automations, LRS forwarding and data retention clean-up. If cron stops, reminders stop quietly and nobody notices for a week.
• Nightly database backups copied off the server, plus the uploaded media. At least one restore actually tested.
• An update routine: back up, apply the release, run database migrations, check system health.
• Monitoring for disk space, uptime and failed jobs, and a named person who receives the alert.

Good tooling makes this list shorter. LMS Advisor is plain PHP and MySQL and runs on ordinary cPanel or VPS hosting. Admins get an in-app screen for running database migrations, creating and downloading backups and switching on maintenance mode, plus a system-health page that checks the server environment and lets you adjust PHP limits without editing config files by hand.

Integrations behave differently behind your firewall

An LMS rarely works alone. It signs people in through your identity provider, pushes events to other systems and pulls in outside services. In the cloud, the vendor has already opened those paths. On a self-hosted server, each one is a conversation with your network team.

Map the traffic in both directions before go-live:

• Inbound. Learners and candidates need to reach the site, often from outside your corporate network. SCIM provisioning calls from your identity provider need to reach it too. An LMS that is only reachable over VPN is a poor fit for customer or partner training.
• Outbound. Webhooks, Slack or Microsoft Teams notifications, forwarding to an external LRS, email delivery, AI providers and video meeting services all need the server to make outbound calls. Strict egress rules break these quietly, and the first symptom is usually a missing notification weeks later.
• Timing. Anything queued, such as LRS statements or automated emails, depends on those cron jobs from the checklist above. Test the whole chain, not just the page load.

None of this is hard, but it takes calendar time. Put the list into the change request on day one rather than discovering items one ticket at a time.

Time to launch

Cloud wins this one. You can have a working site the same day. Self-hosting adds provisioning, DNS, TLS, email setup and, in larger organizations, an internal change request that can take longer than the install itself. If a regulatory deadline is driving the project, build that lead time into the plan. A compliance training rollout with a fixed audit date is a bad place to discover your change board meets monthly.

A quick decision guide

If you tick boxes in both columns, which is common, the tiebreaker is usually the second row. Be honest about who will own the server in two years, not just at launch.

Keep your exit open

Whichever you choose, ask how you would leave. Can you export courses, learner records, completion history and certificates in a usable form? Can you get a copy of the database? A platform that runs the same codebase in the cloud and self-hosted lets you start one way and move later without retraining admins or rebuilding courses. LMS Advisor works that way, with course export and import between installs. Pricing depends on the deployment model, learner numbers and modules, so a demo call is the easiest place to compare both options for your situation.