Open source is free to download, not to run.
Patching, upgrades, security and the one admin who knows how it all works are paid with your people's time. And the software only lives as long as someone funds its development.
The licence is only the tip of the iceberg.
True at first sight. Here is what happens next.
The licence is free, running a production service is not. In our case study, 82% of the in-house cost was staff time spent installing, patching, upgrading and troubleshooting.
Your ICT team runs generic infrastructure well. A niche research application with frequent releases is one more system competing for their time, time not spent on what only they can do.
Security is a practice, not a location. An outdated server in your basement is less safe than a continuously patched, monitored and firewalled service. See the comparison.
Much research software is funded by grants, and grants end. Then developers leave and security fixes wait, and neither you nor your ICT team has any say in it. Read more.
Communities are generous, but nobody is obliged to answer, least of all the day before a funder's deadline. There is no contract, no response time and nobody accountable.
Self-hosting just moves lock-in to your set-up and your one admin. FAIR Wizard runs on open-source DSW, so your content is not tied to a proprietary format and you keep full API access.
Somebody has to pay the developers. In research, that is usually a grant, and grants end.
A project funds a small team. Development is fast.
The roadmap follows the proposal, not your requests.
Developers on fixed-term contracts move on.
Releases slow down, security fixes wait.
How a mid-sized university hosted an open-source data management planning tool in-house, and what it really cost.
A composite scenario: the institution and tool are unnamed, the tasks and effort are realistic.
The research office needed a data management planning tool before new funder requirements kicked in. An open-source tool, developed within a well-known research project, did everything the data stewards wanted. The ICT department had spare capacity on its cluster, and the vice-rector for IT preferred to keep research systems in-house “for security”.
The decision took one meeting: “It's free, we have servers, we'll host it ourselves.” No budget line was created, because there was nothing to buy.
Here is how the next two years went.
The request waits in the ICT queue for six weeks. A sysadmin then learns Docker, sets up PostgreSQL, S3-compatible storage, the document worker, e-mail and TLS. The federation login needs SAML, which the tool does not support, so a Keycloak bridge is added. Meanwhile, researchers write their DMPs in Word.
Three new versions and several hotfixes are out. There is no staging instance, and the data stewards are afraid an upgrade will break their customised knowledge model and templates. “Let's wait for a quieter period.”
The sysadmin who built the set-up moves to another job. The documentation is a half-page wiki note. A colleague spends two weeks reverse-engineering the configuration.
An internal audit flags the instance as ten versions behind, including a critical security hotfix released months earlier that nobody noticed, outdated operating system packages and a publicly reachable login without brute-force protection. An emergency upgrade across several versions fails on a template incompatibility. The tool is down for two days in the week of a Horizon Europe deadline. Restoring from backup reveals that generated documents in object storage were never backed up.
The research project behind the tool ends. Two core developers leave for other jobs and releases drop from monthly to twice a year. A reported vulnerability in one of its dependencies stays unfixed for three months, so ICT adds a local patch and extra firewall rules. The reporting module the university was waiting for is quietly dropped from the roadmap.
The vice-rector asks how many projects have a DMP and how many plan to share their data openly. With the reporting module gone, ICT writes scripts against the API and a data steward fills spreadsheets by hand each quarter.
The new head of ICT asks for the total cost of the “free” tool. The answer is below. The university moves to FAIR Wizard Enterprise: SAML login works natively, the team helps the data stewards set up their questionnaire and templates during onboarding, and a preview instance lets them test every new version before it reaches production.
What running the tool properly for three years costs, at EU-27 average labour costs: €386 per ICT day and €295 per data steward day. Skipping upgrades, as the university did, is not a saving: it is how the audit happened. How we calculated this.
| Self-hosted open-source tool | Effort | 3 years |
|---|---|---|
| One-off costs | ||
| Initial set-up and hardeningServers, Docker, PostgreSQL, S3 storage, document worker, mail, TLS, reverse proxy, firewall rules | 25 ICT days | €9,650 |
| Single sign-on bridgeThe tool supported OpenID only, so the university SAML/Shibboleth federation needed a Keycloak bridge | 10 ICT days | €3,860 |
| Self-onboarding of data stewardsLearning to configure the questionnaire and templates from docs and forums, without training | 10 steward days | €2,950 |
| Knowledge transfer after admin leftThe only person who knew the set-up moved on; a colleague had to reverse-engineer it | 10 ICT days | €3,860 |
| Mitigating an unfixed upstream vulnerabilityAfter the upstream project lost funding, a security fix took three months; ICT patched locally and added firewall rules | 5 ICT days | €1,930 |
| Recurring costs | ||
| Day-to-day operationsOS and database patching, monitoring, backup checks, certificates, disk space, user tickets (about 5 hours a week) | 33 ICT days / year | €38,214 |
| Upgrades12 releases a year: deploy to staging, data steward checks questionnaire and templates, deploy to production | 12 × (1 ICT + 0.5 steward day) / year | €19,206 |
| Critical and security hotfixesAbout 2 hotfixes per release: read release notes, decide on urgency, apply outside the upgrade schedule, verify | 24 × 2 hours / year | €6,948 |
| InfrastructureProduction and staging VMs, storage, off-site backups, monitoring, internal charge-back | 2 environments / year | €12,000 |
| SecurityVulnerability scanning and a share of the annual penetration test of public-facing systems | external services / year | €12,000 |
| Incidents and downtimeAbout one serious incident a year: recovery work and data stewards handling blocked researchers | 5 ICT + 3 steward days / year | €8,445 |
| Workarounds for missing featuresScripts and manual exports to report on DMPs, since the promised reporting module was never delivered | 10 ICT days / year | €11,580 |
| Total cost of the “free” tool | €130,643 | |
| FAIR Wizard Enterprise | Effort | 3 years |
|---|---|---|
| SubscriptionHosting, upgrades, backups, security, monitoring, support, Integration Hub, Analytics and AI Assistant | €12,000 / year | €36,000 |
| Connecting your identity providerSAML/Shibboleth is supported natively, ICT only registers the service | 1 ICT day | €386 |
| OnboardingSetting up the questionnaire and templates together with our team | assisted by us | – |
| Total | €36,386 | |
€94,257saved over 3 years (72%)
And that is before counting what does not fit in a spreadsheet: four months of researchers without a tool, two days of downtime before a deadline, an audit finding on the vice-rector's desk, and a tool whose future nobody could guarantee.
Official statistics for staff time, our own release history for the workload.
| Region | ICT day | Steward day |
|---|---|---|
| EU-27 average | €386 | €295 |
| Western Europe | €492 | €436 |
| Northern Europe | €515 | €376 |
| Southern Europe | €254 | €237 |
| Central and Eastern Europe | €244 | €154 |
| North America * | €386 | €382 |
| Australia * | €273 | €253 |
| East Asia * | €119 | €94 |
Labour cost per hour worked, including employer contributions, × 8 hours. ICT staff: information and communication sector. Data stewards: education sector. Regions are simple averages of their countries.
* Wages only, as no labour-cost statistics are published there. Employer contributions come on top, and sector averages are lower than what specialised ICT staff earn, so the real cost is higher.
Sources: Eurostat: Labour cost levels by NACE Rev. 2 activity (lc_lci_lev); U.S. Bureau of Labor Statistics: Employer Costs for Employee Compensation; Statistics Canada: Employee wages by industry, annual (14-10-0064-01); ILOSTAT: Average hourly and monthly earnings of employees by economic activity; Australian Bureau of Statistics: Employee Earnings and Hours, May 2025; European Central Bank: Euro foreign exchange reference rates
Pick your country or region, then adjust the numbers to your institution.
Excludes incidents, staff turnover and funding risk, so the real in-house cost is usually higher. Get an exact offer.
A typical self-hosted instance next to FAIR Wizard Cloud.
| Typical self-hosted | FAIR Wizard Cloud | |
|---|---|---|
| Critical and security hotfixesNoticing them and applying them quickly | Someone has to watch release notes, notice and apply them | Applied by our team as soon as they are released |
| Testing before upgradesA place to try the next version safely | Rarely a separate staging instance | Preview instance with the future version |
| BackupsAnd knowing they can be restored | Depends on local set-up, rarely tested | Daily encrypted backups and Time Travel restore |
| Perimeter protectionAgainst common web attacks | Firewall, if configured for this app | Web Application Firewall and OWASP-aligned practices |
| Login protectionAgainst password guessing and account takeover | Basic password login | Password policy, CAPTCHA, brute-force throttling, suspicious login alerts |
| Identity providersYour institutional login | Whatever the tool supports, often via an extra bridge to maintain | OpenID, SAML, Shibboleth, LDAP, Active Directory |
| Who fixes vulnerabilitiesIn the software itself | An upstream project, when its funding allows | Our team, under contract |
| Audit trailWho did what and when | Server logs, if kept | Built-in audit log |
| MonitoringSpotting problems before users do | Often added later | Centralised logging, metrics and alerting |
How we run it: Behind the Scenes of FAIR Wizard Cloud.
The reasons usually come from policies, not technology:
None of these needs a server in your basement.
Tell us your requirements and we will put together a cloud offer that fits your institution: your plan, your integrations, your branding and the terms your legal team needs.
Get a tailored offerQuestions ICT departments and management ask us most.
Explore what FAIR Wizard adds on top of the open-source engine.
