Every vendor deck I have sat through frames this as a technology decision. In twenty years of doing it, I have never once seen it decided on technology.
It gets decided by a lawyer, by a regulator, or by a number in a contract. And the teams that treat it as an architecture debate spend three months building a comparison matrix that a compliance officer overturns in a single meeting.
So let me write the version I wish someone had handed me — from Latin America, where this question has a shape it does not have in San Francisco.
🔑 The short version
- It is almost never a technology decision. It is regulation, contracts and who is allowed to look.
- On-premise still wins when the data cannot legally leave, or when volume is huge and steady.
- Cloud wins on speed and on not staffing a platform team you do not have.
- The cloud cost that surprises people is not storage. It is egress — moving your own data out.
- The question nobody asks until it hurts: seeing a problem is not the same as having permission to fix it.
Why “cloud vs on-premise” is usually the wrong question
Because it assumes you are choosing between two clean options, and in a real organization you are choosing between what you already have and one more thing to run alongside it.
Nobody starts from zero. There is a monitoring tool from six years ago that somebody still depends on, a network team with its own polling system, and a compliance requirement written before anyone said the word observability out loud. The honest question is not which is better. It is which parts move, which parts stay, and who pays for the seam between them.
Ask a vendor that and watch the deck stop working.
When on-premise still makes complete sense
It has become fashionable to treat self-hosted as legacy. That is a marketing position, not an engineering one.
On-premise remains the right answer when:
- The data legally cannot leave the country. Not “would prefer not to” — cannot. This is more common in Latin America than most northern vendor material assumes.
- Volume is enormous and predictable. Ingestion-based pricing punishes exactly this profile. If you know you will push the same huge volume every month forever, owning the storage is often cheaper.
- You already have the people. If a competent platform team exists, self-hosting costs less than it appears. If it does not, it costs far more than it appears.
- Latency to the data matters more than convenience. Rare, but real in industrial and financial settings.
The failure mode of on-premise is not technical either. It is that the platform becomes one person’s job, that person leaves, and the upgrade nobody documented is now everyone’s problem.
What cloud actually costs
The list price is the part everyone compares, and it is the part that matters least.
| The cost | Shows up as | Why it surprises people |
|---|---|---|
| Ingestion | Per GB or per span | It tracks telemetry volume, not business growth. AI broke this assumption entirely |
| Egress | Per GB leaving | You pay to take your own data out. Nobody models this until they try to leave |
| Retention | A slider | Usually set once, in a hurry, for all data types at the same time |
| Seats | Per user | Grows with the org chart, not with usage. Finance notices this one first |
| The seam | Nowhere | Keeping the old tool alive alongside the new one. Real, budgeted by nobody |
Egress is the one I would put in front of a CFO. It converts a reversible decision into an expensive one, quietly, over about eighteen months — and it is the strongest argument for standardizing your telemetry format early, while you still have the option.
Data sovereignty: a footnote up north, a headline here
This is the section that northern vendor material tends to compress into one slide, and it is the one that decides the project in this region.
When your telemetry goes to a managed platform, it physically lands somewhere. That somewhere has a jurisdiction, a government, and a set of rules about who can compel access to it. For a bank, a hospital or a public agency in Latin America, that is not a preference. It is the whole decision, and it is made by people who will never open a dashboard.
And the ground moved recently. Mexico rewrote its federal data protection law in 2025 and the authority changed hands entirely. Brazil’s regulator became an independent agency with stronger enforcement powers and named AI systems as an enforcement priority for 2026–2027. If your internal policy still names institutions that no longer exist, it is out of date — and the person who will discover that is an auditor.
Security is not “better.” It is different
A managed platform almost certainly has a larger and more capable security team than yours. That is genuinely true and worth saying plainly.
It also means your data now sits inside somebody else’s blast radius, and you inherit incidents you cannot prevent, cannot detect first, and often cannot describe to your own regulator with the detail they will demand.
Self-hosting inverts it: smaller blast radius, and every single control is now your responsibility, including the boring ones that decay silently. In my experience the thing that fails is never the sophisticated control. It is the one that was correct when it was configured and nobody revisited for four years.
What the theory leaves out, and the field doesn’t
Two things I only learned by getting them wrong.
First: “integrates with everything” is a sentence, not a capability. On one project we needed to pull a network monitoring system in as a data source. Nobody in the company had done it. It ended up being three people reading database schemas by trial and error until something returned useful rows. The brochure had described that as a checkbox. Validate every integration with your own data before you believe it exists.
Second, and it took me years to name: visibility and authority are not the same thing.
Seeing is not fixing
For a long stretch of my career I was accountable, every month, for a voice quality number I had no permission to change. The policies that governed it belonged to the connectivity provider. We were allowed to look. When the fault came from their side, that side showed us nothing.
Responsible for the number. No authority to move it. No visibility into the half that was failing. Reporting on it anyway, monthly.
A metric you answer for but cannot influence is not a metric. It is theater.
That is why, when a platform promises total visibility, my question is no longer what we will be able to see. It is and of what we see, what are we permitted to fix? Seeing is necessary and it is not sufficient, and this industry has spent two decades conflating the two.
So how do you actually decide?
Four questions, in this order. The first two usually end it.
- Is there data that legally cannot leave? If yes, that portion is decided. Stop comparing it.
- Do you have a platform team today? Not could hire — have. Self-hosting without one is a decision to build one.
- Is your volume steady and large, or spiky? Steady and large favors owning it. Spiky favors renting it.
- What does leaving cost? Ask before signing, in writing, including egress. The answer is a number, and it should be in the business case.
Most organizations land on both, and that is a legitimate answer rather than a failure to decide — provided somebody owns the seam, and somebody has budgeted for it.
Compute pricing used for cost modeling: AWS on-demand pricing. Market direction on cost optimization in observability: Network World on the observability market.
Frequently asked questions
Is cloud observability cheaper than on-premise?
It depends on the shape of your volume, not on the list price. Cloud tends to win when volume is spiky or modest and when you do not already have a platform team, because you are renting expertise as much as infrastructure. On-premise tends to win when volume is enormous and predictable, since ingestion-based pricing punishes exactly that profile. The cost most often left out of the comparison is egress: what you pay to move your own data out.
What is data sovereignty and why does it matter for observability?
It is the principle that data is subject to the laws of the country where it physically resides. It matters because telemetry contains far more regulated information than teams assume — customer identifiers, error payloads, and now entire AI conversations. For banks, hospitals and public agencies in Latin America this frequently decides the architecture outright, and the decision is made by legal and compliance rather than by engineering.
Is self-hosting more secure than a managed platform?
Not inherently — it is different. A managed provider almost certainly has a larger security team than yours, but your data then sits inside their blast radius and you inherit incidents you cannot prevent or detect first. Self-hosting gives you a smaller blast radius and full responsibility for every control, including the ones that decay quietly because they were correct when configured and nobody revisited them.
Can I use both cloud and on-premise?
Yes, and most organizations end up there. It is a legitimate answer rather than an indecisive one, on two conditions: somebody owns the seam between the two systems, and that seam is budgeted. The usual failure is not the architecture — it is that keeping the old tool alive alongside the new one was nobody’s line item.
What should I ask a vendor before signing?
Four things, in writing. Where the data physically resides and under whose law. Who can be legally compelled to hand it over. What it costs to move the data out, including egress. And whether retention can differ by data type, because if there is only one slider, your noisiest data sets the price and the exposure for everything else.
What I take from this
The reason this question keeps getting framed as cloud versus on-premise is that framing it that way is comfortable. It turns a political problem into a technical one, and technical problems have the pleasant property of being solvable by people like us.
But the decision is about where your data may live, who may look at it, and what you are allowed to do once you see something wrong. Two of those three are outside engineering entirely.
Which is why the most useful thing you can do this week is not build a comparison matrix. It is find out which of your data is legally pinned in place, and who in your organization gets to say so. That single answer will collapse most of the debate — and it costs a meeting, not a project. 🌎
May the systems be with you. ✦
Featured image generated with artificial intelligence.
Ethel Méndez
Senior Product Manager in B2B observability and networking, with 20 years of field work, NOC and managed services across Latin America. I write what I learned running real systems, not what I read in a course.