Self-hosting an open-source ATS costs a one-person desk about $2,313 over three years. Infrastructure is $288 of that. Your own time is $1,980.
At that number it beats every mid-market ATS inside the first seat, and it does not beat a $15 per user plan until you are running about four seats. The second half of that sentence is the opposite of what this category usually tells you, and it is the seat count no published model covers. Data as of August 2026.
The best model on this subject is Reqcore's three-year comparison of SaaS against self-hosted open source, and it is careful work: a four-part taxonomy of hidden costs, fourteen platforms priced with footnotes on the plan traps, three hosting options costed line by line, and a formula you can run yourself. Two lines are missing from it, and from every other model in this territory. The first is what happens when the project you depend on stops shipping releases. The second is what your own hour is actually worth.
The rate that decides the answer
Reqcore prices staff maintenance at half an hour a month at $50 an hour, and its worked example lands at $1,321 over three years against $32,500 for SaaS. Read the comparison carefully: that $32,500 is a ten-recruiter team growing to fifteen, not a solo desk, and only the self-hosted side of it is flat with headcount. Run the self-hosted assumptions on their own and you get $1,258, so the model reproduces cleanly. The number is not the problem.
The problem is that $50 an hour is a salaried-staff rate, and the person self-hosting an ATS on a one or two person desk is usually the biller. Glozo's US recruitment industry salary report puts the median for the profession at $72,800, which loads to roughly $45 an hour across a full working year once employer taxes and benefits are added. That is the floor, not the ceiling. Every hour you spend on an upgrade is an hour not spent on a search that would have carried a fee, so on a billing desk the real number is a multiple of it.
Notice how convenient the rate is in each direction. Reqcore uses $50 an hour and half an hour a month to show that self-hosting maintenance is close to free, which supports self-hosting. Execue's 2026 agency cost analysis uses $40 an hour to show that automatable work costs a five-person agency $250,000 a year, which supports consolidating onto its platform. One rate, opposite conclusions, each convenient for the party publishing it.
Glozo's market data is built on 10M+ job market signals processed monthly, sourced from 30+ public and partner data signals.
What OpenCATS did between April 2024 and June 2026
This is the line nobody prices, and it is measurable at the source.
OpenCATS publishes every release on its own repository. Version 0.9.7.4 shipped on 23 April 2024. The next release, 0.10.0, shipped on 23 June 2026. That is twenty-six months with nothing to install. The two gaps before it were thirteen months and twenty-one months. The 0.9.7.4 notes describe it as a "maintenance release whilst the php8.2 compatible version is being worked."
What arrived in June 2026 is the part that matters. Reading the 0.10.0 changelog, that release moved password storage to password_hash() with a legacy MD5 migration, added CSRF protection for state-changing requests (the changelog labels it "high risk"), added baseline security headers, hardened output escaping against XSS, added missing authorization checks to AJAX endpoints and module actions, stopped exposing the database password to the client during upgrade, and migrated tables from MyISAM to InnoDB.
Read that list as a description of the previous state. A recruiter who self-hosted OpenCATS at any point before June 2026 was holding their candidate and client data behind MD5-hashed passwords, on an application with no CSRF protection on state-changing requests, for twenty-six months, because there was no release to install.
Then 0.11.0 arrived on 27 August 2026 with PHP 8.4 and 8.5 support, CAPTCHA on public applications and further access-control checks. Two releases in ten weeks after two years of silence.
The honest reading of that, which is not "avoid open source"
OpenCATS is not abandoned. It has been substantially modernized in the last ten weeks, and the current release is better maintained than at any point in its recent history. Our OpenCATS review covers what the product does and what it costs to run, and that base hosting arithmetic still holds.
The point is narrower and it is about variance, not quality. A project carrying one long-standing maintainer plus, in this case, one contributor account that landed most of the roughly eighty merged pull requests in a single release, has a release cadence that can go to zero for two years without anybody deciding it should. Your security posture is downstream of whether that person is available. That is a cost line with a wide distribution, and no model in this market puts a number on it.
Price it as what it actually is, in the two currencies the rest of this model uses. Upgrade events you cannot schedule, at roughly six hours each, which is the line in the table below. And stretches where the honest answer to "is this patched" is no, which costs nothing until it costs everything.
The three-year number at one seat
Everything below assumes Railway's Hobby plan (the $5 monthly minimum plus a small overage), a domain, your own labor at $45 an hour, Reqcore's own half hour a month of routine work, plus the two lines they leave out: two major version jumps at six hours each, and one hour a quarter spent verifying that a backup actually restores.
| Line | Three-year cost |
|---|---|
| Infrastructure (36 months) | $288 |
| Domain | $45 |
| Setup, 2 hours | $90 |
| Routine ops, 0.5 hours a month | $810 |
| Two major upgrade events, 6 hours each | $540 |
| Backup restore checks, 1 hour a quarter | $540 |
| Total | $2,313 |
Labor is $1,980 of that $2,313. Infrastructure is $288. Every argument about whether to self-host is an argument about the labor line, and the infrastructure figure that gets quoted is the smallest thing in the table.
Six hours for an upgrade is not padding. The 0.11.0 notes say the installer routes existing installations through required schema migrations before it will let the application run, that some of those operations take several minutes on a large database, and that anyone with a customized Career Portal template needs to review a location-template change. Going from a 2024 install to the current release is a project, not a docker compose pull.
Where it stops being cheaper
The self-hosted total does not move when you add a recruiter. Hosted per-seat pricing does. So the question is not whether self-hosting is cheaper, it is where the two lines cross.
Every price below was read off the vendor's own pricing page on 28 August 2026, at the annual rate each one publishes.
| Option | Published rate | 1 seat | 3 seats | 5 seats |
|---|---|---|---|---|
| Self-hosted, all in | no per-seat fee | $2,313 | $2,313 | $2,313 |
| Manatal Professional | $15 per user per month | $540 | $1,620 | $2,700 |
| Crelate Essentials (2 users max) | $85 per user per month | $3,060 | not available | not available |
| Crelate Business | $119 per user per month | $4,284 | $12,852 | $21,420 |
| Loxo Core | $149 per user per month | $5,364 | $16,092 | $26,820 |
| Loxo Professional | $199 per user per month | $7,164 | $21,492 | $35,820 |
Against the mid-market platforms, self-hosting wins before you finish the first seat. It pays back against Crelate Business at 0.54 seats and against Loxo Core at 0.43, which is another way of saying that one recruiter on Loxo Core spends more in the first eight months than self-hosting costs in three years.
Against the cheap tier it does not win for a long time. Manatal Professional at $15 a user costs less than self-hosting until about 4.3 seats. A solo recruiter who self-hosts to save money, and who would otherwise have bought the $15 tier, spends roughly four times as much over three years and does the maintenance personally.
That result never appears in the published models because they start at five recruiters and compare against a mid-tier platform. At that seat count and that comparison, self-hosting wins by 90 percent or more and the conclusion is correct. It is the small end where the arithmetic reverses, and the small end is most of this blog's readers.
Check these against the vendors before you trust them, including against us. Loxo repackaged into Core and Professional while this piece was being written, and its $149 entry carried a limited-time offer banner on the day it was read. Our Loxo pricing guide goes through that lineup tier by tier if you are weighing it seriously. Pricing in this category moves faster than the articles that quote it, which is why every figure above carries the date it was read and a link to the page it came from. Ours included.
For the wider picture of what open-source options exist and what each one is actually good at, our guide to open-source ATS tools is the place to start, and open-source recruiting CRM covers the CRM side.
The obligation that comes with the database
Reqcore's cost taxonomy lists compliance and audit readiness, data retention controls, GDPR and CCPA, as an indirect cost of SaaS. It does not carry that line into the self-hosted column, and self-hosting is where it gets heavier rather than lighter.
Running the database yourself makes you responsible for the retention schedule, for deletion requests arriving with a deadline, for who has access and how that is recorded, and for breach notification if something goes wrong. On a managed platform some of that is contractual and some of it is somebody else's operational problem. On your own server all of it is yours.
Note what the infrastructure tier actually buys, too. Railway's Hobby plan carries a 99.9% availability target, seven days of log history and community support. That is a reasonable deal at five dollars a month, and it is worth knowing that your system of record sits on community support before a client asks where their candidate data lives. Railway does hold SOC 2 and offers a data processing agreement, so the compliance path exists. Somebody has to walk it, and on a solo desk that somebody is you.
There is no honest dollar figure to put on this line. There is a real number of hours, and it is not zero.
When self-hosting is the right call anyway
Cost is one input. Three reasons to self-host survive this arithmetic intact.
You want the data in a database you control, exportable in full, with no vendor able to make leaving expensive. You need customization that no hosted product will build for you. Or you are at four or more seats, where the per-seat line has grown past the labor line and the case makes itself.
What does not survive is self-hosting as a way for a one-person desk to save money against a cheap hosted plan. At that scale you are trading roughly $1,700 of your own time over three years for about $250 of licence savings, and the trade only makes sense if you wanted the control for its own sake.
This is the same discipline we applied to Bullhorn's pricing: read the vendor's own published pages, run the arithmetic, and publish what it says rather than what the category expects.