SaaS vs On-Premise Custody: How to Choose
SaaS and on-premise custody can run the same security architecture; what they divide is ownership. In a SaaS deployment the provider runs the infrastructure and the institution is operational in days. In an on-premise deployment the institution runs everything inside its own perimeter, with full ownership of wallets, keys and data. Choosing between them is not a security ranking exercise: it is a question of sovereignty, cost shape, and what your team is staffed to run.
What is the difference between SaaS and on-premise custody?
SaaS custody is a managed deployment: nothing to install, infrastructure operated by the provider, the institution operational from day one through the web portal, mobile app and API. On-premise custody is the same platform deployed entirely within the institution's own infrastructure: keys, wallets, transaction data and metadata all stay inside the institution's perimeter, on servers and hardware it controls, integrated with its own identity, monitoring and security tooling.
Is on-premise custody more secure than SaaS?
Not inherently, and this is the most common misconception in the choice. When custody is built so that signing keys are split into shares and no single party, including the provider, can move funds alone, that guarantee holds in both deployments: the architecture, not the location, is what protects the assets. What on-premise adds is sovereignty rather than a higher security tier: full data residency, zero dependency on external providers for operations, and infrastructure that answers to your policies alone. If a provider tells you its SaaS is secure but its on-premise is more secure, ask which guarantee, exactly, changes between the two.
How do the costs compare?
The two models have different cost shapes, not just different totals:
| Configuration | Shape of the cost | What that means |
|---|---|---|
| SaaS | Fixed monthly subscription | One predictable amount finance can budget years ahead |
| Hybrid | Subscription plus your infrastructure | A managed core, with the components you choose to own |
| On-premise | Capital and headcount | Your hardware, your data centre, and a team to run it |
SaaS turns custody into an operating expense with no capital outlay. On-premise trades the subscription for infrastructure investment and an in-house operations team, which makes sense exactly when control of that infrastructure is the point.
When is SaaS the right choice?
When speed and focus matter more than owning the infrastructure. A SaaS deployment suits institutions that want to be operational quickly, don't have (or don't want to build) a custody operations team, and prefer a fixed, predictable cost. It is also the natural starting point when digital assets are a new business line and the priority is proving the operation before committing capital to it.
When is on-premise the right choice?
When sovereignty is a requirement rather than a preference. On-premise suits institutions with a mandate for full in-house control: data residency obligations that require keys and records to stay in a specific jurisdiction, internal policies that rule out external operational dependencies, regulators or boards that expect infrastructure inside the institution's own perimeter, and a technical team ready to run it. For these institutions, on-premise is not a premium tier; it is the deployment that matches how the rest of their critical infrastructure already works.
Do you have to choose once and forever?
No, and this is the question most evaluations forget to ask. An institution can start on SaaS, be operational in days, and move to its own on-premise infrastructure later as volumes, requirements or mandates grow, with the same security architecture at every stage and no rebuild from scratch. The practical way to de-risk the decision is to test it: The Vault runs a complimentary two-week pilot in a sandbox configured for your business, where your team walks through its real workflows before committing to anything.
If you're weighing SaaS against on-premise for your own deployment, contact us. We're happy to answer your questions and book a demo for you.
Frequently asked questions
Who holds the keys in SaaS custody?
In a share-based architecture, no one holds "the keys" in full, in either deployment: the signing key exists only as separate shares, and no single party, including the provider, can move funds alone. The deployment choice changes who runs the infrastructure, not who can act unilaterally.
Does on-premise custody mean air-gapped custody?
Not by default. On-premise means the infrastructure runs inside your perimeter; an air-gapped cold tier for reserves is a further configuration choice within it, suited to holdings that move rarely.
What team does on-premise custody require?
The same disciplines that run your other critical infrastructure: systems operations, security monitoring, and incident response, with custody-specific training. Institutions without that team today typically start on SaaS and build toward on-premise.
Can we migrate from SaaS to on-premise later?
Yes. When both deployments run the same platform and architecture, migration is a planned transition rather than a rebuild, and policies, wallets and audit history carry over.
Which deployment do regulators prefer?
Regulators assess controls, evidence and accountability rather than deployment models as such. What matters is demonstrable governance: policy enforcement, audit trails and key protection, which a well-built platform provides in both.