Choose SaaS when you want low upkeep and fast updates and your code and metadata may leave your network. Choose self-hosted when data residency, air gaps or contract terms demand it and you can staff the upkeep. Many buyers land on a hybrid: a local agent or runner with a hosted control plane.
What actually leaves your network
Be specific, because "SaaS" covers different data flows. A scanner might upload source code, only manifests and lockfiles, only a list of package names and versions, or only a generated SBOM. The risk differs enormously between those. Ask for a data flow diagram and a list of fields stored, with retention periods.
Metadata is not harmless. A full dependency list reveals your technology choices, and findings reveal where you are weak. Treat both as sensitive.
Comparing the two models
- Upkeep. SaaS: the vendor patches and scales. Self-hosted: your team patches the scanner, its database and its host, and a stale scanner is a security risk itself.
- Data freshness. SaaS usually updates advisory data centrally. Self-hosted needs an update path, which may be hard in an air gap.
- Speed. Self-hosted can be faster for large repositories on a local network. SaaS may add upload time.
- Control. Self-hosted gives you network isolation and custom retention. SaaS gives you what the contract and settings allow.
- Evidence. For audits, a hosted system may offer built-in reports. Self-hosted may need extra work.
- Cost shape. Self-hosting trades license spend for infrastructure and staff time. Count both.
Hybrid options
A common pattern is to scan inside your CI runners, send only metadata such as component lists to the hosted system, and keep source on your side. Another is a dedicated runner in your network that executes jobs and returns results. Ask whether the vendor supports these, and what exactly is transmitted.
Questions for the vendor
- What is sent, stored and retained, by data type?
- Where is data processed, and can the region be chosen?
- Is source code ever retained, and is it used to improve models?
- How do updates reach a self-hosted install, and can they work offline?
- What do you need to run it: hardware, databases, upgrade cadence?
- Can we move from one model to the other later without losing history?
When regulation decides for you
Some sectors and public bodies restrict where data may go. If your obligations say so, narrow the field first, then compare features. Do not choose a model on convenience and discover the restriction in procurement.
Where Safeguard fits: its SBOM and dependency scanning can be tried through the free scan, which works on public repositories, so you can judge the output without sending private code.
Quick check
Does self-hosted mean no data leaves?
Not automatically. Some self-hosted tools still call out for advisory updates or telemetry. Check network requirements.
Is SaaS less secure?
Not inherently. It shifts responsibility. Assess the vendor's controls, as you would any supplier.
Last reviewed: 19 October 2026.
