An architecture decision guide for SaaS companies comparing managed platforms, containers, serverless services and infrastructure control.
The decision changes as you grow
There is no single right answer, because the correct hosting choice for a five-person SaaS with forty customers is genuinely wrong for the same company at 400 customers — and vice versa.
| Stage | Priority | Usually right |
|---|---|---|
| Pre-revenue to early | Ship fast, minimal ops | Platform-as-a-service (Vercel, Render, Fly.io, Railway, App Platform) |
| Growing, first enterprise customers | Compliance, control, predictable cost | Managed services on a major cloud (AWS/Azure/GCP) |
| Scaled | Cost efficiency, multi-region, custom | Major cloud with real platform engineering |
The mistake in both directions: startups building Kubernetes before product-market fit, and scaling companies still on a PaaS whose bill has quietly become larger than the equivalent infrastructure plus an engineer.
Realistic option comparison
| Option | Monthly cost, early | Ops burden | Ceiling |
|---|---|---|---|
| PaaS (Vercel, Render, Fly, Railway) | $20–500 | Minimal | Cost efficiency at scale; less control |
| VPS (Hetzner, DigitalOcean, Linode) | $20–200 | Moderate — you patch it | Very cost-effective; more manual |
| Major cloud, managed services | $100–1,000+ | Moderate | Effectively none |
| Major cloud, containers/Kubernetes | $300–2,000+ | High | None, but needs real expertise |
Hetzner deserves a mention for European SaaS specifically: pricing is substantially below the hyperscalers for equivalent compute, and its German and Finnish locations answer EU data residency questions cleanly. It is a serious option that companies often overlook out of habit.
What actually forces the move to a major cloud
Rarely technical scale. Usually one of these:
- Enterprise procurement. Customers asking for SOC 2, ISO 27001, penetration test results, sub-processor lists and DPAs. Easier to satisfy on infrastructure with mature compliance tooling and existing attestations.
- Data residency commitments. Selling into EU, UK and GCC markets simultaneously with contractual residency terms.
- Availability commitments. Once you sign 99.9%+ SLAs with financial penalties, you need multi-AZ architecture and the operational maturity to match.
- A specific managed service you would rather not run — managed Postgres with point-in-time recovery, a message queue, or a search cluster.
If none of those apply yet, staying simple is usually correct and cheaper.
Cost control, before it becomes a problem
Cloud bills grow quietly. Three habits prevent most unpleasant surprises:
- Tag everything by environment and customer from day one. Retrofitting cost attribution is painful, and without it you cannot answer "what does this customer cost us to serve" — which becomes a pricing problem later.
- Set billing alerts at multiples of expected spend, not just a single ceiling.
- Watch egress. Data transfer out is the charge that surprises SaaS companies most, particularly with media or large API responses.
Reserved capacity and savings plans are worth it once your baseline is stable — typically meaningful savings for a one-year commitment. Do not commit before your architecture has settled.
Multi-tenancy affects hosting more than hosting affects multi-tenancy
Decide your isolation model early, because it drives infrastructure cost and compliance posture:
| Model | Cost | Isolation | Suits |
|---|---|---|---|
| Shared database, tenant column | Lowest | Logical only | SMB SaaS, high tenant count |
| Schema or database per tenant | Medium | Strong | Mid-market, compliance-sensitive |
| Full stack per tenant | Highest | Complete | Enterprise, regulated, few large customers |
Enterprise buyers in regulated sectors increasingly ask about this directly. Having a defensible answer matters commercially, not just architecturally.
Frequently asked questions
Do we need Kubernetes?
Almost certainly not early. It solves problems most growing SaaS companies do not yet have, and it costs engineering time you need elsewhere. Adopt it when orchestration complexity genuinely exceeds what simpler tooling handles.
Is a hyperscaler needed to pass a security review?
No, but it lowers friction — enterprise reviewers recognise the compliance artefacts. On smaller providers you carry more of the evidence burden yourself.
How do we handle EU data residency?
Choose EU regions explicitly for compute, storage, backups and logs — the last two are where residency claims usually fall apart. See our guide on data residency considerations for the wider pattern.