Hosting Dolibarr: in-house server or managed hosting, how to choose

What hosting changes for an ERP

Dolibarr is used every day: quotes, invoices, stock, payment reminders. If the instance goes down on a Monday morning, your business stops with it. Hosting therefore determines three things: availability, security and your ability to recover your data after an incident. There are two main options. The first is an in-house server, installed on your premises or on a machine you rent and administer yourself. The second is managed hosting, where a provider runs the server, the backups and the updates for you. Neither is better in itself. An SME with an IT person on staff and a decent technical room can run its own server very well. A ten-person company with no system skills will often end up with backups that were never tested. The criteria below help you decide based on your own situation, not on a preference of principle.

Backups: the question that settles it

Ask yourself one question: if the server disappears tonight, how long will it take you to restart, and with which data? A Dolibarr backup covers two elements: the database and the documents folder, which holds the PDFs and attachments. Backing up one without the other gives an inconsistent restore. The backup must also leave the machine: a copy on the same disk protects you from neither a hardware failure, nor a theft, nor ransomware. Finally, a backup that has never been restored is still only a hypothesis. In-house, all of this rests on you. With managed hosting, check what is actually provided and ask how a restore works.

• The database and the documents folder are backed up together, at a frequency that suits how much data you enter.
• A copy is kept off the server, ideally at another site.
• A test restore is carried out regularly on a separate environment.
• The retention period of the backups is known and written down.
• A named person is responsible for monitoring backup failures.

Updates and security patches

Dolibarr regularly publishes corrective versions, including on older branches, and vulnerabilities are fixed through these releases. A server that is no longer updated becomes a target. The issue is not only Dolibarr: there is also the operating system, the web server, PHP and the database. Each layer needs follow-up. In-house, someone must watch the announcements, test the update on a copy, then apply it with a backup taken just before. A managed host generally takes on this work, but check who decides the schedule, because your custom modules can break when the version changes. Our article on securing an instance in production details the settings to check in both cases.

Access, performance and availability

Think about who connects, and from where. A team that is entirely in the office can live with a local server. As soon as sales staff travel or people work remotely, you must either expose the instance on the Internet or use VPN access. Exposing an in-house server requires careful network configuration: certificate, firewall, restricted access to the administration. On availability, look at what happens in a power cut, an outage of the office Internet connection or a disk failure. A professional host has redundant power and connections, which a small technical room almost never offers. Also ask who monitors the service and who is alerted in case of an incident, day and night.

Data location and compliance

Your data contains customer records, contact details, contracts and invoices. Knowing where it is stored is not a detail. For companies in France, Belgium or Luxembourg, the question comes up under the GDPR (RGPD in French): hosting location, any subcontractors, data processing agreement. An in-house server settles the question of location, but not that of physical and logical protection. With managed hosting, ask for the country of the data centre, the identity of the operator and whether any subcontractors are located outside the European Union. Some customers, especially public or regulated ones, also impose contractual requirements on this point. It is better to know before you choose than to discover the constraint during a tender.

Responsibilities: who does what, in writing

The real cost of hosting shows in how responsibilities are split. In-house, everything falls to you: hardware, system, security, backups, monitoring, replacing a failed component. With managed hosting, the contract must state precisely what the provider handles and what stays on your side, for example managing user rights or approving an update. Also require reversibility: being able to retrieve your database and documents in a usable format if you change provider. Our Dolibarr hosting offer follows this approach, and our teams also provide maintenance for instances hosted elsewhere. In every case, name a responsible person on the company side, even if operations are outsourced.

• The contract lists what is included: system, backups, updates, monitoring.
• Response times in case of an incident are written down, not just mentioned.
• The exit procedure and data recovery are described.
• An internal contact is appointed to make decisions.

Deciding and preparing the next step

Build a simple table with your five criteria: backups, updates, access, location, responsibilities. For each one, note what you can really do in-house and what you would rather delegate. If three or more lines lean towards delegation, managed hosting will probably be more reliable for you. If you keep an in-house server, schedule a restore test now, along with the list of people to alert in case of an outage. Whichever you choose, it can be changed: moving from one mode to the other is a controlled operation when it is prepared. To compare your situation with a concrete setup, contact us and describe your number of users, your modules and your access constraints. We will tell you what we would do in your place.