Own Your Stack:
An Operator's Manifesto for 2026

Owning your stack does not mean self-hosting everything. It means deciding layer by layer which parts of your operation you could survive having repriced, throttled or switched off by somebody else, then owning only the parts you could not.

Slack shows why. Since 29 May 2025 a newly installed Slack app distributed outside the Marketplace may read a channel's history at 15 messages a minute (Slack changelog). An internal app your team builds keeps Tier 3 limits of 50+ requests a minute at up to 999 messages each (Slack conversations.history reference). That is a nominal 49,950 messages a minute by our arithmetic. The lower limit sits on a changelog page, not in any contract you signed.

The framework below covers four layers and four tests, then points to the deeper posts that do the detailed arithmetic. Two playbooks cover the neighbouring decisions: the SaaS replacement playbook on build-versus-buy cost and the Ops Automation Playbook on which workflows to automate first.

By Dan Colta. NodeSparks is a two-person EU automation studio, run by Dan Colta and Constantin Bivol, building owned automations for SME teams in two lanes: replacing SaaS subscriptions and automating daily ops. This page is the framework underneath both.

Key Takeaways

• Ownership is four decisions: data, workflow logic, identity and runtime, each tested on exit cost, kill-switch exposure, change frequency and who maintains it.
• The EU Data Act has applied since 12 September 2025 and removes switching charges, including charges for data egress, from 12 January 2027 (European Commission). It guarantees an export, not a working replacement.
• A newly installed Slack app distributed outside the Marketplace may read 15 messages of history a minute (Slack Developer Docs). An internal app you build has a nominal Tier 3 rate of 49,950, by our arithmetic.
• Self-hosted is not the same as owned. Impacted Atlassian Data Center products go read-only on 28 March 2029 (Atlassian).
• Owning has a bill. 31% of breaches start with vulnerability exploitation (Verizon 2026 DBIR) and only 14.04% of small EU enterprises employed ICT specialists in 2024 (Eurostat). Rent the commodity layers and anything nobody on staff can patch.

What does it mean to own your stack?

It means holding the controls on four layers: your data, the workflow logic that moves it, the identity that lets people in and the runtime it executes on. Renting any of them is normal. In 2025, 52.7% of EU enterprises paid for cloud computing services (Eurostat, 3 February 2026). Owning means choosing which rentals you could survive losing.

A single tool usually touches several layers at once. A CRM holds your customer records, encodes your sales process as pipeline rules, logs people in through your identity provider and runs on its vendor's servers. You can own some of those while renting the rest.

• Data. Customers, invoices, messages, documents and the history behind them. Every other layer can be rebuilt from it.
• Workflow logic. Routing, approvals and the edge case somebody explained once in a meeting, living in a vendor's settings, a no-code flow or a code repository.
• Identity. The domain, the mail tenant, single sign-on and the admin accounts that decide whether anyone can log in.
• Runtime and infrastructure. Where the code executes, on whose hardware and under which licence.

Which four tests decide what you should own?

Four questions settle each layer: what leaving costs, who can switch it off, how often it changes and who will maintain it. Only the first has an EU legal date. From 12 January 2027 cloud providers can no longer charge switching fees, including data egress, when you move to another provider (European Commission).

Exit cost

What would leaving cost in money, staff time and lost function? Data now has an EU floor. Workflow logic has none, because rules and edge cases get rebuilt rather than exported. A high exit cost is leverage the vendor holds at every renewal.

Kill-switch exposure

Who can switch the layer off, throttle it or reprice it without asking you? That includes the vendor's fraud systems, its API policy and whoever acquires it next. The test asks whether you would have a way back that does not run through the same vendor.

Change frequency

How often does the layer change because your business did? Workflow logic moves whenever a price, a team or a customer segment does, while email barely moves. Frequent change is where a rented roadmap hurts most.

Who maintains it

Can someone on your side patch it, restore it and explain it to the next person? Only 14.04% of small EU enterprises employed ICT specialists in 2024 (Eurostat). A layer nobody can maintain is one you should not own, however well it scores elsewhere.

Maintaining is not the same as employing. Logic an outside builder writes stays yours when the repository sits in your company's own account, a runbook explains it and a second person has restored it once, the same mitigations the bus-factor section below lists.

Run all four tests against each layer and a pattern appears. Each row below is anchored in dated primary facts.

Each dated fact links its primary source. The scoring in the first four columns is our judgement.

Read the table as a sorting device. A layer with high exit cost and kill-switch exposure that changes often is a candidate to own, provided the maintenance column has a name in it. For most small teams the sort lands on owning the workflow logic and a copy of the data, holding the domain and renting nearly everything else.

Why is the data layer the one everything is rebuilt from?

Every other layer can be rebuilt from it. Most firms that buy cloud already keep it with a vendor: 71.53% of EU enterprises buying cloud in 2025 used it for file storage (Eurostat). Since 12 September 2025 the EU Data Act requires providers to export that data in a machine-readable format. It does not make the export run elsewhere.

Providers must also make open interfaces available. During a transition from 11 January 2024 to 12 January 2027 they may still charge customers the costs they incur for switching and data egress. From 12 January 2027 switching charges, including charges for data egress, are removed entirely (European Commission, page updated 15 December 2025).

That settles the invoice for leaving, not the speed. Most operators reach their data through integrations that run on rate limits the vendor sets. Slack's May 2025 change is the cleanest published example.

At 15 messages a minute an unlisted app needs about 111 hours to read a 100,000-message channel. At the nominal Tier 3 rate an internal app needs about 2 minutes (our arithmetic). That is an exit cost paid in time rather than euros. If your team already runs its operations in Slack, Slack as an ops dashboard covers replacing three SaaS subscriptions with it.

Owning the data layer rarely means hosting the database yourself. It means three habits:

1. A scheduled export of every system holding records you would need to rebuild, landing in storage your company controls.
2. A format you can read without the vendor, such as CSV, JSON, a SQL dump or Markdown.
3. A note with each export explaining the fields. A schema nobody understands is an export in name only.

Documents and wikis are the hardest case, because their structure lives inside the vendor's block model. Self-hosted Notion alternatives covers when to switch and when to build your own.

Why should the workflow logic be yours?

Because it changes most often and no export carries it out. Data leaves as a file. The rules that route it leave only if you can read them. Among EU enterprises buying cloud in 2025, 30.12% used it for ERP and 27.91% for CRM (Eurostat), two tools where business rules usually live.

Two firms can run the same accounting package on the same cloud with completely different approval thresholds, routing rules and exceptions for their biggest customer. That logic is where a business differs from its competitors. Inside a SaaS product's settings screens, it leaves with you as screenshots and memory.

Code in a repository you hold is the most portable home for logic. A self-hosted flow tool sits in the middle, since flows export as files while somebody still has to run the tool. The trade-offs are in Zapier vs n8n vs Make vs custom code.

Is your identity layer rented without you noticing?

For most cloud buyers, yes: 85.15% of EU enterprises buying cloud in 2025 used it for email (Eurostat). The mail tenant and single sign-on decide whether anyone can log in to anything else. Microsoft's Entra error reference lists AADSTS5000224, NotAllowedTenantBlockedTenantFraud, with contacting Microsoft support as the only documented remedy (Microsoft Learn, updated 15 June 2026).

The reference publishes no frequency, only the route back. With the tenant blocked, the data still exists and the logic still runs, yet nobody can log in to reach either.

The registrar sits underneath even the tenant. Your domain anchors mail, password resets and often single sign-on. On 15 June 2023 Squarespace agreed to buy the assets of Google's Domains business, including approximately 10 million domains hosted on Google Domains (Squarespace Form 8-K, SEC EDGAR). The filing said customers would keep the option to make changes to their domains account at any time. Their default registrar still changed in a deal none of them was party to.

The full kill-switch case is in leaving Google Workspace as an EU company.

Owning identity is a modest job:

• The domain and its DNS in an account the company controls, with registrar lock on and at least two people able to log in.
• MX records you can repoint to another mail provider within the hour.
• One break-glass admin account that does not depend on the tenant it administers.
• An exported list of users, groups and connected apps.

The mailbox can stay rented. Email is a commodity, while the domain it answers to is not.

Is self-hosted software the same as owned software?

No. Self-hosting moves the runtime onto your server but leaves the licence with the vendor. Atlassian ended support for its self-hosted Server products on 15 February 2024, after which neither Atlassian nor Marketplace partners provide technical support, security updates or vulnerability fixes (Atlassian). Impacted Data Center products go read-only on 28 March 2029.

The servers kept running while the patch stream stopped. New customers have not been able to buy Atlassian Data Center subscriptions since 30 March 2026. When subscriptions expire on 28 March 2029 you can still read your data but cannot add anything new (Atlassian, retrieved 26 September 2026). Software on a subscription licence in your own rack is a rental with extra steps.

Licences move too

Open-source licences move as well. HashiCorp moved all future releases of its products from MPL 2.0 to the Business Source License v1.1 on 10 August 2023 (HashiCorp), while its APIs, SDKs and almost all other libraries stayed on MPL 2.0.

Starting with Redis 7.4, Redis left the three-clause BSD licence for a dual source-available licence, RSALv2 and SSPLv1 (Redis, 20 March 2024). The change was not retroactive. Hosting Redis for your own organisation's internal use remained permitted. Redis 8 then added the OSI-approved AGPLv3 (Redis, 1 May 2025), in an announcement that acknowledges AWS and Google now maintain a fork of their own.

A relicence hits companies reselling hosted software far harder than teams running it for themselves. Pinning a version, moving to a fork or relying on non-retroactive terms are all real exits if you plan them before you need them.

The rented server underneath

The infrastructure underneath is usually rented as well. Hetzner raised its CX23 cloud server in Germany and Finland from EUR 3.99 to EUR 5.49 a month, excluding VAT (Hetzner Docs). The new price applies to new orders and rescales from 15 June 2026. That is a 37.6% increase by our arithmetic, set on a date you did not choose. Orders placed before that date keep the old price.

Our own example

We self-host Postiz, the open-source social media scheduler, on a Hetzner CX23 server in the EU. It has been live since 27 August 2026, posting to LinkedIn, Instagram and YouTube. Reddit is not connected, because Reddit stopped issuing self-service API keys in November 2025.

We hold the runtime and the scheduling logic. We rent the server, whose list price changed about ten weeks before our box went live. We also rent every platform connection, the layer that decided where we could post. The per-platform access map is in the self-hosted social media scheduler comparison.

What does owning your stack actually cost you?

Mostly time and risk rather than invoices. The server can be a Hetzner CX23 at EUR 5.49 a month excluding VAT (Hetzner Docs). The patch clock costs more: Verizon's 2026 Data Breach Investigations Report finds 31% of breaches now start with vulnerability exploitation, ahead of stolen credentials (Verizon, 19 May 2026).

Every server you own puts you on that clock. A staffing problem and a bus factor come on top.

The patch clock

Verizon adds that AI is shrinking the window for defence from months to mere hours. The incidents in the 2026 edition took place between 1 November 2024 and 31 October 2025 (Verizon DBIR).

A SaaS vendor absorbs that clock for the layers it runs. An owner takes it on directly, including for code nobody on the team wrote. In March 2024 malicious code was found in the upstream release tarballs of xz, a compression library shipped in Linux distributions. It scored CVSS 10.0, Critical (NIST National Vulnerability Database, published 29 March 2024). Finding out whether you ran an affected build is an owner's job.

The staffing problem

Eurostat reports that 14.04% of small EU enterprises employed ICT specialists in 2024, against 78.44% of large ones and 20.05% of all enterprises (Eurostat). By our arithmetic about 86% of small enterprises had none.

The bus factor

A peer-reviewed ICPC 2016 study estimated the truck factor, the minimum number of developers who would have to leave before a project is incapacitated, for 133 popular GitHub projects. Of those, 65% had a truck factor of 2 or less (Avelino, Passos, Hora and Valente, arXiv, 2016).

That exposure applies to what a two-person studio like ours builds and to many of the open-source projects small teams self-host. The mitigations are unglamorous: code in a repository the owner holds, a runbook for someone who was not there and a second person who has restored the thing at least once.

What has changed under rented stacks since 2023?

Eleven dated changes across three layers, starting with a June 2023 deal covering about 10 million domains (Squarespace 8-K) and running to Atlassian Data Center going read-only in March 2029. Most arrived as a blog post, a changelog entry or a price table rather than a contract amendment.

The layer column is our classification.

Where renting still wins

Renting wins on the commodity layers and on any layer nobody on your staff can patch. Among EU enterprises buying cloud in 2025, 85.15% used it for email, 71.69% for office software and 71.53% for file storage, against 30.12% for ERP and 27.91% for CRM (Eurostat). That split is roughly where the line belongs.

Size matters too. In 2025, 49.3% of small EU businesses paid for cloud services, against 66.78% of medium and 84.67% of large enterprises (Eurostat).

About half of small EU firms rent cloud services, while about one in seven employs anyone who could run an owned stack.

Renting is not a security exemption either. The same Verizon report finds that 48% of breaches involved a third party, a share Verizon says is up 60% (Verizon, 19 May 2026). That counts third-party involvement in some capacity rather than breaches caused by SaaS. It also overlaps with the 31% starting from vulnerability exploitation. The two figures are not additive.

Renting wins in four situations:

• The layer is a commodity. Email, office software and file storage work the same in every company. Own the domain and the export, then rent the service.
• Nobody on staff can maintain it. A self-hosted tool nobody patches is a liability with a login page.
• The workflow is still changing shape. Rent while you learn the process, then own it once the rules settle.
• The owned version costs more to run than the rent. Self-hosted AI inference at low volume is the clearest case, covered below.

Where to go deeper, layer by layer

Each post below takes one layer and does the arithmetic this page only sketches. The self-hosted AI analysis, for instance, finds that an owned inference box beats a frontier API only above 13.8 million output tokens a month, its own arithmetic on published prices. Start with the layer that worries you most.

Runtime: self-hosted AI

Self-hosted AI: the payback period turns the runtime test into a volume threshold that owning may never reach against a cheap serverless open-weight API.

Runtime and logic: unattended agents

AI agent security: the model refusing is not a boundary argues that model-layer defence is a probability while an operating-system sandbox is a boundary, one you configure yourself when you own the runtime.

Data: documents and wikis

Self-hosted Notion alternatives applies the exit-cost test to the tool where many small teams keep their written knowledge.

Identity: mail and the tenant

Leaving Google Workspace as an EU company applies the kill-switch test to the mail and identity stack, down to a setup with no US SaaS in it.

Coming next

Later posts will cover running self-hosted n8n in production, the numbers on building an internal tool against buying seats, cloud repatriation for small teams and first-party cost data from a year of owned builds.

FAQ

Six short answers on ownership, the Data Act, self-hosting, identity, costs and renting.

The bottom line

Own the layers that decide how you leave and rent the ones you would happily swap. The EU has dated the end of switching fees, data egress included, to 12 January 2027. No regulation caps the cost of rebuilding logic you never held or a login you never controlled.

Six principles come out of the framework:

1. Hold the domain and a break-glass admin path first. It is the cheapest layer to own and the one every other layer depends on.
2. Keep an independent copy of your data in a format you can read without the vendor, with a note on what the fields mean.
3. Own the workflow logic that changes most often, in code or files someone on your side can read, in a repository your company holds.
4. Check the licence of the next version before you build on the current one.
5. Rent the commodity layers: email, office software and file storage.
6. Never own a layer nobody on your side can patch.

That is the line NodeSparks builds to: owned workflow logic and data plumbing for SME teams, on top of commodity layers they should keep renting. If your next question is what a replacement costs, the SaaS replacement playbook has the method. If it is where to start, the Ops Automation Playbook ranks the workflows worth owning first.

Sources (retrieved 2026-09-26):

• European Commission, Data Act explained: https://digital-strategy.ec.europa.eu/en/policies/data-act-explained
• Slack Developer Docs, Rate limit changes for non-Marketplace apps: https://docs.slack.dev/changelog/2025/05/29/rate-limit-changes-for-non-marketplace-apps/
• Slack Developer Docs, conversations.history method reference: https://docs.slack.dev/reference/methods/conversations.history
• Microsoft Learn, Microsoft Entra authentication and authorization error codes: https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes
• Squarespace, Form 8-K Exhibit 99.1 on the Google Domains assets (SEC EDGAR): https://www.sec.gov/Archives/edgar/data/1496963/000149696323000042/sqsp-06152023x8kexhibit991.htm
• Atlassian, Migrate Now: Server support ends on Feb. 15: https://www.atlassian.com/blog/announcements/server-support-30-day-countdown
• Atlassian, Data Center End of Life: https://www.atlassian.com/licensing/data-center-end-of-life
• HashiCorp, HashiCorp adopts Business Source License: https://www.hashicorp.com/en/blog/hashicorp-adopts-business-source-license
• Redis, Redis Adopts Dual Source-Available Licensing: https://redis.io/blog/redis-adopts-dual-source-available-licensing/
• Redis, Redis is now available under the AGPLv3 open source license: https://redis.io/blog/agplv3/
• Hetzner Docs, Price adjustment: https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/
• Verizon, 2026 Data Breach Investigations Report news release: https://www.verizon.com/about/news/breach-industry-wide-dbir-finds
• Verizon, 2026 Data Breach Investigations Report: https://www.verizon.com/business/resources/reports/dbir/
• NIST National Vulnerability Database, CVE-2024-3094: https://nvd.nist.gov/vuln/detail/CVE-2024-3094
• Avelino, Passos, Hora and Valente, A Novel Approach for Estimating Truck Factors (ICPC 2016): https://arxiv.org/abs/1604.06766
• Eurostat, ICT specialists: statistics on hard-to-fill vacancies in enterprises: https://ec.europa.eu/eurostat/statistics-explained/index.php?title=ICT_specialists_-_statistics_on_hard-to-fill_vacancies_in_enterprises
• Eurostat, 53% EU enterprises used paid cloud services in 2025: https://ec.europa.eu/eurostat/web/products-eurostat-news/w/ddn-20260203-1
• Eurostat, Cloud computing: statistics on the use by enterprises: https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Cloud_computing_-_statistics_on_the_use_by_enterprises