Customer-hosted vs cloud-based 401(k) software.
What separates vendor-hosted SaaS, customer-hosted cloud and on-premise deployment for 401(k) administration software, and how a TPA should decide.
Three hosting models
| Model | Who runs the infrastructure | Where data lives |
|---|---|---|
| Vendor-hosted cloud (SaaS) | The software vendor | The vendor's cloud environment, often shared across customers |
| Customer-hosted cloud | The customer, in its own cloud account, with vendor support | The customer's cloud account, in a region it chooses |
| On-premise | The customer, in its own data center or servers | The customer's facilities |
'Cloud-based' usually means vendor-hosted SaaS. Customer-hosted software can also run in the cloud; the difference is whose account and whose controls.
The trade-offs
| Vendor-hosted SaaS | Customer-hosted | |
|---|---|---|
| Time to start | Fast | Slower: environment set-up and agreements |
| Infrastructure work | Vendor's | Customer's, shared by written agreement |
| Control over data location and access | Limited to vendor options | High |
| Updates | Vendor's schedule | Customer approves and schedules |
| Security evidence | Vendor's audit reports, if any | Customer's controls plus the vendor's application practices |
| Exit | Depends on vendor export | Data already in your environment |
Write down who does what
Neither model is secure or compliant by itself. What matters is that each control has a named owner, is tested and has evidence. For customer-hosted software, put the split in writing: infrastructure, identity and access, encryption keys, backups and restore tests, updates, support access, monitoring and incident response.
The DOL's cybersecurity guidance for plan sponsors and service providers lists practices worth mapping to each row. Our customer-hosted page shows a starting table.
Questions to ask any vendor
- Where exactly will participant data be stored, and in which country and region?
- Who at the vendor can access production data, how is it approved, and is it logged?
- Which security reports or attestations exist, with what scope and date?
- How are backups taken and restore-tested, and what are the recovery objectives?
- How are updates delivered and approved?
- How do we export all of our data if we leave?
Readiness checklist for customer-hosted software
- A cloud account (for example AWS) or servers dedicated to the deployment, in the region where data must stay.
- Named owners for infrastructure, identity and access, backups, monitoring and incident response.
- Network rules that limit who can reach the application and the database.
- Encryption at rest and in transit, with a decision on who controls the encryption keys.
- Backups with a tested restore, and agreed recovery time and recovery point objectives.
- A patching and release window, with acceptance testing before each update.
- A process to approve, time-limit and log any vendor support access.
A quick way to decide
| If this describes you | Lean toward |
|---|---|
| You want to start quickly and have little IT capacity | Vendor-hosted SaaS, after reviewing the vendor's security evidence |
| Clients or your own policy require data in your own account or region | Customer-hosted cloud |
| You already run secure infrastructure and want full physical control | On-premise |
| You want to own your data and exit path without running a data center | Customer-hosted cloud |
KinetiPlan's model
KinetiPlan is customer-hosted: production deployments run in the customer's own AWS account in a US region of its choice, or on-premise, with responsibilities agreed in writing. KinetiPlan follows SOC 2-aligned practices; it has no SOC 2 report or other certification. See security and US hosting.
References
- U.S. Department of Labor, EBSA: cybersecurity guidance for plan sponsors, service providers and participants
- IRS: 401(k) plan overview
General information for plan professionals, not legal, tax or ERISA advice. Plan documents, elections and later IRS or DOL guidance can change how a rule applies to a specific plan. Dollar figures are for the years stated; check the current year before relying on them.
Common questions
Is customer-hosted software more secure than SaaS?
Not automatically. Security depends on how controls are owned, operated and evidenced. Customer-hosted gives the TPA more control over data location and access, and more responsibility.
Can customer-hosted software run in the cloud?
Yes. Customer-hosted means the software runs in infrastructure the customer controls, which can be its own cloud account, such as AWS, or on-premise servers.
What does a TPA need to run customer-hosted 401(k) software?
An infrastructure owner, a cloud account or servers in the required region, encryption and backup decisions, a patching window and a written split of responsibilities with the vendor.
Related articles and tools
See how KinetiPlan turns these rules into daily work.
A 15-minute live demo of the pilot build on the workflow you choose, with synthetic data.