Managed VICIdial hosting vs self-hosting: a decision framework, not a vendor ranking

Choose the operating model that can prove your controls

Fast answer: choose managed hosting when its contract and evidence cover the operational controls you cannot staff, and self-host when you can reliably own patching, telephony, observability, recovery and security. Neither label proves quality by itself.

This is a decision framework, not a review or ranking. It assumes you have defined jurisdictions, call volumes, integrations, recording policy and recovery objectives; CRM means customer relationship management. It does not evaluate named providers or promise compliance.

This comparison assumes familiarity with VICIdial's own vocabulary, including Asterisk and carrier; the companion article “VICIdial terminology for complete beginners: users, phones, campaigns and leads” defines them for a first-time reader.

• Prerequisites: a workload outline, recovery targets and a named business owner for each control.
• Non-goal: this is not legal advice, a vendor ranking or a certification.
• Require evidence dated to the proposed service.

Map shared responsibility down to the call path

Ask who owns OS patching, VICIdial/Asterisk changes, certificates, PJSIP/provider configuration, firewall rules, database care, recordings, access review, monitoring and incident response. “Fully managed” is incomplete until each item has an owner and escalation time.

For self-hosting, name people and coverage windows rather than an organization label. For managed service, ask whether you retain exports, configuration backup, audit access and a safe exit path. Complete this worksheet from contract language; an unassigned row is a stop condition.

• Request the change-management and emergency-change process.
• Confirm least-privilege administrative access.
• Document data processors and support access boundaries.

control = certificate renewalmanaged_owner = [name or role]self_hosted_owner = [name or role]evidence_to_request = [dated test or document]escalation_time = [duration]

Ask for testable evidence, not assurances

A credible candidate can describe backup scope, restore testing, RTO/RPO measurement, monitoring, patch cadence, vulnerability response, logging/redaction, region and subprocessor boundaries. Ask what was tested, when, under which assumptions, and what was not tested.

Distinguish source-present, configured, enabled and functionally-verified evidence. For example, a backup policy is source evidence; an encrypted job configured is not a successful restore; a recent scoped restore drill is functional evidence.

• Request redacted operating-procedure and drill summaries.
• Verify SLA exclusions and maintenance windows.
• Avoid sending credentials or customer data during evaluation.

Compare total operating cost and risk

Compare more than monthly compute: include engineering coverage, on-call burden, audits, backups, egress, monitoring, carrier management, downtime exposure and migration effort. A low advertised fee can omit the control you most need.

Use the same workload and retention assumptions for each option. Treat quotes as dated inputs and include a contingency for growth, security remediation and a provider exit. This worksheet is a comparison template, not a price claim; leave a cost blank until a dated quote supplies it.

• Create a one-year and two-year scenario.
• Price recordings and restores explicitly.
• Record every assumption next to the quote.

option = [managed or self-hosted]compute_and_storage = [dated quote]on_call_coverage = [included or separate]restore_drill_evidence = [date or missing]exit_assistance = [contract term]open_risks = [list]

Make reversibility a selection criterion

Before signing, prove that you can export configuration and data in a usable format, obtain recordings under your authorization model, revoke access, and restore elsewhere. Run a bounded migration rehearsal using synthetic data if possible.

Stop if a candidate cannot identify backup ownership, recovery testing, administrator access controls, data location, breach notification path or termination procedure. The independent verification is a contractual review plus a scoped exercise, not a sales presentation.

• Set acceptance criteria in the agreement.
• Keep an offline contact/escalation roster.
• Review the model after the first incident or restore drill.