Your own server or our cloud? How an IT services firm should decide

Most HR software gives you one answer to “where does our data live?”: their cloud, in a region they chose. For an IT services firm, that answer can clash with what your clients’ contracts say, and with what your own IT head is comfortable signing.

This post walks through how to decide. It’s general information, not legal advice; your lawyer and your clients’ contracts have the final word.

First, what’s actually in HR and payroll data

It’s more than names and salaries. In a services firm, the HR system usually holds:

• Your people’s personal data: PAN, bank accounts, identity documents, addresses, family and nominee details, tax declarations.
• Your clients’ names and project details, inside timesheets: which client, which project, which task, how many hours.
• Sign-in and activity logs that show who looked at what.

The first is what the Digital Personal Data Protection Act, 2023 (DPDP Act) is about. The second is what your client NDAs and master service agreements are about. Both matter when you choose where the system runs.

What your client contracts may say

Read your three or four largest client agreements, and their security questionnaires, for clauses like these:

• Where data may be stored: “within India”, “on the supplier’s own infrastructure”, or “not with any third party without written approval”.
• Subcontractors: whether a software provider holding project data counts as one, and whether you must name it.
• Audit rights: whether the client can inspect where its project information is kept.
• Incident notice: how quickly you must tell the client about a breach, often in hours, not days.

If any client asks for its information to stay on infrastructure you control, that leans towards your own server. If none do, the choice is about cost and effort.

What the DPDP Act asks of you

For your employees’ data, your company is the data fiduciary: you decide why and how it’s used. Any software provider that holds it for you, on its cloud, is your data processor. A few points matter for hosting:

• You stay responsible. Under section 8(1) of the Act, the fiduciary answers for what its processor does. You need a written contract with the provider (a data processing agreement) that covers security, breaches, sub-processors and deletion.
• Transfers abroad are allowed unless the government restricts a country (none had been named as of October 2026), but stricter Indian laws still apply. The Companies Act rules, for example, want a back-up of the books of account kept on servers in India.
• Breaches have clocks. Under the DPDP Rules, 2025, the fiduciary tells the Data Protection Board and the people affected, with a fuller report to the Board within 72 hours. CERT-In’s 2022 directions already require cyber incidents to be reported within 6 hours, and logs to be kept in India for 180 days.
• Timing. Most of the Act’s duties apply from 13 May 2027. Until then, the IT Act’s rules on sensitive personal data still apply. Either way, it’s sensible to set this up now.

None of this forces you onto your own server. It does mean that, on someone else’s cloud, the contract has to be good.

Your own server: what you take on

Running the system yourself gives you full control, and full responsibility. Be honest about the second part:

• A server and its upkeep. Someone patches the operating system, watches the disk, renews certificates and applies upgrades.
• Backups that are tested. Daily, encrypted, copied off the server, and restored at least once as a rehearsal.
• Someone on call. CERT-In’s 6-hour clock runs at night and on holidays too.
• Access from outside. A server inside your office network with no public name is the most private set-up, but staff working from home or clocking in from a phone then need a VPN.

If you already run servers for clients with a patch and backup routine, this is familiar work. If your IT team is two people and a laptop cupboard, it’s a real load.

Our cloud: what you hand over

On a provider’s cloud, the provider runs the servers, backups and upgrades. What you keep is the responsibility to check them:

• Where it runs. Ask for the region, in writing.
• Who else touches the data. Ask for the sub-processor list: hosting, backup storage, email, and anything optional such as SMS.
• What happens on a breach, how fast they’ll tell you, and what they’ll give you for your own report.
• How you leave. Can you export everything, in a format you can read, and will they confirm deletion afterwards?

A simple way to decide

If this is true	Lean towards
A client contract says its information must stay on infrastructure you control	Your own server
You already run servers with patching, backups and on-call cover	Your own server
Your IT team is small, and staff need access from anywhere	A cloud in India
No client clause applies and you’d rather not run servers	A cloud in India
You’re not sure yet	Start on the cloud, with an exit route that lets you move to your own server later

The last row is the one most firms miss. The choice isn’t final if the same product runs both ways, and you can take all your data with you.

How Dexta handles it

Dexta runs the same way in both places, so you can choose now and change later:

• Our cloud in India. We run the servers, the backups and the upgrades. Encrypted backups are copied off the server every six hours to storage in India and kept for 400 days.
• Your own server. One Linux server with Docker runs all eleven apps, including inside an office network with no public name, using its own certificates. You choose the backup bucket; every backup is encrypted before it leaves the server.
• Either way, an admin can export all your company’s data at any time, with a second admin approving it. Your DPDP tools, from the privacy notice to the breach register with CERT-In and Board clocks, are in the Hub.

If a client contract is pushing you one way, book a demo and bring the clause. We’ll show you how each set-up answers it.