Cloud Repatriation Saves Money Only When Someone Runs the Servers

Cloud repatriation, moving steady workloads off public cloud onto dedicated servers, can lower your monthly bill. The savings only hold if someone runs the hardware: patching, monitoring, backups, capacity planning and the overnight pager. Most savings estimates compare the cloud invoice to the hardware cost and leave those people out.

So the real decision is who operates the servers after the move. Settle that first and the numbers usually work. Skip it and you trade a predictable bill for an unpredictable risk.

Why cloud repatriation is on the table

For a lot of businesses, the public cloud bill grew faster than the work it supports. Workloads that run at the same level every hour of every day, such as a database, a file store or an internal app, gain little from pay as you go pricing. They pay a premium for flexibility they never use.

Data transfer fees deserve their own line. When the UK Competition and Markets Authority closed its cloud market investigation in July 2025, it named "the presence and magnitude of egress fees" as a key commercial barrier to switching providers, one that hits "particularly smaller customers." A cloud repatriation plan that moves terabytes out pays those fees once, on the way out, so they belong in year one of the estimate.

Cloud repatriation terms in plain language

Measured service

The pay as you go part of cloud. NIST SP 800-145 says cloud systems "automatically control and optimize resource use by leveraging a metering capability." You pay for what the meter reads, which suits uneven demand and overcharges steady demand.

Rapid elasticity

NIST's term for capacity that can be "elastically provisioned and released" to match demand. It is the feature a steady workload buys and rarely uses.

Data egress charges

Fees for moving data out of a provider. The European Commission describes them as "charges for data transit."

Switching charges

What a provider bills for the work of moving a customer to another provider or to its own servers, egress included. The EU Data Act limits them, as covered below.

Total cost of ownership

Every cost of running a system for its whole life: hardware, hosting, people, risk and compliance, not just the monthly invoice.

Cloud repatriation is rarely all or nothing. The sensible pattern is a rebalance:

• Move: steady, high utilization, predictable workloads.
• Keep in cloud: spiky, seasonal or experimental workloads that need to scale up and down.
• Decide case by case: anything tied to a cloud managed database, queue or identity service you would have to replace.

The cost the savings slide leaves out

A typical savings comparison has one line on each side: the cloud bill against the hardware and hosting cost. A fair total cost of ownership has four buckets.

Bucket	What it covers	Usually on the slide?
Infrastructure	Servers, storage, network, colocation or hosting	Yes
People	Patching, monitoring, on call, upgrades, capacity planning	Rarely
Risk	Redundancy, disaster recovery, tested restores	Rarely
Compliance	Evidence that controls run: logs, patch records, backup tests	Almost never

The people bucket is the one that changes the answer. The Bureau of Labor Statistics reports that the median annual wage for network and computer systems administrators was $99,130 in May 2025, before benefits, training and the cost of covering nights, weekends and vacations. One person cannot be on call all year, so a real rotation needs more than one.

Here is the arithmetic most savings slides skip. A week has 168 hours, and a standard 40-hour schedule covers less than a quarter of them. Covering every hour with someone awake and responsible takes more than four full-time people (168 divided by 40 is 4.2) before anyone takes a holiday or a sick day, and about five once leave is counted. Most small businesses do not hire five people. They put one person on a pager and accept slower response at night, or they pay someone else to carry it. Either way, that choice is a line in the cloud repatriation budget.

Administration is only part of the work. Cloud repatriation also brings database, security and network design back in house, and median pay for each of those roles was close to or above $100,000 in May 2025, before benefits.

Median annual wage, May 2025 is highest in Computer network architects at $134,050.

Median annual wage for the four roles that run servers after a move off public cloud, before benefits. Each one is a salary the cloud bill used to cover inside its price.

	Median annual wage, May 2025
Computer network architects	134,050
Information security analysts	129,180
Database administrators	104,620
Network and computer systems administrators	99,130

How cloud repatriation goes wrong

The failure patterns are consistent, and each traces back to the missing operations work:

• Understaffing. The cloud provider was quietly doing patching, hardware swaps and failover. After the move, nobody owns those jobs.
• Undersized hardware. Autoscaling hid your true peak usage, so the new servers are sized for the average.
• Hidden dependencies. Managed databases, queues and sign-in services you relied on do not exist on bare servers and have to be rebuilt and maintained.
• Untested recovery. Backups exist, but nobody has restored one under pressure.

A team that moves workloads without adding operating capacity can end up with higher costs and more downtime than the cloud setup it left. The savings and the risk come from the same variable.

Cloud repatriation exit fees and the EU Data Act

One part of the cost story is changing by law. According to the European Commission, the EU Data Act "applies since 12 September 2025," and it will "entirely remove switching charges, including charges for data egress (i.e. charges for data transit), from 12 January 2027." Until then, during the transition that started on 11 January 2024, providers "may still charge their customers for the costs incurred in relation to switching and data egress."

Outside the EU the rule does not apply, and egress is still billed under each provider's terms. Either way, fees are only the visible part of cloud repatriation. The operating work after the move costs more, and it lasts for years.

Regulation makes cloud repatriation an operations question

If you serve financial firms in the European Union, the Digital Operational Resilience Act (DORA) raises the stakes. According to the European Insurance and Occupational Pensions Authority, DORA "entered into application on 17 Jan 2025," and it exists so that banks, insurers, investment firms and other financial entities can withstand, respond to and recover from ICT disruptions.

Supervisors are also watching the tech providers themselves. On November 18, 2025, the European Banking Authority and its sister authorities published the list of critical ICT third-party providers designated for oversight under DORA, covering services "from core infrastructure to business and data services."

Bringing a workload in-house does not remove the resilience duty. It moves the evidence onto your side: monitoring records, patch history, restore tests and incident logs that someone has to produce and keep current. That is operations work, and it belongs in the cloud repatriation budget.

Questions to answer before cloud repatriation

1. Name the patch owner. Decide who patches the operating system and firmware, and on what schedule.
2. Staff the pager. Decide who answers an alert at 3 a.m., and who covers them on holiday.
3. Set the uptime target. Write down the target and the redundancy it requires, then price that redundancy.
4. Run a restore test. Restore a full backup and time it. If nobody has done one, do it before the move, not after.
5. List the managed services. Note every cloud managed database, queue or sign-in service you use and what replaces each one.
6. Price the exit. Get the egress and switching charges for your data volume in writing.
7. Assign the evidence. Decide who produces the compliance evidence your customers or regulators ask for.

If any answer is "we'll figure it out," that cost is missing from your savings estimate.

The real choice is who runs the servers

The decision was never public cloud against a rack in a closet. It is who owns the patching cadence, the uptime target, the capacity plan and the compliance evidence. You can staff that yourself, you can leave it with a hyperscaler and pay the premium, or you can have a dedicated team run isolated servers for you.

LTFI takes the third path for the system a business runs on. Each company gets its own server, which Kief Studio hosts, patches and watches, with backups you can actually restore, and no other business's data on it. Our Harden and Watch layers explain how. Our note on why dedicated infrastructure isn't the expensive option walks through the cost side, and own the box covers why control of the hardware matters. When you price a cloud repatriation move, put the people bucket in from the start, and talk to us if you want to see how a managed server fits.

Frequently asked questions