Hosting & support
The software is free. Running it is a responsibility.
There is no paid edition and no feature held back behind a tier. What differs between these options is not what the software does — it is who is on the hook when a backup fails at 2am.
Self-hosted
Free
Forever. No licence fee, no per-seat cost, no headcount tier.
Suits: Anyone willing to follow an instruction manual. Docker Compose brings up the app and its database with one command and no third-party accounts.
Includes
- The complete source, under AGPL-3.0
- Every feature — nothing is held back for a paid tier
- Unlimited employees
- Documentation and the public issue tracker
You are responsible for
- Infrastructure and its cost
- Database backups, and testing that they restore
- TLS, patching and monitoring
- PDPA obligations as the data controller
- Incident response and PDPC breach notification
We are responsible for
- Nothing. Nobody else has access to your deployment or your data.
Self-hosted on a managed platform
Free
Software free; infrastructure typically S$0–50/month at SME scale, billed by your providers.
Suits: Most SMEs. The best balance of control and operational burden.
Includes
- Everything in self-hosted
- Managed Postgres in a Singapore region
- Automated backups and point-in-time recovery
- TLS and platform patching handled by your providers
You are responsible for
- Provider accounts and their bills
- Application configuration and upgrades
- PDPA obligations as the data controller
- Processing agreements with your providers
We are responsible for
- Nothing. The accounts are yours; the database is in your account, not ours.
Operated for you
From S$2,500
One-off setup, then S$500/month. A guide, not a quote — the final figure is scoped against your headcount, migration and support requirements.
Suits: Companies with no technical staff, or who want a named party contractually responsible for uptime and data handling.
Includes
- Deployment, configuration and migration from your current system
- Monitoring, backups with tested restores, and version upgrades
- A written data processing agreement and defined support response times
- A named contact for incidents
You are responsible for
- PDPA obligations as the data controller — these cannot be transferred
- Appointing your own Data Protection Officer
- Deciding your own retention periods and privacy notice
We are responsible for
- Operating the deployment as your data intermediary, under contract
- Availability, backups and patching, to the agreed terms
Who is liable for what
This is the question that actually matters when you adopt free software to hold personal data, so it gets a plain answer rather than a link to a licence.
The software is provided as-is, with no warranty
That is the standard position for open-source software and it is what the AGPL says. There is no service level, no uptime commitment and no guarantee of fitness for a particular purpose. If you self-host, nobody else is contractually on the hook for your deployment — because nobody else is operating it or can even see it.
You are the data controller, in every option
Under the PDPA, obligations attach to the organisation that decides how and why personal data is used. That is your company, whichever way you run this. Appointing a Data Protection Officer, publishing a privacy notice, setting retention periods and notifying the PDPC of a notifiable breach are yours. No software licence and no hosting contract moves them.
An operating engagement makes us a data intermediary, not the controller
If you pay us to operate the deployment, we process data on your instructions under a written agreement. That agreement carries real obligations — security measures, breach notification to you, defined response times, deletion on termination. What it does not do is make us the controller. That distinction is not a technicality; it decides who the PDPC deals with.
Statutory calculations are your responsibility, because we removed ours
OTG HRMS does not calculate CPF or produce payslips, so it cannot get them wrong. Leave entitlements are calculated, and while the defaults follow Singapore statute and common practice, they are defaults — not legal advice, and not aware of your employment contracts. Check them against what you actually promised before you go live.
The trade, stated plainly
Free software with no vendor means no vendor cost, no vendor lock-in and no vendor who can raise your price or shut down. It also means no vendor to sue. If your organisation needs a counterparty carrying contractual responsibility, take the operated option or buy a commercial product with an SLA — and read what that SLA actually covers, because most of them cover less than people assume.
Not legal advice
This page is a practical orientation written by the people who built the software. For obligations specific to your organisation, consult a qualified adviser. The longer walkthrough is here.