The application is free. Running it is not, and the cost is not mainly money — it is responsibility. An HR database holds NRIC numbers, salaries, medical certificates, home addresses and emergency contacts. Somebody has to keep that safe, and self-hosting means that somebody is you.
This is the page that should determine whether you install OTG HRMS at all.
Three ways to run it
| Fully self-hosted | Managed platform | Someone else operates it | |
|---|---|---|---|
| Software cost | Free | Free | Free |
| Infrastructure | Your servers | ~S$0–50/month at SME scale | Included in the operator's fee |
| You are responsible for | Everything: OS, database, backups, TLS, patching, monitoring | Application config, backups, upgrades | Nothing technical |
| Data location | Wherever you put it | Your chosen region | Contract with the operator |
| Suits | Teams with real infrastructure capability | Most SMEs | No technical staff |
The managed-platform route is right for most SMEs
A managed Postgres provider with a Singapore region, plus a Node host, gets you automated backups, point-in-time recovery, TLS and patching without operating anything yourself. For a company under a hundred people this typically lands somewhere between free and about fifty Singapore dollars a month.
Crucially, the database is your account. Not a vendor's multi-tenant database with your rows in it. You can dump it, move it, or delete it, on any day, without asking anyone.
Full self-hosting: what you are taking on
Running the database yourself is entirely reasonable if you already run infrastructure. If you do not, be clear-eyed about the list:
- Backups you have actually restored. An untested backup is a hypothesis. Test a restore into a scratch database quarterly.
- Encryption at rest for the volume, and encryption in transit for every connection.
- Patching, for the OS and Postgres, on a schedule rather than when something breaks.
- Access control — who can reach the database, from where, with which credentials, and how those are rotated.
- Monitoring, so you find out about a failed backup before you need the backup.
- A breach plan. Under the PDPA, notifiable breaches must be reported to the PDPC within three calendar days of assessment. Three days is not enough time to invent a process.
Keep the encryption key out of the backup
NRIC values are encrypted with NRIC_ENCRYPTION_KEY. If that key lives in the same place as your database dumps, an attacker who gets the dumps gets the key, and the encryption achieved nothing.
So:
- Key in a password manager or secrets manager. Never in the repository.
- Backups somewhere the key is not.
- Both recoverable by more than one person — a key only one person can reach is a different kind of outage.
Where to put it geographically
The PDPA does not forbid transferring personal data overseas, but it does require you to ensure comparable protection when you do — which means contractual terms with the receiving party, and knowing where the data actually sits.
Hosting in Singapore avoids that analysis entirely and is the simplest defensible answer for a Singapore company with Singapore employees. Every major provider offers a Singapore region. Pick it unless you have a specific reason not to.
Third parties in the path
Even self-hosted, some data leaves your machine. Know which:
| Service | What it sees | Avoidable? |
|---|---|---|
| Database host | Everything | Only by running your own |
| Object storage | Receipts, MCs, policy PDFs, photos | Only by running your own |
| Email provider | Names, addresses, request details in notifications | Yes — disable email |
| OCR provider | Receipt images | Yes — leave the API key unset |
Each of these is a data intermediary under the PDPA and needs a processing agreement. Most providers publish a standard DPA you can accept. Keep a copy — it is what an auditor will ask for.
If none of this is for you
Then do not self-host. Pay someone to operate it, or use a commercial HR product with an SLA. Choosing free software you cannot safely operate is a worse outcome than paying for a service, and it is your employees who bear the cost of that mistake.