Self-hosted crypto exchange software: what you get, what you run, and what it costs
What self-hosted crypto exchange software includes, what your team has to run, how it differs from white-label cloud and open-source kits, and what it costs.
BitPolaris Engineering
Self-hosted crypto exchange software runs on infrastructure you control: on-premise or in your own cloud account, with the private keys, the customer database and the audit trail inside your perimeter from day one. It is the alternative to the hosted model, where the vendor operates the instance and the environment the keys are encrypted in, and bills a monthly fee plus a share of revenue. This guide covers what a self-hosted install includes, what your team takes on, how it compares with white-label cloud and open-source kits, what a source-code licence adds, and what it costs, using our own published numbers so you can check them.
Three ways to deploy the same exchange core
Deployment affects the contract as much as the architecture. This is the same table we use on the deployment page. The exchange core is the same in all three columns; what differs is who operates it, where the keys live and which blocks are available.
| White-label cloud | Self-hosted | Source code | |
|---|---|---|---|
| Who operates | Vendor | You, with the vendor’s support team on call | You |
| Where it runs | Vendor’s EU dedicated servers | Your bare metal or cloud account | Your bare metal or cloud account |
| Keys | Encrypted inside the instance | Entirely in your perimeter | Entirely in your perimeter |
| Vendor access | Operational, logged | None standing; session credentials you issue | None |
| Updates | Included; you approve windows | 20% of licence per year; you approve windows | Optional update stream, 15% per year |
| Custody block | Not available | Available | Available |
| Pricing | Setup + monthly | One-time licence + annual support | One-time perpetual licence |
| Exit | 90 days notice, full data export | Perpetual; support optional | Perpetual; fork allowed |
“White-label cloud” here means a hosted instance branded for you. Two rows decide most purchases. “Keys” is the row regulators and banks read first: a licensed broker that must hold customer assets under its own control cannot use a model where the vendor’s instance encrypts the keys. “Vendor access” is the row your security team reads: self-hosted means the vendor has no account on your servers; when you want support inside the system, you issue a time-limited credential and revoke it afterwards.
What is included in self-hosted crypto exchange software
“Exchange software” is not one program. The reference packaging is about 50 services under Docker Compose behind Traefik on dedicated servers; sizing and topology are set with you at scoping from your markets and expected users. Each service is something an in-house team would otherwise build:
- Matching engine (Go): spot matching with limit, market and stop-limit orders, self-trade prevention, gRPC and AMQP transport.
- Ledger and core (Rails): accounts, wallets, transfers and accounting; identity service with KYC tiers and a Sumsub integration (other providers are scoped separately; provider fees are yours); WebSocket feeds and an API gateway.
- Wallet layer for nine chains: BTC, ETH, BSC, TRON, XRP, SOL, DOGE, LTC and AVAX C-Chain, with RPC pools and failover.
- Liquidity: the Mirror engine quotes order books on 97 markets today from reference venues and hedges each fill on those venues as it happens, so you do not pre-fund market-making inventory; the hedging venue still needs working balances. Your own market makers connect through the API. How mirroring works.
- Clients: a React web terminal with Easy and Pro modes (a simple buy-and-sell view and a full order-book terminal), React Native apps for iOS and Android published under your developer accounts, and mobile web.
- Operations console: 53 screens for KYC queues, withdrawal approvals, market and fee configuration, the Mirror console, Earn (where your licence allows), live support and 60 email templates.
- Data and infrastructure: MySQL, Redis, InfluxDB, RabbitMQ and HashiCorp Vault, with Cloudflare in front.
The piece buyers most often underestimate is the console. An exchange without approval queues and an audit log is unlikely to pass most compliance reviews, and that console is rarely part of open-source kits.
What your team has to run
Self-hosting moves responsibilities, it does not remove them. Plan for the following before you sign:
- Infrastructure. Bare metal or a cloud account; reference installations exist on Hetzner, AWS Frankfurt and OVH. Backups go to a second site you choose; backup frequency, restore tests and recovery targets are agreed at scoping and written into the order.
- The key ceremony. Hot, warm and cold wallet keys are generated on your hardware with your officers present and a signed record. The vendor guides the procedure through a session you control and does not handle the key material.
- Update windows. Releases arrive from the vendor; you approve when they are applied. Expect a staging environment and a rollback plan as standard. The licence is perpetual whether or not you continue the update subscription.
- Monitoring and on-call. The stack ships with its monitoring rules and alerting; what is watched and where alerts go is set with you at install. Someone on your side carries the pager; the vendor’s support team is the second line, reached through credentials you issue, with hours and severity targets written into the order.
- Evidence. Because the logs, the database and the configuration are yours, your licence application and your auditors get their technical evidence from your own systems. What regulators ask for lists what that file usually contains.
If you have no operations engineer at all, we recommend starting on the cloud model and migrating later: cloud setup fees are credited against a later self-hosted licence for the same products, and migration between models takes about two weeks for a standard deployment, excluding app-store, bank and custom-integration delays.
Where it can run
Data residency is the most common reason to self-host. Cloud instances are EU only; self-hosted goes where your licence requires, within sanctions, export-control and support constraints:
- EU: any provider; reference installations on Hetzner, AWS Frankfurt and OVH.
- GCC: AWS Bahrain and UAE, Oracle Dubai, or on-premise. Arabic UI and right-to-left layout are supported.
- Türkiye: local providers or on-premise for data-localisation rules. EUR and TRY bank-transfer rails exist in the software; your bank or PSP connects them.
- Elsewhere: Singapore, Switzerland and the UK on request. Address and sanctions screening is available on every deployment.
Self-hosted software versus an open-source kit
Open-source exchange kits also run on your servers, and for an engineering-led group they are a legitimate route. The difference is what is there at installation. A kit typically gives you a matching engine, a basic ledger and a web front end. The parts missing are the ones that take the longest: the operations console, the liquidity engine, native apps, chain integrations with failover, and the deployment scripts, monitoring, backup process and audit logs that come from running the stack for real customers. In our cost comparison that gap works out to €300k or more of engineering and six to twelve months before a kit can serve customers.
A commercially licensed self-hosted stack is the opposite trade: you pay a fixed price for software that already runs an exchange, and you inherit its architecture decisions. Ask to see the running system before you decide; a vendor that cannot show the console working is asking you to buy the kit route with a licence fee on top.
What self-hosted crypto exchange software costs
Our prices are public and fixed in EUR; the pricing page builds a year-one estimate from them.
| Block | Self-hosted licence (one-time) | Source-code licence (one-time) | Updates and support |
|---|---|---|---|
| Exchange | €24,500 | €58,100 | Self-hosted: 20% of licence per year (€4,900). Source: optional 15% update stream |
| Wallet (web, backend, admin) | €11,900 | €28,700 | Same terms |
| Custody (self-hosted only) | €15,400, or €14,000 with Exchange | €37,800, or €33,600 with Exchange | Same terms |
| Payments | €7,700 | €20,300 | Same terms |
Modules such as the iOS and Android apps, Token Launch, Earn and fiat rails are priced separately; fiat rails also depend on your bank or EMI partner and jurisdiction. For comparison, the same exchange on the cloud model is €7,700 setup plus €1,600 a month, with year-one support included. A licensed broker taking Exchange, Wallet and Custody self-hosted pays €50,400 one-time for the three core blocks and about €10,100 a year for updates and support.
What is not in these numbers: your servers, your KYC provider’s per-check fees, blockchain network fees, and working balances on the hedging venue for the Mirror engine. Those are the same on any model.
The install, step by step
On the cloud model we publish five weeks from signature to go-live; self-hosted adds one to two weeks for the install and the key ceremony once infrastructure access, DNS, certificates and provider accounts are ready. The sequence is the same each time:
- Scoping and licence path. Jurisdiction, custody requirements, KYC provider, hosting constraints, sizing and the list of markets.
- Environment. You provision the servers or the cloud account and hand over access; the stack is installed and the staging environment comes up first.
- Key ceremony and custody policy. Keys generated on your side; approval thresholds, whitelists and delays configured in the policy engine.
- Branding, apps and content. Web terminal and apps under your brand, store submissions started early because review is the least predictable step.
- Dry run. A full cycle on the staging system: deposit, trade, withdrawal with approval, reconciliation, incident drill.
- Go-live and hand-over. Admin training, runbooks, and the vendor’s support team attached through credentials you issue.
Questions to ask any vendor before you self-host
- Does the vendor keep any standing access after installation? If yes, how is it logged and revoked?
- Who is present at the key ceremony, and can you repeat it without the vendor?
- Can you rebuild the deployed images from source, or are you running binaries you cannot inspect? (BitPolaris: the self-hosted licence ships the deployable system; the source-code licence adds the repositories and build pipeline, subject to third-party components.)
- How are updates delivered and can you decline one?
- What happens to support if you stop paying the annual fee, and does the licence survive?
- Can the vendor show the operations console running on a live system today?
Self-hosted crypto exchange software FAQ
What does self-hosted crypto exchange software mean?
The exchange runs on servers or a cloud account you control. Private keys, the customer database and the audit trail stay inside your perimeter, the vendor keeps no standing access, and support happens through time-limited credentials you issue. You pay a one-time licence and an annual fee for updates instead of a monthly fee and a revenue share.
Is self-hosted the same as buying the source code?
No. A self-hosted licence gives you the deployable system on your infrastructure; a source-code licence adds the repositories, build pipeline and infrastructure definitions, 90 days of onboarding for your engineers and the right to fork. BitPolaris prices them at €24,500 and €58,100 for the exchange block.
How many people do I need to run a self-hosted exchange?
Plan for at least one operations engineer who owns servers, backups and update windows, plus the compliance and support staff any exchange needs. The vendor’s support team covers the second line. Groups without an operations engineer usually start on the cloud model and migrate later; the setup fee is credited.
Can I self-host in the GCC or in Türkiye?
Yes. Reference deployments cover AWS Bahrain and UAE, Oracle Dubai and on-premise installs in the GCC, with Arabic UI and right-to-left layout, and local providers or on-premise in Türkiye for data-localisation rules. Switzerland, Singapore and the UK are available on request.
Does self-hosting make me compliant?
No. It gives you control of keys, data and evidence, which most licence regimes require, but the licence, the policies and the people are yours to put in place. What regulators ask for explains which parts of the technical file the software should generate or retain for audit review.
BitPolaris licenses the production software behind a live exchange for installation on your servers: keys in your perimeter, a 53-screen operations console and a liquidity engine that hedges each fill instead of pre-funding inventory. Prices are public.