There's a popular kind of video right now. A founder shows their app running on Vercel and Supabase, adds up the monthly bills, then moves everything to a $10 server and runs an AI coding agent on it directly. Cheaper, faster, no middlemen.
Some of that is true. A small virtual server really can do the work of several hosted services. But the videos skip the part where you become responsible for everything those services were quietly doing for you.
We run both setups ourselves, so here's the honest trade-off.
What a VPS actually is
A VPS, or virtual private server, is a slice of a computer in a data centre that you rent by the month. Hetzner's cheapest cloud server is €5.99 a month before VAT. You get a blank Linux machine and full control over it.
Platforms like Vercel and Supabase sit on top of servers like that and handle the boring parts for you. Vercel's Pro plan is $20 a month with some usage included, and Supabase's paid plan is a similar amount. For a small app, the combined bill often lands somewhere between $50 and $80.
What you save, and what you take on
| Managed (Vercel, Supabase) | Your own VPS | |
|---|---|---|
| Typical monthly cost | $50 to $80 | $6 to $15 |
| Security updates | Done for you | Your job, every week |
| Firewall and login hardening | Done for you | Your job |
| Backups | Built in on paid plans | Your job, and you must test restores |
| Rolling back a bad release | One click | Only if you set it up |
| Code review before going live | Built into the workflow | Skipped if you edit live on the server |
| If the server is compromised | Shared responsibility with the platform | Entirely yours |
The saving is real, but it's measured in tens of pounds a month. The work you take on is measured in hours, and the risk is measured in whatever your customer data is worth.
The bit the videos admit, then move past
To his credit, the creator of one of these videos says it out loud: you can get hacked. Then he moves on.
A fresh server on the internet starts getting automated login attempts within minutes. That's normal and manageable, but only if someone has turned off password logins, set up a firewall, switched on automatic security updates and kept an eye on it.
Running an AI coding agent directly on the live server adds another layer. Changes go straight to production without a review step or an easy way back. If the agent makes a mistake, or is tricked by something it reads, it's acting on the real system with real data.
Why it matters more in the UK
If your app holds personal data about customers, UK GDPR makes you responsible for keeping it secure. On a managed platform, part of that work is done and documented by the provider. On your own server, the security measures are all yours, and so is the explanation if something goes wrong.
That doesn't rule out a VPS. It means you need to be able to say what you did to protect the data.
When a VPS makes sense
We use a small server of our own for background jobs: scheduled scripts and always-on agents that don't touch client data. It sits behind a private network, so it isn't open to the internet, and all code still goes through Git.
That's a good fit for a VPS. So are internal tools, side projects, learning, and apps with no personal data where a day of downtime wouldn't hurt anyone.
Our own website and anything customers use stay on a managed platform. We get reviewed releases, one-click rollback, hosting in London and security patching we don't have to think about. For a two-person firm, that's worth far more than the $50 we'd save.
If you do move, do these five things first
One: turn off password logins and use SSH keys only. Two: put a firewall in front of everything, and if it's an internal tool, keep it on a private network rather than the open internet. Three: switch on automatic security updates. Four: set up off-server backups and test a restore before you need one. Five: keep your code in Git and deploy from there, rather than letting anyone, human or AI, edit the live server.
If any of those sound unfamiliar, the $50 a month is probably buying you more than hosting.
Not sure which setup suits what you're building, or whether your current one is safe? Get in touch and we'll take a look.