Table of Contents
- What Is a Self-Hosted Payment Gateway?
- Self-Hosted vs Hosted vs Embedded: Which Model Fits
- Top Self-Hosted Payment Gateway Options in 2026
- What a Self-Hosted Setup Actually Costs
- PCI Compliance: Your Responsibilities When You Self-Host
- Security Best Practices for Self-Hosted Checkouts
- Should Your Business Self-Host? A Decision Framework
- Frequently Asked Questions
What Is a Self-Hosted Payment Gateway?
A payment gateway moves card data from your customer to the processor securely. With a self-hosted (often called on-site or direct) setup, the customer never leaves your website to enter payment details. Your server collects the data, passes it to the gateway through an API, and returns the result. The URL bar never changes, and the design matches your store exactly. This contrasts with two alternatives. Hosted or redirect gateways (PayPal Standard is the classic example) send customers to the provider’s page and back. Gateway-hosted embedded fields (Stripe Elements or Braintree Hosted Fields) keep the checkout visually on your site, but the sensitive fields are actually iframes served by the provider. Self-hosting is the only model where raw card data touches your infrastructure, which is precisely why it demands more from you. The payoff is total control: custom field layout, combined carts for mixed products and services, one-page upsell logic, localized payment methods, and analytics that see every step. The obligation is that you inherit the security and compliance duties the hosted models outsource to the provider.Self-Hosted vs Hosted vs Embedded: Which Model Fits
Most businesses should not self-host raw card data, and knowing where your checkout falls on the control-versus-burden spectrum is the whole decision. The table below compares the three models as they work in 2026.| Model | PCI Scope | Checkout Control | Typical Fit |
|---|---|---|---|
| Self-hosted (direct API) | Highest (SAQ D or A-EP) | Complete: fields, flow, URL, data | Large stores with dev teams and custom flows |
| Embedded fields (iframes) | Low (SAQ A) | High: styled to match, hosted securely by provider | Most small and mid-size e-commerce |
| Redirect or hosted page | Minimal (SAQ A) | Low: provider controls page design and flow | Simple stores, service businesses, marketplaces starting out |
Top Self-Hosted Payment Gateway Options in 2026
Several US-facing gateways support direct integration where card data is collected on your infrastructure and transmitted via API. Pricing below reflects typical published rates for card-not-present transactions in early 2026; volume discounts are negotiable above roughly $80,000 monthly processing.| Gateway | Typical Pricing | Notes for Self-Hosting |
|---|---|---|
| Stripe (direct API) | 2.9% + $0.30 per transaction | Best developer tooling; tokenize server-side to shrink PCI scope |
| Authorize.Net | $25 per month + 2.9% + $0.10 | Long-standing direct-post and API options; strong B2B support |
| Braintree | 2.59% + $0.49 per transaction | PayPal ownership simplifies combined card-plus-PayPal checkouts |
| NMI | About $25 per month + processor rates | Gateway-only layer popular with ISO resellers and custom builds |
| BTCPay Server | Free and open source (network fees only) | Self-hosted by design; Bitcoin and Lightning, no card processing |
What a Self-Hosted Setup Actually Costs
Beyond per-transaction fees, self-hosting carries upfront and ongoing costs that hosted models avoid. Budget for these line items before committing.- Development and integration: $3,000 – $15,000 for a production-grade direct integration with error handling, retries, and receipts on a typical store.
- Hosting that meets PCI expectations: $50 – $500 per month for properly configured servers, WAF, and logging; shared bargain hosting usually fails the checklist.
- SSL certificates: $0 – $200 per year, with free certificates from Let’s Encrypt being perfectly acceptable.
- Quarterly ASV vulnerability scans: $100 – $500 per year when SAQ D applies.
- Security maintenance: 2 – 6 developer hours monthly for patching, key rotation, and log review, or $200 – $1,000 per month outsourced.
- Chargeback and dispute fees: $15 – $25 per case at most processors, plus the representment time.
PCI Compliance: Your Responsibilities When You Self-Host
PCI DSS applies to any business that stores, processes, or transmits cardholder data. The compliance burden scales with your exposure. Hosted and embedded checkouts usually qualify for SAQ A, the shortest self-assessment. A self-hosted checkout that receives card data puts you in SAQ D (all requirements, hundreds of controls) or, with careful server-side tokenization where data passes through but never rests on your systems, potentially SAQ A-EP, which is still substantially heavier than SAQ A. Three practices keep the burden manageable. First, never store raw card numbers; store only tokens returned by the gateway. Second, use the gateway’s client-side encryption or tokenization libraries so your servers relay rather than decrypt card data. Third, segment the payment path from the rest of your network so your quarterly scans and annual assessment cover a small, tightly controlled environment instead of your entire infrastructure. Non-compliance is not a theoretical risk: processors levy $5,000 to $100,000 per month in penalties for non-compliant merchants depending on card brand rules and processor agreements, and a breach on top of non-compliance is how small merchants disappear. Compliance is a designed-in property, not a yearly form.Security Best Practices for Self-Hosted Checkouts
If you self-host, these controls are the minimum bar in 2026, both for PCI and for ordinary risk management.- Enforce TLS 1.2 or higher everywhere, with HSTS enabled and certificates auto-renewed.
- Tokenize every card on first use; raw PANs must never touch your database or logs.
- Keep frameworks, libraries, and server images patched on a defined schedule, with an inventory of dependencies.
- Require two-factor authentication and role separation for admin access to payment infrastructure.
- Log payment-path activity to immutable storage and review alerts weekly.
- Run a web application firewall in front of checkout endpoints and test for the OWASP Top 10 at least annually.
- Validate all input server-side and use the gateway’s own client SDKs rather than hand-rolled encryption.
Should Your Business Self-Host? A Decision Framework
Choose self-hosting when checkout experience is a measurable revenue lever: you need a one-page funnel with upsells, complex B2B terms, subscription dunning built your way, or deep custom analytics, and you have (or can hire) the engineering capacity to maintain it. The conversion gains from removing a redirect step are real but modest, typically low single digits; the bigger wins come from custom flows that hosted products simply cannot express. Choose embedded fields when you want brand-consistent checkout without the security surface, which is the right call for the clear majority of stores under $10 million in annual revenue. Choose redirect when speed to market dominates, such as validating a new product line. And whatever you choose, review the decision annually; gateway capabilities improve every year, and last year’s reason for self-hosting may have shipped as a hosted feature. For a second opinion grounded in conversion data, the team at Digimau audits checkout funnels end to end.Frequently Asked Questions
These are the questions US business owners and marketers ask most about this topic, answered plainly.What is a self-hosted payment gateway?
A self-hosted payment gateway collects card details directly on your website through your own forms and servers, then transmits them to the processor via API. The customer never leaves your domain. This gives full design and flow control but puts the merchant in scope for PCI DSS requirements such as SAQ D or A-EP.
What is the difference between self-hosted and hosted payment gateways?
Hosted gateways redirect customers to the provider’s page to enter card details, minimizing your compliance burden but sacrificing design control. Self-hosted gateways keep the entire checkout on your site, giving you control of every pixel and data point while transferring security and PCI responsibilities to your infrastructure.
How much does a self-hosted payment gateway cost?
Expect $3,000 to $15,000 in development for a production integration, $50 to $500 per month for compliant hosting and security maintenance, plus standard processing fees around 2.6% to 2.9% plus $0.10 to $0.49 per transaction. Fixed monthly cost is typically $500 to $1,500 all-in for a mid-size store.
Do I need PCI compliance if I self-host my checkout?
Yes, and at a higher level than hosted options. Collecting card data on your servers generally requires SAQ D, the most demanding self-assessment questionnaire, or SAQ A-EP with strict tokenization. Hosted and embedded checkouts usually qualify for SAQ A, which is why most small businesses avoid full self-hosting.
What are examples of self-hosted payment gateways?
Common US options with direct-API integration include Stripe, Authorize.Net, Braintree, and NMI. BTCPay Server is a fully self-hosted open-source option for Bitcoin payments. Note that a gateway can support multiple integration modes, so confirm the card data flow, not just the brand name.
Can I self-host with Stripe?
You can build a direct Stripe integration where card fields are presented on your site, but Stripe expects you to use its tokenization libraries so raw card numbers are converted to tokens before storage. Most teams pair Stripe Elements with server-side tokens, which keeps compliance manageable while preserving a custom checkout.
Are self-hosted payment gateways safe?
They are as safe as the team running them. With TLS 1.2+, tokenization, prompt patching, WAF protection, and access controls, self-hosted checkouts meet the same security bar as major hosted services. Without disciplined maintenance, they are riskier, because unpatched software on the payment path is the most common breach vector.
How do chargebacks work with a self-hosted gateway?
Chargebacks follow the same card network rules regardless of gateway model: the cardholder disputes, the processor debits you plus a $15 to $25 fee, and you submit representment evidence. Self-hosting helps indirectly because complete checkout data and clear billing descriptors reduce friendly fraud win rates against you.
Can self-hosted gateways handle recurring billing?
Yes. Gateways like Stripe, Authorize.Net, and Braintree support stored tokens and subscription schedules, and self-hosting gives you full control over dunning logic, retry timing, and proration rules. You store only tokens, so recurring charges are initiated by API without retaining card numbers.
When should a business switch from hosted to self-hosted payments?
Switch when checkout limitations measurably cost revenue, such as abandoned redirects, unsupported payment methods, or impossible custom flows, and when you have engineering capacity for PCI maintenance. Stores under roughly $10 million in annual revenue usually get better economics from embedded fields, re-evaluated annually as gateway features evolve.
Related Articles
Keep reading with these guides:
