Cloud-first was a decade-long detour. Five forces — AI egress, sovereignty regulation, cloud bill shock, vendor risk, and sharper audits — flipped the consensus in 2026. Here’s what changed, and why the companies that never left are quietly compounding the advantage.
Something quietly shifted in 2026. After a decade where “cloud-first” was the answer to almost every infrastructure question, a specific class of workloads started migrating home. The pendulum hasn’t fully swung back — most workloads still belong in the cloud — but the ones that don’t are leaving louder than they arrived. Source code is at the front of the line.
The cloud-first decade
From 2014 to 2022, every category of dev tooling moved to SaaS. GitHub crossed 100 million users. GitLab went public. Atlassian killed its Server product. Self-hosted got rebranded as “legacy” in every Gartner quadrant. The implicit assumption: cloud is just better. Faster updates, easier ops, elastic billing.
The assumption held until it didn’t. Three things converged in 2024–2025 to crack it: AI-assisted development put proprietary code on inference paths nobody had budgeted for; cloud bills hit a level where the CFO started reading them; and regulators — slowly at first, then suddenly — started caring about data residency at the source-code layer.
Five forces that broke the consensus
1. AI turned source code into an egress problem
When Copilot launched in 2021, “we transmit your code to Microsoft to build context” was a footnote in the docs. By 2026 it’s an agenda item at every board meeting in regulated industries. Every cloud-hosted AI code tool ships your source to a third-party inference endpoint. Default training: usually off. Default retention windows: rarely zero. Default contractual indemnity if a future training run absorbs your IP: hand-wavy.
The math changed when companies realized AI productivity gains don’t help when the legal team blocks the rollout. Self-hosted source control plus local LLM inference suddenly looked less like nostalgia and more like the only deployable answer.
2. Sovereignty stopped being theoretical
EU NIS2 — enforced October 2024 — requires “appropriate technical measures” for source code repositories in critical infrastructure sectors. US Executive Order 14117, issued in February 2024, restricts certain categories of code from specified foreign cloud providers. California’s CCPA 2.0 added source-code-as-trade-secret protections effective January 2026. Each of these can be satisfied on a cloud platform, with enough configuration. Each is trivial to satisfy on a self-hosted one.
3. The cloud cost shock
Cloud bills became an executive-level pain category in 2023–2025. The data points are concrete:
- Datadog announced a self-hosted option in Q1 2025 — the first time the company had ever offered one.
- MongoDB’s self-hosted licensing growth outpaced Atlas for the first time in Q3 2025.
- 37signals’ AWS exit, with $3M per year saved publicly disclosed, stopped being an outlier and became a template.
- GitHub Enterprise Cloud pricing rose 32% between 2023 and 2025.
- Snowflake, Databricks, and Datadog combined add over $1B per year to enterprise IT budgets — a number that pencils out very differently when private-cloud GPU prices are also falling.
4. Vendor risk got concrete
HashiCorp’s BSL relicense. Redis SSPL. Elasticsearch SSPL. Terraform → OpenTofu fork. MongoDB’s earlier SSPL move. Each of these reminded enterprises that “we run our workload in their cloud” translates to “their pricing power over us is uncapped.” A self-hosted equivalent suddenly looks less like a maintenance burden and more like insurance.
5. Compliance asks got sharper
CISOs in 2026 face audit questions that didn’t exist in 2020:
- Where is your source code stored, by physical region, and what’s your evidence?
- Which model trained on this repository, and what’s the provenance chain?
- Can you produce a tamper-evident audit log for every PR merged in the last 365 days?
- Who has accessed this branch, when, and from which IP?
- If we issue a discovery request under NIS2 Article 23, can you produce the data within 72 hours?
Each of these is harder to answer on a SaaS platform optimized for elastic billing than on a self-hosted one optimized for forensic retention.
Modern on-prem doesn’t look like 2014
The strongest argument against self-hosting through 2022 was the operational tax. Cloud was easier. Updates were automatic. SaaS got auto-scaling out of the box. On-prem meant “build a team of Linux admins, hope they don’t quit.”
That argument no longer holds. Modern on-prem is:
- Kubernetes-native — Helm charts for everything, GitOps reconciliation, rolling upgrades without downtime.
- Single-command install — RCstack, Docker Compose, Ansible. Enterprise SCM from cold start to production in under 5 minutes.
- Observability built in — Prometheus metrics, OpenTelemetry traces, Grafana dashboards shipped with the install.
- Federated identity by default — SAML 2.0, SCIM provisioning, OIDC. Your IdP is the source of truth. No LDAP sync scripts maintained by one engineer who left.
- AI inference at the perimeter — vLLM, Ollama, TGI, Bedrock-in-VPC. 4-bit quantized 70B models on a single H100. Throughput and latency competitive with public API endpoints.
The operational gap between SaaS and well-engineered on-prem has narrowed from a 10× factor to under 2×. For workloads where the upside is sovereignty, compliance, or IP protection, the math is now favorable — often dramatically so.
Industries leading the comeback
Some sectors never left:
- Defense and aerospace stayed self-hosted through the cloud-first decade. Today they’re the reference architecture other industries are calling for advice.
- Financial services — at least three Tier-1 US banks completed source-repo repatriation projects in 2025. None of them announced it publicly. All of them mentioned it on earnings calls when asked about AI strategy.
- Automotive OEMs are consolidating around on-prem code platforms to meet ASPICE plus ISO 26262 functional-safety audits at the platform layer, not at the project layer.
- Life sciences GxP environments require validated change control. Cloud SLAs don’t qualify. On-prem with a documented validation package does.
- Semiconductor companies treat RTL and process design kits as state-secret-grade assets. They have for thirty years. The rest of the industry is catching up.
We manage 11,000+ repositories and 1,600 active users on a single RhodeCode deployment. Nothing else came close — not from a performance perspective, and not from a regulatory perspective.
— Platform Engineering, Source Code Governance, Thales Group
The bottom line
If your source code is a tradeable asset — IP, regulated, defense-adjacent, customer-data-derived — then the question in 2026 isn’t “should we self-host?” It’s “why didn’t we always?”
The organizations that never left are compounding the advantage. They have 15 years of audit trails. They have 10 years of refined SAML configurations. They built their AI inference pipelines inside their own perimeter from day one. They aren’t migrating now because they don’t have to. They’re just doing the work, on hardware they own, with software they control.
The on-prem comeback isn’t a step backwards. It’s an acknowledgment that for a specific class of software — the kind that holds the company’s IP, regulatory standing, and competitive moat — the cloud was a detour, not a destination.
Where RhodeCode fits
We’ve been shipping behind-firewall source code management since 2010. Git, Mercurial, and Subversion under one roof. SAML, CAS, OAuth, 2FA, SCIM. AI-assisted review that connects to your local LLM endpoint — every token round-trips inside your network, zero egress. Forty thousand installs across financial services, defense, automotive, life sciences, and research. We didn’t move to the cloud. We just watched it become fashionable to come home.
Frequently asked questions
Five converging forces: AI tools that egress proprietary code, EU NIS2 and US EO 14117 sovereignty regulations, cloud bill shock at the executive level, vendor relicensing risk from HashiCorp, Redis, and Elastic, and audit questions that on-prem answers more easily than SaaS. The combination flipped the cost-benefit math for IP-heavy workloads.
Why are companies moving back to on-premise software in 2026?
Yes — and growing. Self-hosted Git is the deployment model of choice for regulated industries, AI-aware enterprises, and any organization where source code is treated as a regulated or competitive asset. Modern installers, including Kubernetes-native deployment, single-command setup, and built-in observability, have closed most of the operational gap with SaaS.
Is self-hosted Git still relevant in 2026?
Self-hosted source control makes NIS2 compliance straightforward. Article 21 “appropriate technical measures” are easier to demonstrate with on-prem deployments where physical region, encryption, access logs, and tamper-evident audit trails are all under your direct control. RhodeCode customers in EU critical sectors typically pass NIS2 audits without architectural changes.
Does self-hosted source control comply with EU NIS2?
Yes. Local LLM endpoints such as vLLM, Ollama, TGI, AWS Bedrock-in-VPC, and Azure OpenAI Private Endpoint deliver code-review-grade inference at sub-second latency. Modern self-hosted platforms like RhodeCode plug into these endpoints directly. Every token round-trips inside your network. Zero egress. Zero third-party retention.
Can AI code review run behind a firewall?
At low scale, under about 50 developers, SaaS is typically cheaper. At enterprise scale, with 200+ developers, multiple repositories, and compliance requirements, on-prem is typically 30–60% cheaper on a 3-year TCO basis — especially after factoring in audit cost, data residency premiums, and AI inference egress fees.
What’s the cost difference between SaaS and modern on-prem source control?