Contract Red Flags
We read the Terms of Service so you don't have to. Lock-in risks, pricing traps, and data portability.
99
Contracts reviewed
15
High risk
51
Red flags total
A
AWS
Cloud · Reviewed 2026-03⚠
Egress fees create lock-in
Data transfer OUT is $0.09/GB. Moving 10TB of data out costs ~$900. Financial lock-in by design.
⚠
Terms allow unilateral changes
AWS can modify service terms at any time. Continued use = acceptance.
⚠
Complex billing — surprise costs common
Hundreds of billing dimensions. Easy to accidentally spend $10k on a misconfigured service.
✓
Data sovereignty options
Choose specific regions. GovCloud for compliance. Data stays where you put it.
Positives
Most comprehensive service catalogEnterprise agreements negotiableHIPAA, SOC 2, FedRAMP certified
M
MongoDB Atlas
Database · Reviewed 2026-03⚠
SSPL license — not open source
MongoDB Server is SSPL since 2018. You cannot offer MongoDB as a service without open-sourcing your entire stack.
⚡
Atlas lock-in features
Atlas Search, Atlas App Services, Realm — all proprietary. Moving away means rewriting these features.
✓
Data export with mongodump
mongodump/mongorestore work fine. Data is portable at the database level.
⚡
Price increases happen
Dedicated cluster prices have increased ~15% over 2 years. No contractual price protection.
Positives
Data exportable via standard toolsMulti-cloud deployment availableStrong enterprise agreements
O
OpenAI
AI · Reviewed 2026-04⚠
Rate limits change without notice
Rate limits and model availability can change. GPT models get deprecated with ~6 months notice.
⚠
Model deprecation risk
Older models (GPT-3.5, GPT-4-32k) sunset. Must migrate to newer models, which may behave differently.
⚡
Data usage for training
API data not used for training by default (since March 2023). But Terms allow OpenAI to use data for 'abuse monitoring'.
⚡
No SLA on free tier
Rate limits are lower. Paid plans get priority access and higher limits.
Positives
API data not used for training by defaultEnterprise plan with data processing agreementSOC 2 certified
F
Firebase
BaaS · Reviewed 2026-04⚠
Deep Google lock-in
Firestore, Cloud Functions, Firebase Auth — all proprietary. Migration requires rewriting core app logic.
⚠
Unpredictable pricing at scale
Document reads, writes, and deletes all billed separately. Costs hard to predict with complex queries.
⚡
Data export possible but painful
Firestore export to BigQuery works. Auth users exportable. But no standard SQL dump format.
✓
Free tier is generous
Spark plan: 50k reads/day, 20k writes/day, 1GB Firestore. Good for MVPs.
Positives
Generous free tier for prototypingGoogle infrastructure reliabilityStrong mobile SDK support
D
Datadog
Monitoring · Reviewed 2026-04⚠
Extremely expensive at scale
Per-host pricing starts at $15/mo but custom metrics, APM, logs add up fast. $100k+/year is common.
⚠
Auto-discovery creates cost surprises
Agent auto-discovers and monitors new services. Each new container = new host = more cost.
⚡
Data export limited
Can export dashboards as JSON. Raw metric/log data export is limited and expensive.
⚡
3-year contracts common
Sales pushes multi-year contracts for discounts. Early termination penalties exist.
Positives
Most comprehensive monitoring platformExcellent integrationsStrong enterprise support
S
Shopify
E-commerce · Reviewed 2026-04⚠
Deep platform lock-in
Liquid templates, Shopify-specific APIs, proprietary checkout. Migration to WooCommerce or custom requires full rebuild.
⚠
Transaction fees on non-Shopify Payments
0.5–2% extra fee if you use a third-party payment processor instead of Shopify Payments.
⚡
Data export available but incomplete
CSV export for products, customers, orders. But theme customizations, metafields, and app data often lost.
⚡
App dependency creates hidden costs
Core features often require paid apps ($10-100/mo each). Subscription management, reviews, upsells — all paid extras.
Positives
Reliable infrastructure for e-commerceLarge app ecosystemPCI DSS Level 1 compliant
C
Convex
BaaS · Reviewed 2026-04⚠
Proprietary query language and runtime
Convex uses its own query/mutation model. No standard SQL. Migration requires full rewrite of data access layer.
✓
Data export available
Snapshot export to JSON or streaming export to external systems. Data is recoverable.
⚡
No self-hosted option
Fully managed only. No open-source core. If Convex shuts down, your backend needs a complete rewrite.
⚡
VC-backed startup
Well-funded but pre-profitability. Acquisition or shutdown risk inherent in startup infrastructure.
Positives
Data export via snapshot and streamingGenerous free tierSOC 2 certified
M
Microsoft Azure
Cloud · Reviewed 2026-04⚠
Egress fees like AWS
Data transfer out priced similarly to AWS (~$0.08/GB). Moving data to another cloud or on-premise is expensive.
⚡
Enterprise Agreement required for best pricing
Best discounts require multi-year Enterprise Agreements. Pay-as-you-go pricing can be 40-60% higher.
⚡
Active Directory lock-in
Deep Azure AD/Entra ID integration creates identity lock-in. Microsoft 365 + Azure AD combination is sticky.
✓
Compliance certifications comprehensive
FedRAMP High, DoD IL5, HIPAA, PCI DSS, GDPR, ISO 27001 all certified. Best enterprise compliance catalog.
Positives
Most comprehensive enterprise complianceM365 integrationHybrid cloud (Azure Arc) best-in-classFedRAMP High certified
H
HubSpot
CRM · Reviewed 2026-04⚠
Pricing scales aggressively with contacts
Free CRM is genuinely useful. But Marketing Hub scales with contacts — 50k contacts can cost $800+/month. Price jumps are non-linear.
⚡
Data export available but limited
CSV export for contacts, deals, companies. But workflows, automation logic, and custom objects require manual documentation.
⚠
Ecosystem lock-in via integrations
HubSpot integrations and native syncs (Salesforce, Gmail, etc.) create stickiness. Each integration reimplemented when switching.
✓
Free tier is genuinely useful
Free CRM has real features: contact management, deals, forms. Not a crippled bait. Good entry point.
Positives
Free CRM with real featuresData exportable via CSV and APISOC 2, ISO 27001 certifiedGDPR data tools available
S
Sendbird
Communications · Reviewed 2026-04⚠
Deep SDK coupling
Chat, video, and notifications require Sendbird SDKs (iOS, Android, Web). Switching means rewriting entire messaging layer.
⚠
Per-MAU pricing at scale
Free up to 30 MAU. After that: $99-399/month per tier. Large apps with 100k+ MAU can pay $5k+/month.
⚡
Data export available
Message history exportable via API. But message thread structure and SDKs are Sendbird-specific.
⚡
Proprietary — no self-host
No self-hosted option. If Sendbird shuts down or pricing becomes untenable, you rebuild from scratch.
Positives
Comprehensive in-app messaging SDKSOC 2, ISO 27001 certifiedHIPAA BAA available
I
Intercom
Customer Support · Reviewed 2026-04⚠
Per-seat pricing is very expensive
Starter $74/seat/month. Most teams need multiple seats. $500-2000/month is typical for small teams. One of the priciest tools in the stack.
✓
Conversation data exportable
Full conversation export via API. Contacts exportable. Migration to Crisp, Chatwoot, or Help Scout documented.
⚡
AI features require higher tiers
Fin AI and resolution bot locked to Fin add-on (+$0.99/resolution). Costs multiply with AI usage.
⚡
Deep product integration creates coupling
Product tours, banners, news feeds, checklists — all Intercom widgets. Removing means rebuilding onboarding flows.
Positives
Conversation data fully exportableBest-in-class in-app messagingSOC 2, ISO 27001 certified
S
Snowflake
Data Warehouse · Reviewed 2026-04⚠
Compute costs escalate unexpectedly
Credits billed per second of warehouse compute. Runaway queries or misconfigured auto-resume = surprise $1k-10k bills.
✓
Standard SQL — data portable
Snowflake SQL is mostly ANSI-compliant. Data stored as Parquet-compatible. Migrating to BigQuery or Redshift is painful but feasible.
⚡
Proprietary features create coupling
Snowpark, Streamlit native apps, Data Sharing, Marketplace — all Snowflake-specific. Heavy use creates lock-in.
✓
Multi-cloud — choose your cloud
Runs on AWS, GCP, Azure. Choose your preferred cloud and region. Cross-cloud data sharing is a key feature.
Positives
Standard SQL — data is portableMulti-cloud deploymentSOC 2, ISO 27001, HIPAA, PCI DSS certifiedStrong data sharing ecosystem
A
Airtable
Productivity · Reviewed 2026-04⚠
Heavy automation creates deep coupling
Airtable automations, scripts, and views are all proprietary. Migrating a complex base requires rebuilding all business logic.
⚡
Data export via CSV only
CSV export per table. No bulk export of formulas, views, or automation logic. Meaningful data portability is limited.
⚠
Pricing jumped significantly in 2023
Team plan went from $10 to $20/seat/month. Business plan $45/seat/month. Existing users were migrated without grandfather pricing.
✓
API for programmatic access
REST API for all records. Can automate export and migration. API record limit 100k on paid plans.
Positives
REST API for full record accessSOC 2 certifiedGood template ecosystem
J
Jira (Atlassian)
DevTools · Reviewed 2026-04⚠
Data export is painful
XML export of issues is available but complex to import elsewhere. Workflows, custom fields, and automation rules have no migration path.
⚠
Pricing model changed in 2024
Atlassian moved to per-user pricing tiers. Team features gated behind higher plans. Enterprise discounts require negotiation.
⚠
Plugin ecosystem creates coupling
Hundreds of paid Atlassian Marketplace plugins ($10-100/month each). Each plugin is a separate vendor and separate contract.
✓
Cloud and Data Center options
Jira Data Center: self-hosted on your servers. Full data control. Cloud: Atlassian managed. Enterprise choice.
Positives
Self-hosted Data Center optionStandard export formats (XML, CSV)SOC 2, ISO 27001, FedRAMP certified
Z
Zendesk
Customer Support · Reviewed 2026-04⚠
Annual contracts with limited cancellation
Zendesk sells annual contracts. Mid-term cancellation is not allowed. You pay for the full year even if you migrate off.
⚠
Significant price increases 2023-2025
Zendesk raised prices significantly after going private (Hellman & Friedman LBO, 2022). Suite Enterprise saw 30-40% increases. No price lock on annual contracts after renewal.
⚡
Data export available but complex
Tickets, users, organizations exportable via API/CSV. Knowledge base as HTML. Triggers, macros, and automation rules require JSON export and manual reimport to alternatives.
⚡
AI features (Fin-equivalent) bundled into higher tiers
Zendesk AI features require Suite Professional or higher. AI is not available on basic Support-only plans.
Positives
Comprehensive support platformEnterprise-grade compliance (SOC 2, HIPAA BAA)GDPR DPA availableLarge partner ecosystem
V
Vercel
Hosting · Reviewed 2026-03⚡
Price changes with 30 days notice
Vercel can change pricing with 30 days email notice. No price lock on annual plans.
⚡
Usage limits can change
Fair use policy limits (bandwidth, builds) are not contractually fixed and can be adjusted.
✓
Data export available
You can download your source code anytime. Deployments and analytics data exportable via API.
⚠
No SLA on Hobby plan
Free/Hobby tier has zero uptime guarantee. Pro has 99.99% SLA.
Positives
Source code always yoursStandard data processing agreement availableSOC 2 Type II certified
S
Stripe
Payments · Reviewed 2026-03⚠
Reserve rights on funds
Stripe can hold reserves (% of transactions) if they deem your business high-risk. Common for new accounts.
⚠
Account termination without cause
Stripe can terminate your account at any time with notice. Funds held for dispute period (120 days).
⚡
Data portability limited
Customer payment data exportable. But payment methods (cards on file) cannot be migrated to another processor.
✓
Transparent per-transaction pricing
2.9% + 30c clearly documented. Volume discounts negotiable.
Positives
Industry-standard processing ratesExcellent documentationPCI DSS Level 1 certified
C
Clerk
Auth · Reviewed 2026-03✓
User data export available
Full user data export via API. Passwords can be exported as hashes for migration.
⚡
MAU-based pricing can spike
If you go viral, costs jump immediately. No spending caps or alerts by default.
⚡
Proprietary — no self-host option
Unlike Auth0 or Keycloak, Clerk has no self-hosted version. You depend on their infrastructure.
Positives
User data fully exportablePassword hash migration supportedSOC 2 Type II certified
A
Anthropic
AI · Reviewed 2026-04⚡
Model deprecation with notice
Claude models get deprecated with ~6 months notice. Must migrate prompts to newer versions.
✓
Usage-based pricing only
Clear per-token pricing. No hidden fees. Batch API offers 50% discount.
⚡
Data retention policy
API inputs/outputs retained for 30 days for abuse monitoring. Enterprise plans can opt out.
Positives
Clear usage-based pricingAPI data not used for trainingSOC 2 Type II certifiedEnterprise agreements available
N
Netlify
Hosting · Reviewed 2026-04⚠
Bandwidth overages bill immediately
100GB/month on free tier. Overages billed at $55/100GB. A viral moment can cost hundreds.
⚡
Build minutes limited
Free: 300 min/month. Pro: 25k min/month. Complex builds can eat through this fast.
✓
Good data portability
Static sites deploy anywhere. Netlify Functions are standard AWS Lambda format.
Positives
Standard deployment formatFunctions portable to AWS LambdaSOC 2 certified
L
Lemon Squeezy
Payments · Reviewed 2026-04⚡
Higher fees than Stripe
5% + 50c per transaction (vs Stripe's 2.9% + 30c). But handles sales tax, VAT, and MoR.
⚡
Merchant of Record = less control
They are the legal seller. Good for tax compliance but limits payment customization.
⚡
Customer data partially portable
Can export customer list. But payment methods and subscriptions are not transferable.
Positives
Handles global sales tax/VAT automaticallyNo Stripe Atlas needed for international salesSimple integration for digital products
P
Pinecone
Vector DB · Reviewed 2026-04⚡
Proprietary — no self-host
Fully managed only. No open-source version. If they shut down, you need to migrate vectors.
✓
Data export available
Vectors can be fetched via API and migrated to another vector DB. Not a one-click export though.
⚡
Pricing by pod/serverless
Serverless: $0.04/1k queries. Pod-based: $70+/mo. Costs escalate with high-dimensional vectors.
Positives
Industry-standard vector DBGood documentationSOC 2 certifiedServerless option available
G
GitHub
DevTools · Reviewed 2026-04✓
Git-based — inherently portable
All code is standard Git. Clone and push to GitLab, Bitbucket, or self-hosted Gitea in minutes.
⚡
Actions lock-in
GitHub Actions workflows are GitHub-specific YAML. Migrating CI/CD to GitLab CI or CircleCI requires rewriting.
⚡
Copilot data concerns
Individual plan code snippets may feed into model training. Business tier explicitly excludes training.
✓
Microsoft ownership
Backed by Microsoft. No startup risk. But strategic priorities may shift (Copilot monetization push).
Positives
Standard Git — code always portableLargest developer ecosystemSOC 2, ISO 27001, FedRAMP certified
A
Auth0
Auth · Reviewed 2026-04⚠
MAU pricing escalates fast
Free up to 7,500 MAU. After that, pricing jumps significantly. Enterprise plans start at $23k/year.
⚡
Okta acquisition changed direction
Acquired by Okta in 2021. Product strategy shifted. Some features deprecated in favor of Okta equivalents.
✓
User data exportable
Management API allows full user export including password hashes. Migration to self-hosted Keycloak feasible.
⚡
Rules/Actions create coupling
Auth0 Rules and Actions are proprietary serverless functions. Heavy customization makes migration harder.
Positives
User data fully exportable with password hashesSelf-hosted alternative (Keycloak) existsSOC 2, ISO 27001, HIPAA certified
R
Render
Hosting · Reviewed 2026-04⚠
Free PostgreSQL expires in 90 days
Free-tier PostgreSQL databases auto-delete after 90 days. Data is lost if not backed up or upgraded.
⚡
Free web services sleep after 15 min
Free tier web services spin down after 15 minutes of inactivity. Cold starts take 30-60 seconds.
✓
Docker-based — portable
Standard Docker deployments. Move to any container platform with minimal changes.
Positives
Standard Docker containersClear pricing tiersSOC 2 certifiedManaged PostgreSQL available
D
Deno Deploy
Edge Hosting · Reviewed 2026-04⚡
Deno runtime lock-in
Code must run on Deno runtime. Node.js compatibility improving but not 100%. npm packages mostly work via npm: specifiers.
⚡
KV store is proprietary
Deno KV is Deno Deploy-specific. No standard export. Data migration requires manual rewrite.
✓
Code is portable JavaScript/TypeScript
Your actual code is standard JS/TS. Moving to Node.js or Bun requires minor adjustments.
Positives
Edge deployment globallyStandard JavaScript/TypeScriptFree tier generous (100k requests/day)Built-in KV database
S
Sanity
CMS · Reviewed 2026-04⚡
GROQ query language is proprietary
Sanity uses GROQ, a proprietary query language. Content exportable as JSON, but queries need rewriting on migration.
⚡
Content Lake is managed-only
Content Lake (hosted datastore) has no self-hosted option. Content exportable via CLI but storage is Sanity-dependent.
✓
Generous free tier
Free plan: 100k API requests/day, 500k assets, 3 users. Reasonable for small projects.
⚡
Overage pricing can spike
API CDN requests beyond plan billed at $1/10k. A traffic surge can create unexpected costs.
Positives
Full content export via CLI (ndjson)Real-time collaboration built-inCustom Studio is open source React app
C
Contentful
CMS · Reviewed 2026-04⚠
Expensive at scale
Free: 5 users, 25k records. Team starts at $300/mo. Enterprise pricing is opaque and often $2k+/mo.
✓
Content export available
Full content export via CLI and API. Migrations to Strapi or Sanity are well-documented community paths.
⚡
Rate limits on free tier
Free tier: 55 requests/second. Can throttle during build if many pages fetch content.
Positives
Content fully exportableWell-documented APISOC 2 certifiedStrong enterprise compliance
H
Hasura
API Gateway · Reviewed 2026-04✓
Open source core available
Hasura CE is open source (Apache 2.0). Self-host with Docker. GraphQL layer over your Postgres.
⚡
Cloud-only features in Enterprise
Caching, observability, SSO are Cloud/Enterprise only. CE lacks features you might grow to need.
⚡
Schema coupling
Hasura metadata (permissions, relationships, actions) is Hasura-specific. Migration means rewriting authorization layer.
✓
Data stays in your database
Hasura is a layer over YOUR Postgres. Remove Hasura and your data is untouched.
Positives
Open source core (Apache 2.0)Data stays in your PostgresSelf-hostableNo data lock-in whatsoever
T
Twilio SendGrid
Email · Reviewed 2026-04✓
Generous free tier
100 emails/day forever on free tier. Good for development and small apps.
⚡
Twilio acquisition added complexity
Billing merged with Twilio. Account management more complex. Support quality reportedly declined.
✓
Standard SMTP/API — portable
Standard SMTP and REST API. Switching to Resend, Postmark, or Mailgun takes hours.
⚠
Account suspension risk
Aggressive automated fraud detection. Accounts sometimes suspended without warning. Recovery can take days.
Positives
Standard SMTP — zero lock-in100 emails/day free foreverStrong deliverability reputation
C
CircleCI
CI/CD · Reviewed 2026-04⚡
Proprietary CI config format
.circleci/config.yml is CircleCI-specific. Orbs are CircleCI's reusable config — not portable.
⚠
2023 security breach
January 2023 security incident exposed customer secrets. All secrets had to be rotated. Trust concern.
✓
Docker-based builds — partially portable
Build steps run in Docker. Individual build steps are standard shell commands — portable.
⚡
Credits-based pricing can spike
Credit consumption varies by resource class. Large parallel builds can burn credits faster than expected.
Positives
Docker-based executionGood parallelism supportSOC 2 certified
H
HashiCorp Vault
Security · Reviewed 2026-04⚠
BSL license since 2023
Changed from MPL 2.0 to BSL 1.1 in August 2023. Competing products cannot use it. Community fork: OpenBao.
✓
Self-hosted option available
Can self-host Vault. Full control over secrets. HCP Vault adds managed convenience.
⚡
Complex operations
Unsealing, replication, audit logging — Vault ops are complex. Requires dedicated expertise.
✓
Secrets export available
All secrets accessible via API. Migration to Doppler, Infisical, or AWS Secrets Manager is feasible.
Positives
Self-hostableIndustry-standard secrets managementRich audit loggingMany auth backends
N
New Relic
Monitoring · Reviewed 2026-04✓
Generous free tier — 100GB/month
100GB free ingest per month. One full-platform user free. Actually usable for small teams.
⚠
Data ingest pricing can spike
Beyond 100GB free: $0.35/GB ingest. APM agents can generate 50+ GB/month per service easily.
⚡
NRQL is proprietary
New Relic Query Language is proprietary. Dashboards and alerts not portable to Grafana or Datadog.
⚡
Data export via NRQL API
Raw data queryable and exportable via API. But formats are New Relic-specific.
Positives
100GB/month free ingestAll-in-one observability platformSOC 2, FedRAMP certified
T
Twilio
Communications · Reviewed 2026-04⚠
Phone number ownership ambiguity
You rent phone numbers from Twilio. Porting numbers out requires carrier support and can take weeks. Phone number portability is not guaranteed in all countries.
⚠
Account suspension without warning
Twilio aggressively monitors for spam/abuse. Accounts suspended if abuse detected — even false positives. Reinstatement can take days.
✓
Usage-based pricing — clear
Per-message, per-minute pricing. Transparent rate cards. No hidden fees. Volume discounts available.
⚡
Standard APIs — partially portable
TwiML and Twilio API are Twilio-specific but widely understood. Switching to Vonage/Plivo requires rewriting API calls but not core logic.
Positives
Industry-standard SMS/voice APIsTransparent per-unit pricingSOC 2, ISO 27001 certifiedHIPAA BAA available
O
Okta
Auth · Reviewed 2026-04⚠
Expensive — enterprise pricing only
No meaningful free tier. Starter ~$2/MAU. Workforce Identity separate product. Total cost can hit $100k+/year for large orgs.
⚠
2022 breach — Lapsus$ group
January 2022: Lapsus$ group accessed support system, potentially viewing ~2.5% of customer tenants. Trust significantly impacted.
✓
User data exportable
Full user export via API. Password hash migration possible. SCIM support for standard provisioning.
✓
Deep enterprise integrations
HR system sync (Workday, BambooHR), 7000+ app integrations, adaptive MFA. Switching loses all these integrations.
Positives
User data fully exportableSCIM provisioning standardSOC 2, ISO 27001, HIPAA, FedRAMP certified
P
PlanetScale
Database · Reviewed 2026-04✓
MySQL-compatible — portable
Standard MySQL wire protocol. Migrate with mysqldump. No proprietary query language.
⚡
Branching requires schema workflow
Schema changes require deploy requests (no DDL in production). Powerful but forced workflow that differs from standard MySQL ops.
⚠
Removed free tier in 2024
PlanetScale eliminated the free tier in April 2024. Minimum spend now $39/month. Projects relying on free tier had to migrate.
⚡
Vitess under the hood
Powered by Vitess (YouTube's MySQL sharding layer). Some MySQL features unavailable: no foreign keys enforced, no full-text search in some configs.
Positives
Standard MySQL — fully portable with mysqldumpHorizontal sharding via VitessSOC 2, HIPAA certified
L
LogRocket
Monitoring · Reviewed 2026-04⚠
Session replay creates PII risk
Records user sessions including keystrokes. Requires careful PII scrubbing configuration to avoid GDPR violations. Default settings may capture sensitive fields.
⚡
Proprietary — no self-host
Cloud-only SaaS. No self-hosted option. Raw session data not easily exportable.
⚡
Per-session pricing
Priced by monthly active sessions. High-traffic products can see significant costs. 1000 sessions/month free.
⚡
SDK required in frontend
JavaScript SDK must be bundled. Adds ~60-70KB gzipped. Cannot be used without SDK instrumentation.
Positives
Best session replay in classIntegrates with Sentry, Datadog, IntercomSOC 2 certified
S
Segment (Twilio)
Analytics · Reviewed 2026-04✓
Customer data portable via API
Segment stores events 30-180 days. Full replay and export via API. Moving to RudderStack (open source) is documented.
⚠
Expensive at scale
Free up to 1000 MTU/month. Team plan $120/month. Business plan pricing opaque — enterprise deals often $50k+/year.
⚡
Twilio acquisition quality concerns
Acquired by Twilio in 2020. Product investment reportedly declined. Some customers migrating to RudderStack or PostHog.
⚡
Destination connections are proprietary wiring
Segment's 450+ destination connections are a key differentiator but also coupling. Each must be reconfigured on migration.
Positives
Industry standard CDPData fully portable via API and replaySOC 2, ISO 27001 certified
A
Algolia
Search · Reviewed 2026-04✓
Index data fully exportable
Browse API returns all indexed records. Exporting to Typesense or MeiliSearch (both open source) is well-documented.
⚡
Search-record pricing model opaque
Pricing by search operations + records. Overly complex. Easy to underestimate costs when indexing deeply nested objects.
⚡
Proprietary ranking and relevance config
Algolia ranking, facets, and synonyms config is Algolia-specific. Recreating relevance tuning on another engine requires significant effort.
✓
Generous free tier
Free: 10k search requests/month, 1M records. Enough for small to medium projects.
Positives
Data fully exportable via Browse APIIndustry-leading search relevanceSOC 2, ISO 27001 certified
M
Mixpanel
Analytics · Reviewed 2026-04✓
Event data exportable
Raw event export via Data Export API. Events stored as JSON. Migration to Amplitude or PostHog feasible.
✓
Retroactive data processing
Lexicon and schema changes apply retroactively. Fixes bad tracking without reingesting. Competitor differentiator.
⚡
Free tier reduced
Free plan: 20M events/month as of 2023 (previously unlimited). Sufficient for most startups but a precedent for reduction.
⚡
EU data residency limited
EU data residency available on Enterprise plan only. GDPR compliance requires Enterprise for EU-hosted data.
Positives
Raw event data exportableGenerous free tierSOC 2 certifiedGDPR compliant
P
PagerDuty
Monitoring · Reviewed 2026-04✓
Per-user pricing — predictable
Fixed per-user pricing. No usage-based surprises. Free for up to 5 users with basic features.
✓
Incident and alert data exportable
Full API access to incidents, alerts, schedules. Migration to OpsGenie or incident.io is well-documented.
⚡
On-call schedule migration is manual
Complex on-call schedules, escalation policies, and team structures require manual recreation when switching vendors.
⚡
Proprietary routing and escalation logic
Event routing rules and ML-based noise reduction are PagerDuty-specific. Recreating these on another platform takes weeks.
Positives
Transparent per-user pricingFull API — data portableSOC 2, ISO 27001 certified
E
Elastic Cloud
Search/Logs · Reviewed 2026-04⚡
License changed twice (2021, 2024)
Apache 2.0 → SSPL+Elastic v2 (2021), then added AGPL-3.0 option (2024). Resulted in OpenSearch fork. Choose your license carefully.
✓
Snapshot/restore is portable
Snapshots write to S3-compatible storage. Restore to any Elasticsearch or OpenSearch cluster. Standard data portability.
⚡
Pricing per resource
Billed per RAM/storage allocated. Easy to over-provision. ML features (Platinum) and SIEM (Enterprise) gated behind higher tiers.
Positives
AGPL-3.0 option restoredSnapshot/restore for full data portabilitySOC 2, ISO 27001, HIPAA certified
E
ElevenLabs
AI · Reviewed 2026-04⚠
Voice cloning ToS restrictions
ToS prohibits cloning voices without explicit consent. Account termination for misuse. Generated audio may be watermarked for traceability.
⚡
Per-character pricing scales fast
Free 10k characters/month. Creator $22/mo for 100k. Pro $99/mo for 500k. Audiobook-scale usage hits enterprise pricing fast.
✓
Standard API — easy to switch
REST API for TTS. Migration to OpenAI TTS, PlayHT, or Cartesia is straightforward — voice IDs change but integration is simple.
⚡
Custom voices stay on platform
Cloned voices are not exportable. Switching providers means re-cloning voices on the new platform.
Positives
Best-in-class voice qualityStandard REST APISOC 2 Type II certified
P
Perplexity API
AI · Reviewed 2026-04✓
OpenAI-compatible API
API mirrors OpenAI's chat completions format. Switching to/from OpenAI requires only base URL change. Excellent portability.
⚡
Sonar model proprietary
Sonar online models (search-grounded) are Perplexity-specific. No equivalent at OpenAI/Anthropic — switching loses live web search capability.
⚡
Citation format is custom
Citations returned in Perplexity-specific format. Apps relying on citation rendering need adapter when switching.
Positives
OpenAI-compatible chat APITransparent per-token pricingStandard REST integration
G
Groq
AI API · Reviewed 2026-04✓
No data retention on paid API by default
API requests and responses are not retained for training on paid plans. Clear zero-retention policy documented.
⚡
LPU hardware — vendor-specific hardware risk
Groq runs on proprietary LPU (Language Processing Unit) chips. If Groq closes or pivots, the specific hardware performance characteristics cannot be replicated elsewhere.
✓
API compatible with OpenAI SDK
Groq API is OpenAI-compatible. Switching to OpenAI, Together AI, or Fireworks requires changing only the base URL and API key.
⚡
Rate limits change frequently
Rate limits on free tier change often as Groq manages capacity. Production apps should not rely on free-tier limits staying constant.
Positives
OpenAI-compatible API — easy to switchNo training on paid API dataSOC 2 Type II certifiedTransparent pricing per 1M tokens
T
Temporal Cloud
Workflow Engine · Reviewed 2026-04⚠
SDK lock-in — deep integration
Temporal SDK penetrates every layer of your application code. Migrating away requires rewriting all workflow and activity code — not just config changes.
⚡
Workflow history is non-portable
Running workflow instances cannot be migrated live to another system. You must drain all workflows before switching. Can take days/weeks for long-running workflows.
✓
mTLS for all traffic
All worker-to-Temporal communication uses mutual TLS. No plaintext options on Cloud. Certificate rotation handled automatically.
⚡
Action-based pricing can spike
Pricing based on Workflow Actions (state transitions). Loops, retries, and signals all count. Buggy workflows can generate unexpected Action counts and bills.
✓
Open source self-host option
Temporal Server is Apache 2.0 licensed. Self-host on your own Kubernetes cluster as escape hatch. Temporal Cloud is convenience, not a requirement.
Positives
Apache 2.0 open-source serverSelf-host as exit strategyStrong mTLS security postureSOC 2 Type II certified
S
Segment (Twilio)
Analytics/CDP · Reviewed 2026-04⚡
Data forwarding to 400+ destinations
Segment forwards your customer data to every destination you enable. Each destination is an additional data processor — review all sub-processors in your DPA.
✓
Workspace data exportable
Full event replay to any destination. Historical data exportable via AWS S3 destination or direct API. Profiles API exports user trait data.
⚠
Price increases post-Twilio acquisition
Segment pricing increased significantly after Twilio acquisition (2020). Growth plan costs scaled with MTU count in ways that surprised many startups post-viral-growth.
⚡
GDPR deletion propagation delay
Deleting a user in Segment can take up to 30 days to propagate to all connected destinations. Ensure downstream destinations also implement deletion for GDPR compliance.
Positives
Comprehensive DPA with sub-processor listHIPAA BAA available on Business planSOC 2 Type II certified
M
Mistral AI
AI API · Reviewed 2026-04✓
EU-hosted — strong data residency story
Mistral's La Plateforme is hosted in EU (OVH/Azure Europe). Data stays in EU by default. Good for GDPR-sensitive applications.
⚠
Free tier data used for training
Free API tier inputs/outputs may be used to improve Mistral models. Paid tier excludes training. Always use paid tier for production and sensitive use cases.
⚡
Le Chat consumer product has separate terms
Le Chat (consumer app) has different data terms than La Plateforme (API). Ensure your integration uses the API terms, not Le Chat terms.
✓
Open weights models — ultimate escape hatch
Mistral releases open-weights versions of their models (Mistral 7B, Mixtral 8x7B, etc.). Run locally via Ollama or LM Studio without any API dependency.
Positives
EU-hosted infrastructureOpen weights models available for self-hostingOpenAI-compatible APITransparent pricing
C
Cloudflare Workers
Edge Hosting · Reviewed 2026-04⚡
Non-standard runtime — V8 isolates not Node.js
Cloudflare Workers runs V8 isolates, not Node.js. Many Node.js APIs are unavailable. Code written for Workers often needs polyfills or rewrites for other runtimes.
✓
Free tier is genuinely free with 100K req/day
Workers free tier: 100,000 requests/day, 10ms CPU time per invocation. No credit card required. Higher limits on $5/month Workers Paid.
⚡
KV, R2, D1 vendor lock-in
Workers KV, R2, and D1 are proprietary to Cloudflare. Code using these services needs significant rework to run on AWS Lambda, Deno Deploy, or Vercel Edge.
⚠
Durable Objects — strong lock-in
Durable Objects provide stateful coordination uniquely on Cloudflare's network. No equivalent exists elsewhere. Code using Durable Objects cannot be migrated without a full rewrite.
✓
No bill spikes — CPU-time billing
Billed on CPU time (ms), not wall-clock time. Idle time during I/O is free. This prevents the surprise bills common with Lambda or Cloud Functions.
Positives
CPU-time billing avoids I/O cost surprisesGlobal edge network includedR2 has zero egress feesWrangler CLI for local dev
C
Convex
BaaS · Reviewed 2026-04⚠
Proprietary runtime — high lock-in
Convex functions run in a proprietary runtime. No self-hosting. Migrating away requires rewriting entire backend.
✓
Data export available
Snapshot export to JSON. Streaming export for ongoing sync. Data is recoverable but format is Convex-specific.
⚡
Pricing tied to function calls + storage
Pay per function call, database storage, bandwidth. Costs can spike with traffic. No spend caps by default.
Positives
SOC2 Type II certifiedGenerous free tierReal-time sync included at no extra costDPA available
E
Encore
Framework · Reviewed 2026-04⚡
Open source framework, proprietary cloud
Encore framework is open source. Encore Cloud (hosting + tracing) is proprietary. Framework works without cloud but loses observability features.
⚡
Code annotations — moderate lock-in
Encore uses code annotations and a custom compiler. Removing Encore requires rewriting service definitions and infrastructure bindings.
Positives
Framework is open sourceBuilt-in tracing without external serviceMulti-cloud deploy supportDPA available
S
Supabase
Database · Reviewed 2026-03✓
Open source — no lock-in
Core is open source. You can self-host anytime. pg_dump exports everything.
⚡
Project pausing on free tier
Free projects auto-pause after 7 days of inactivity. Data preserved but cold starts.
⚡
Price changes with notice
30 days notice for pricing changes. Grandfathering not guaranteed.
Positives
Fully open source corepg_dump compatible — zero lock-inHIPAA BAA available on Team planData stays in your chosen region
R
Railway
Hosting · Reviewed 2026-03✓
Usage-based — predictable
Pay for what you use. Clear per-vCPU and per-GB-RAM pricing. No hidden fees.
✓
Docker-based — portable
Everything runs in Docker. Move to any Docker host with zero code changes.
⚡
Startup — acquisition risk
Venture-backed startup. If acquired or shut down, your Docker containers run anywhere.
Positives
Docker-native = zero lock-inTransparent pricingDatabase credentials fully accessible
C
Cloudflare
CDN/Hosting · Reviewed 2026-04✓
Generous free tier — real
Free plan includes unlimited bandwidth, DDoS protection, CDN. No bait-and-switch.
⚡
Workers have limits
Workers free tier: 100k requests/day, 10ms CPU time. Paid: 10M requests included.
⚡
Terms prohibit non-HTML serving on free CDN
Free plan CDN is technically for HTML sites only. Video/file hosting may violate ToS.
Positives
Zero egress feesOne of the most generous free tiersGlobal network in 300+ citiesSOC 2, ISO 27001 certified
F
Fly.io
Hosting · Reviewed 2026-04✓
Docker-based — fully portable
Everything runs as Docker containers. Move to any container platform with zero changes.
✓
Pricing transparent
Per-second billing for VMs. Clear pricing page. No surprise fees.
⚡
Startup — smaller team
Smaller company than alternatives. Support response times can be slower.
Positives
Docker-native = zero lock-inGlobal edge deploymentTransparent per-second billingPostgres included
N
Neon
Database · Reviewed 2026-04✓
Open source — Postgres compatible
Neon is open source (Apache 2.0). Uses standard Postgres — pg_dump works. Zero proprietary query language.
⚡
Branching creates storage costs
Database branching is a killer feature but each branch consumes storage. Heavy branching workflows can spike bills.
⚡
Autoscaling can surprise
Compute scales to zero on free tier (cold starts ~500ms). Pro plan autoscaling can overshoot if not capped.
⚡
Startup risk
VC-backed startup. If acquired or shut down, data is standard Postgres — migrate with pg_dump anywhere.
Positives
Fully open source core (Apache 2.0)Standard Postgres — zero lock-inGenerous free tier with 0.5GB storage
T
Turso
Database · Reviewed 2026-04✓
Open source — libSQL fork of SQLite
Based on libSQL, an open fork of SQLite. Data is portable — export as standard SQLite database file.
⚡
Edge replication adds complexity
Multi-region replication is automatic but adds latency for writes. Consistency model requires understanding.
⚡
Embedded replicas lock to SDK
Embedded replicas feature requires Turso's SDK. Moving away means rewriting the local sync layer.
Positives
Open source libSQL coreSQLite-compatible — data fully portableGenerous free tier (9GB storage, 500 databases)
R
Resend
Email · Reviewed 2026-04✓
Simple API — easy to switch
REST API for sending email. Standard SMTP also supported. Switching to SendGrid/Postmark takes hours.
⚡
No email receiving
Send-only service. If you need inbound email processing, you'll need a second provider.
⚡
Young product — limited features
No built-in email templates editor, limited analytics compared to Mailgun or SendGrid.
✓
React Email integration
First-class React Email support. Templates as React components — fully portable.
Positives
Standard REST + SMTP — zero lock-inReact Email integrationTransparent pricing with generous free tier
P
PostHog
Analytics · Reviewed 2026-04✓
Open source — self-host available
MIT licensed. Full self-hosted version available. No feature gating between cloud and self-hosted.
⚡
Event-based pricing can spike
Free up to 1M events/month. After that, per-event pricing. High-traffic sites can see unexpected bills.
✓
Data warehouse export
Export raw event data to S3, BigQuery, or Snowflake. ClickHouse-based — data is queryable.
Positives
Fully open source (MIT)Self-hostable — complete data controlAll-in-one: analytics, feature flags, session replay
L
Linear
DevTools · Reviewed 2026-04⚡
Proprietary — no self-host
Closed source, cloud-only. No self-hosted option. If Linear shuts down, you lose your project management tool.
✓
Good data export
CSV export for issues. Full API access. Bulk export available. Migration to Jira or GitHub Issues feasible.
✓
Per-seat pricing — predictable
$8/user/month (Standard). No usage-based surprises. Free tier for small teams.
⚡
Limited customization
Opinionated workflow. If you need heavy customization, Jira is more flexible (but more complex).
Positives
Transparent per-seat pricingFull API and CSV exportSOC 2 certified
I
Inngest
Background Jobs · Reviewed 2026-04✓
Open source — self-host available
Inngest server is open source (Apache 2.0). Self-host as a fallback. Functions are just your code.
⚡
SDK coupling
Inngest SDK wraps your functions. Removing it means refactoring to a standard queue system (BullMQ, SQS).
⚡
Startup risk
VC-backed startup. Open-source core mitigates shutdown risk — you can self-host.
Positives
Open source server (Apache 2.0)Functions are your own codeSelf-host fallback available
T
Trigger.dev
Background Jobs · Reviewed 2026-04✓
Open source — self-host available
Fully open source (Apache 2.0). Self-hosted version available with Docker Compose.
⚡
v3 breaking changes
v3 was a major rewrite from v2. SDK and task definitions changed significantly. Expect continued evolution.
⚡
Young ecosystem
Smaller community than established job queues. Fewer integrations and examples available.
Positives
Fully open source (Apache 2.0)Self-hostableTypeScript-nativeGenerous free tier
A
Appwrite
BaaS · Reviewed 2026-04✓
Open source — self-host available
Fully open source (BSD 3-Clause). Docker-based self-hosting. No proprietary cloud-only features.
⚡
Smaller ecosystem than Firebase
Fewer SDKs, integrations, and community resources compared to Firebase or Supabase.
✓
Data export via REST API
Full data export via API. Databases backed by MariaDB — standard SQL dump works on self-hosted.
Positives
Fully open source (BSD 3-Clause)Self-hostable with DockerNo vendor lock-inData fully portable
S
Strapi
CMS · Reviewed 2026-04✓
Open source — self-host anywhere
MIT licensed. Self-host on any Node.js server. Uses standard databases (PostgreSQL, MySQL, SQLite).
⚡
Strapi Cloud adds managed features
Strapi Cloud has features not in self-hosted (analytics, team management). But core CMS is identical.
⚡
Plugin ecosystem fragmented
v4→v5 broke many community plugins. Plugin quality varies. May need to maintain custom plugins.
Positives
Fully open source (MIT)Standard database — pg_dump worksSelf-hostable anywhereNo content lock-in
D
DigitalOcean
Cloud · Reviewed 2026-04✓
Predictable pricing
Fixed monthly pricing for Droplets. $4/mo for smallest VM. No surprise bills from hidden dimensions.
⚡
Smaller service catalog than AWS
Limited managed services compared to AWS/GCP. May outgrow DO and need multi-cloud or migration.
✓
Reasonable egress fees
1TB free outbound transfer per Droplet. Overages at $0.01/GB — 9x cheaper than AWS.
Positives
Predictable flat pricingLow egress feesSimple billingSOC 2, ISO 27001 certified
M
Mailgun
Email · Reviewed 2026-04✓
Standard SMTP and API
Standard SMTP relay and REST API. Migration to any other email provider is straightforward.
⚡
Free tier reduced
Was 10k/month free. Now just a trial period. Flex plan starts at $0.80/1k emails after trial.
✓
Inbound email processing
Supports inbound email routing and parsing. Not all providers offer this — adds migration friction if used.
Positives
Standard SMTP — fully portableInbound email processingGood deliverabilityTransparent per-email pricing
G
GitLab
DevTools · Reviewed 2026-04✓
Git-based — inherently portable
Standard Git. Clone and push to GitHub, Bitbucket, or self-hosted Gitea. Code never locked in.
✓
Self-hosted option available
GitLab CE is open source (MIT). Full self-hosted deployment. Complete data sovereignty.
⚡
CI/CD is GitLab-specific YAML
.gitlab-ci.yml format is GitLab-specific. Migrating CI pipelines to GitHub Actions or CircleCI requires rewriting.
⚡
Free tier reduced over time
Free tier reduced from unlimited to 5GB storage, 400 CI minutes/month. May reduce further.
Positives
Open source CE edition (MIT)Self-hostable — full data controlStandard Git — code always portableAll-in-one DevOps platform
D
Doppler
Security · Reviewed 2026-04✓
Secrets fully exportable
Export all secrets as .env, JSON, YAML. No proprietary format. Migration to Vault or Infisical straightforward.
⚡
Proprietary — no self-host
Cloud-only SaaS. No self-hosted option. But secrets format is standard — switching is easy.
✓
Per-seat pricing — predictable
Free for 5 users. $4/user/month for Team. No usage-based surprises.
Positives
Standard secret formats — zero lock-inSimple per-seat pricingSOC 2 Type II certifiedGood CLI and integrations
I
Infisical
Security · Reviewed 2026-04✓
Open source — self-host available
MIT licensed. Full self-hosted version with Docker. No feature gating between cloud and self-hosted.
⚡
Young product — evolving rapidly
API and SDK breaking changes between versions. Fast iteration means migration guides sometimes lag.
✓
Standard secret formats
Export as .env, JSON. Standard formats. Migration to Vault or Doppler straightforward.
Positives
Fully open source (MIT)Self-hostable with DockerStandard export formatsE2E encryption
B
BetterStack
Monitoring · Reviewed 2026-04✓
Uptime monitoring is straightforward
HTTP checks, heartbeats, status pages. Standard monitoring — switching to Checkly or UptimeRobot is easy.
✓
Log management uses ClickHouse
Logs searchable via SQL-like queries. Data exportable. Not deeply proprietary.
⚡
Pricing per-seat + per-data
Logs pricing based on retention and volume. Can escalate with high-volume services.
Positives
Simple uptime monitoring — easy to switchTransparent pricingGood status page featureSOC 2 certified
S
Sentry
Monitoring · Reviewed 2026-04✓
Open source — self-host available
Sentry is open source (FSL-1.1 for new code, Apache 2.0 for older). Full self-hosted Docker Compose setup. Feature-parity with cloud.
⚡
Event-volume pricing can spike
Priced per error event. A new bug hitting production can send 100k events in minutes, burning through monthly quota.
⚡
FSL license for newer features
New Sentry features ship under Functional Source License (non-compete for 2 years, then Apache 2.0). Competitors cannot use newer code immediately.
⚡
Data residency limited
Cloud hosted in US by default. EU data residency available on Business+ plans. Self-host for full control.
Positives
Self-hostable with full feature parityStrong data portability via APISOC 2, ISO 27001 certified
U
Upstash
Database · Reviewed 2026-04✓
Redis-compatible — highly portable
Standard Redis protocol. Switch to self-hosted Redis or other Redis-compatible services with zero code changes.
⚡
Per-request pricing at small scale
Free tier: 10k commands/day. Pay-per-request after that. High-traffic apps should calculate carefully vs fixed-price Redis.
⚡
Startup risk
VC-backed startup. But Redis compatibility means migration risk is very low — standard Redis client code runs anywhere.
✓
Global replication option
Global database replicates to multiple regions. Reads served from nearest region. No other managed Redis offers this at startup-friendly pricing.
Positives
Standard Redis protocol — zero lock-inTransparent per-request pricingSOC 2 certifiedGlobal replication available
C
Coolify
Hosting · Reviewed 2026-04✓
Open source — self-host on your VPS
Fully open source (Apache 2.0). Deploy on any VPS. You own the infrastructure — no vendor can shut you down.
✓
Cloud option available
Coolify Cloud (managed) available for those who don't want to manage the control plane. But self-host is always an option.
⚡
Smaller ecosystem
Fewer integrations and marketplace templates than Railway or Render. May need more manual configuration.
⚡
No built-in SLA
Self-hosted means your own uptime responsibility. Coolify Cloud offers basic SLA. Not suitable for enterprises needing 99.99%.
Positives
Fully open source (Apache 2.0)Run on your own VPS — complete controlDocker and Docker Compose nativeNo vendor lock-in by design
1
1Password Teams
Security · Reviewed 2026-04✓
Data export in standard formats
Export vault as 1PIF or CSV. Items migratable to Bitwarden or KeePass. No meaningful lock-in for credential data.
✓
Secret Key architecture
Two-secret model (master password + Secret Key) means even 1Password cannot decrypt your vault. Zero-knowledge design.
✓
Per-seat pricing — predictable
$7.99/user/month (Teams). $19.95/user/month (Business). No usage-based surprises.
⚡
Proprietary — no self-host
Cloud-only. No self-hosted option. But export is straightforward, and credential formats are standard.
Positives
Standard export formats — easy to switchZero-knowledge encryptionSOC 2, ISO 27001 certifiedGDPR compliant
C
Cloudflare R2
Object Storage · Reviewed 2026-04✓
Zero egress fees
No data transfer out fees, ever. AWS S3 charges $0.09/GB egress — R2 charges $0. Massive cost difference for read-heavy workloads.
✓
S3-compatible API
Standard S3 API. aws-cli, boto3, rclone all work. Migration to or from S3 is straightforward.
⚡
Class A operations cost more
Writes (Class A) at $4.50/M, reads (Class B) at $0.36/M. Heavy write workloads can be more expensive than S3.
⚡
Newer service — fewer regions
Launched 2022. Fewer geographic regions than S3. Object Lifecycle and replication features still maturing.
Positives
Zero egress fees by designS3-compatible — no lock-inSOC 2, ISO 27001, PCI DSS certified
S
Supabase (Enterprise)
BaaS · Reviewed 2026-04⚡
Read replicas Pro+
Read replicas, point-in-time recovery, and HIPAA BAA require Team or higher tiers ($599+/mo).
⚡
Edge Functions Deno-based
Edge Functions run on Deno, not Node.js. Some npm packages don't work. Migration to Vercel Functions or Cloudflare Workers requires rewrites.
✓
Standard Postgres data
Fully open Postgres. pg_dump/pg_restore work. RLS policies are standard SQL — portable to any Postgres host.
Positives
Open source core (Apache 2.0/MIT)Standard Postgres — no lock-inEU data residency availableSOC 2, HIPAA available
W
Wasabi Hot Cloud Storage
Object Storage · Reviewed 2026-04✓
No egress or API fees
Flat $6.99/TB/month. No egress charges, no API request fees. 80% cheaper than AWS S3 for typical workloads.
⚡
90-day minimum storage duration
Objects deleted before 90 days still billed for the full 90 days. Discourages frequent delete/replace cycles.
✓
S3-compatible API
Standard S3 API works with all S3 tools and SDKs. Migration via rclone or aws-cli is trivial.
⚡
Acceptable use policy on egress
Free egress is capped at 100% of stored data per month. Above that, Wasabi may throttle or require an enterprise contract.
Positives
Flat predictable pricingS3-compatible — fully portableSOC 2, HIPAA, GDPR compliant
B
Backblaze B2
Object Storage · Reviewed 2026-04✓
Cheap storage, free Cloudflare egress
$6/TB/month storage. Free egress to Cloudflare via Bandwidth Alliance. ~5x cheaper than S3 for static asset workloads.
✓
S3-compatible since 2020
Standard S3 API. Native B2 API also available. rclone, aws-cli, terraform all work out-of-box.
⚡
Some enterprise features missing
No native AWS-style IAM. Application Keys are simpler but less granular. No KMS, no event notifications.
Positives
S3-compatible — no lock-inFree Cloudflare egress (Bandwidth Alliance)SOC 2, ISO 27001 certifiedGDPR compliant
T
Tigris Data
Object Storage · Reviewed 2026-04✓
Globally distributed S3-compatible
Single bucket, multi-region with strong consistency. S3-compatible API. Fly.io's recommended object storage.
✓
Zero egress fees
No egress charges. Pricing by storage and operations. Cost-effective vs AWS for read-heavy workloads.
⚡
Smaller company — startup risk
Smaller team than AWS or Cloudflare. S3 compatibility means migration risk is low — standard tools work for export.
Positives
S3-compatible — fully portableZero egress feesStrong consistency across regionsSOC 2 Type II certified
S
Supabase Vector (pgvector)
Vector DB · Reviewed 2026-04✓
pgvector — open source
Built on pgvector Postgres extension. PostgreSQL License (BSD-style). Self-host or migrate to any Postgres with pgvector enabled.
✓
Standard SQL queries
Vector search via standard SQL (ORDER BY embedding <=> query). No proprietary query language. Migration to Neon, Crunchy Bridge, or self-hosted is trivial.
⚡
HNSW index limitations
pgvector HNSW indexes are slower at billion-scale than dedicated vector DBs (Pinecone, Qdrant). Best for under 100M vectors.
Positives
pgvector is open source (BSD-style)Standard PostgreSQL — zero lock-inSQL-native vector queriesData fully portable via pg_dump
P
Plausible Analytics
Analytics · Reviewed 2026-04✓
No personal data collected — GDPR by design
Plausible does not collect IP addresses, cookies, or device fingerprints. No personal data means no GDPR consent banners required for analytics.
✓
Data exportable as CSV/JSON
All stats and raw data exportable via API or CSV. Self-host on your own infra using the same open-source codebase.
✓
EU hosting by default
Plausible Cloud is hosted in EU (Hetzner, Germany and France). GDPR-friendly by default. EU SCCs not needed as data stays in EU.
⚡
Aggregated data only — no per-user events
Unlike Mixpanel or PostHog, Plausible does not provide per-user event streams or session replay. Not suitable for product analytics requiring individual user journeys.
Positives
Privacy-first — no personal data collectedAGPL open source — self-host for zero lock-inEU hosting included by defaultNo cookie consent banner needed
R
Resend
Email · Reviewed 2026-04✓
No spam filtering lock-in
You bring your own domain and DNS records. IP reputation tied to your domain, not Resend's shared IPs on paid plans.
✓
React Email templates are code in your repo
Templates are React components in your codebase. No vendor format. Works with any email provider that accepts HTML.
⚡
No SOC 2 yet (as of 2026)
Resend is growing fast but hasn't published SOC 2 Type II report as of early 2026. Not suitable for healthcare or heavily regulated industries without this.
✓
Audience data exportable
Contact lists exportable as CSV. Suppression lists accessible via API. Domain verification DNS records transfer to any provider.
Positives
React Email templates in your codebaseStandard SMTP fallback availableDomain reputation stays with youSimple per-email pricing
M
Mailgun (Sinch)
Email · Reviewed 2026-04⚡
Acquired by Sinch — pricing changes followed
Mailgun was acquired by Sinch in 2021. Free tier was subsequently reduced from 5,000 to 1,000 emails/month. Prices for paid plans increased in 2022.
⚡
Log retention limited on lower tiers
Email logs retained for only 3 days on Foundation plan, 30 days on Scale. Important for debugging — ensure your plan has sufficient retention.
✓
Standard SMTP and API
Standard SMTP port 587 supported. API format is simple HTTP. Switching to SendGrid, Postmark, or Resend requires only endpoint and key changes.
✓
EU data residency available
EU region available (Frankfurt). Data stays in EU for compliance. Select region during signup or via API base URL.
Positives
Industry-standard SMTP interfaceEU region availableSuppression list managementSPF/DKIM/DMARC configuration guides
P
PostHog
Analytics · Reviewed 2026-04✓
Open source — self-host option is real
PostHog Community is MIT licensed and runs on your own infrastructure. Full feature parity with Cloud for product analytics.
✓
Event data fully exportable
Raw events queryable via SQL on self-hosted. Cloud exports to S3 or GCS. Historical data importable to ClickHouse, BigQuery, or any warehouse.
⚡
Session recordings contain PII risk
Session recordings capture network requests, form inputs, and DOM content by default. Enable autocapture with caution — mask sensitive fields explicitly.
⚡
Feature flags and experiments integrated
PostHog's feature flag SDK is woven into your frontend code. Migrating to LaunchDarkly or Split.io requires updating flag evaluation calls throughout the app.
Positives
MIT/AGPL open source — self-host or cloudEvents, recordings, feature flags in one productEU Cloud availableHIPAA BAA on paid plans
B
Better Auth
Auth · Reviewed 2026-04✓
MIT — no vendor lock-in
Fully open source MIT license. Self-hosted by design. No SaaS dependency.
⚡
No managed service SLA
No hosted offering means no uptime guarantee. You are responsible for availability.
⚡
Community-driven maintenance
Single maintainer with growing community. Bus factor risk inherent to small OSS projects.
Positives
MIT licensed — use however you wantSelf-hosted — full data controlNo per-user pricingDatabase-agnostic
H
Hono
Framework · Reviewed 2026-04✓
MIT — fully permissive
MIT licensed. No usage restrictions. Run on any runtime (Cloudflare, Deno, Bun, Node).
⚡
No vendor behind it
Community-driven project. Yusuke Wada is lead maintainer. No corporate backing means no guaranteed long-term support.
Positives
MIT licenseMulti-runtime — zero platform lock-inNo commercial dependenciesLightweight with no vendor-specific APIs
T
Turso
Database · Reviewed 2026-04✓
SQLite-compatible — easy migration
libSQL is SQLite-compatible. .dump exports standard SQL. Embedded replicas are local SQLite files.
⚡
Young company — longevity uncertain
Turso (ChiselStrike Inc.) is VC-funded. If company folds, your data is still in standard SQLite format.
⚡
Free tier row limits
Free tier limited to 9GB storage and 500 databases. Overages blocked, not charged.
Positives
MIT licensed libSQLSQLite format — ultimate portabilityEdge replicas included on paid plansNo egress fees
C
Cerebras
AI API · Reviewed 2026-04✓
OpenAI-compatible API
API follows OpenAI format. Switch to any other provider by changing the base URL and API key.
⚡
Limited model selection
Only serves Llama and other open models. No proprietary models. Model availability depends on Cerebras hardware capacity.
✓
No data retention for training
Input/output data not used for training. Logs retained briefly for abuse detection only.
Positives
OpenAI-compatible API — easy migrationNo data training on inputsTransparent per-token pricingSOC2 certified
G
Groq
AI API · Reviewed 2026-04✓
OpenAI-compatible API
Standard API format. Drop-in replacement for OpenAI in most codebases.
⚡
Rate limits on free tier
Free tier has strict rate limits (30 RPM). No guaranteed capacity without paid plan.
⚡
No fine-tuning support
Inference only. No fine-tuning, no model customization. If you need custom models, you need another provider.
Positives
OpenAI-compatible APINo data used for trainingTransparent pricingUltra-low latency inference
P
Polar
Payments · Reviewed 2026-04✓
Open source — Apache 2.0
Platform is open source. Can self-host if needed. No vendor lock-in.
⚡
Merchant of Record model
Polar is the legal seller (MoR). They handle taxes and compliance, but they own the billing relationship with your customers.
⚡
Young platform — smaller ecosystem
Fewer integrations than Stripe. Limited payment method support compared to established processors.
Positives
Open source Apache 2.0Handles global tax complianceLower fees for digital productsDeveloper-first API
T
Trigger.dev
Background Jobs · Reviewed 2026-04✓
Open source — Apache 2.0
Self-hostable. Your job code is standard TypeScript. No proprietary runtime.
⚡
Cloud pricing by compute time
Cloud version bills per compute second. Long-running jobs can get expensive compared to self-hosting.
⚡
No SOC2 yet
Early-stage company. No SOC2 certification on cloud offering.
Positives
Apache 2.0 — self-host anytimeStandard TypeScript — no DSL lock-inDocker-based self-hostingDPA available
I
Inngest
Background Jobs · Reviewed 2026-04✓
SDK is open source
Apache 2.0 SDK. Functions are your TypeScript code. Orchestration logic is portable conceptually.
⚡
Cloud platform is proprietary
Inngest Cloud is proprietary SaaS. Dev server is open source. Full self-hosting requires significant infra.
✓
SOC2 certified
SOC2 Type II achieved 2024. DPA available.
Positives
SOC2 Type IIOpen source SDKEvent-driven — functions are just codeSSO on Pro plan
E
ElectricSQL
Database · Reviewed 2026-04✓
Apache 2.0 — fully open source
Sync engine is Apache 2.0. Your data stays in PostgreSQL. No proprietary data format.
⚡
Early-stage project
Active development with breaking API changes. Not yet stable for mission-critical production.
✓
Postgres-dependent
Uses standard Postgres logical replication. Your data is standard SQL — zero lock-in.
Positives
Apache 2.0 licenseStandard PostgreSQL — no data lock-inLocal-first architectureSelf-hosted by design
P
PGlite
Database · Reviewed 2026-04✓
Apache 2.0 — fully open source
Postgres compiled to WASM. Apache 2.0. No cloud dependency.
✓
Client-side only
Runs entirely in browser or Node.js. No SaaS vendor. No contracts needed.
Positives
Apache 2.0No vendor — runs locallyStandard PostgreSQL SQLNo cloud dependency
L
Langfuse
AI/ML · Reviewed 2026-04✓
MIT — fully open source
MIT licensed. Self-host for complete data control. No prompts leave your infrastructure.
⚡
Cloud pricing by traces
Cloud version bills per trace/event. High-volume AI apps can accumulate costs.
✓
SOC2 on cloud
SOC2 Type II for cloud offering. Self-hosted = your own compliance.
Positives
MIT licenseSelf-hostable — full data controlSOC2 Type II (cloud)SSO on Teams plan
U
Unkey
API Security · Reviewed 2026-04✓
Open source — self-hostable
Open source API key management. Self-host for full control.
⚡
No SOC2 yet
Early-stage company. No SOC2 certification. Self-host for compliance-sensitive environments.
Positives
Open sourceSelf-hostablePer-key usage audit logsRate limiting built-in
B
Biome
Tooling · Reviewed 2026-04✓
MIT — fully open source
MIT licensed. CLI tool — no SaaS, no cloud dependency, no contracts.
⚡
Community-maintained
Forked from Rome after the company folded. Active community but no corporate sponsor.
Positives
MIT licenseNo cloud dependencyDrop-in ESLint + Prettier replacementRust-based — fast and reliable
T
Twenty
CRM · Reviewed 2026-04⚡
AGPL 3.0 — copyleft
AGPL means modifications to Twenty itself must be shared. Using it as a service (SaaS) triggers source sharing requirement.
✓
Self-hosted — your data
Docker Compose deployment. PostgreSQL backend. Full data control.
Positives
Open source CRMSelf-hostablePostgreSQL — standard data formatNo per-user SaaS fees on self-hosted
D
Docmost
Documentation · Reviewed 2026-04⚡
AGPL 3.0 — copyleft
AGPL copyleft applies. Self-hosted use for internal docs is fine. Offering as a service requires sharing source.
✓
No cloud offering
Self-hosted only. No vendor dependency. No contracts to negotiate.
Positives
Open sourceSelf-hosted only — full controlPostgreSQL storageNo SaaS fees