Skip to content
Kreezalid
TemplatesFeaturesCustomersPricingResourcesPartner programmeBook a demo
Log inStart building

Getting started

Hosting and securing a marketplace: what professional-grade really costs

One week of our production logs, the list of what professional security takes (backups, disaster recovery, monitoring, tests), and what it costs every month when you run it yourself.

Kreezalid9 min read

In short: a custom-built marketplace does not only cost its development. Running it at a professional level (redundant servers, encrypted off-site backups, a tested recovery plan, monitoring, security updates, automated tests, someone who answers at night) costs roughly €3,100 to €5,700 a month before VAT at the vendors’ published prices, and rarely less than €1,500 even if you skip the security audit and the on-call rota. A Kreezalid plan, which includes all of it, costs €129 to €599 a month before VAT.

You may have a great development team, or the drive to build your platform yourself. For the product, that is often the right call. But on launch day a second job begins: operating an application exposed to the internet that holds your sellers’, buyers’ and payments’ data. That job has a cost, and it is the one marketplace budgets forget most often.

This article starts from facts, not from a sales pitch: what our own servers receive in a week, the list of what it takes to cope, and what each line costs when you pay for it yourself.

What an online marketplace receives in one week

We counted it in the logs of our production server, for the week of 2 to 9 November 2026:

Over 7 days Volume
Requests received 3,062,818
Attempts to find a vulnerability 19,877
Distinct IP addresses behind those attempts 3,852
Refused login attempts on the server (SSH) 2,817

An “attempt to find a vulnerability” is a robot asking for files no visitor ever asks for: a forgotten .env file (it often holds the database passwords), a .git folder (all the source code, with its history), a WordPress login page, phpMyAdmin, a backup archive left in a public folder. That is one attempt every 30 seconds, day and night.

These robots are not after anyone in particular. They sweep the whole internet, all the time, and your marketplace is on their list as soon as its domain name exists, long before your first customer. One forgotten file, once, is all they need.

It is not only about discretion. On 28 September 2026, a wave of scanners reached 829 requests a minute on our platform: the server’s load shot up, and the database saturated for about twenty minutes for a neighbouring application on the same machine. The same day, we put in place automatic blocking of addresses that behave like this. That is the kind of day running a platform holds in store, and someone has to be there for it.

What professional-grade takes

“Professional” does not mean “paranoid”. It is the level a B2B customer sending you a security questionnaire expects, or a cyber insurer, or simply your sellers on the day something breaks. In practice:

  1. Servers kept up to date. The operating system, web server, language runtime, database and every library get security fixes several times a month. They must be applied, fast, without breaking the application.
  2. Automatic attack blocking. A firewall, bans for addresses that probe or flood the site, protected admin access, TLS certificates renewed.
  3. Frequent, encrypted, off-site backups. With another provider, in another data centre. A backup on the same server disappears with it.
  4. Backups an attacker cannot erase. It is ransomware’s first move: delete the backups, then encrypt the rest. The backup server must accept additions only.
  5. Tested restores. A backup never restored is an assumption. It must be restored regularly, automatically, and the data checked.
  6. A disaster recovery plan: written down, timed (how long to start again on a fresh machine?) and rehearsed, because on the day the server burns nobody has time to discover the procedure.
  7. Monitoring from outside. Probes that check the site answers, from other networks, and alert a person, not an inbox nobody reads.
  8. Error tracking. Knowing a buyer’s payment failed before the seller calls you.
  9. Automated tests and continuous integration. Every code change passes tests and analysis before it reaches production, and a bad deploy can be undone.
  10. Security reviews of the code: an audit, then fixes, then another audit at every major change.
  11. Secret management: passwords and API keys out of the code, encrypted, rotated when someone leaves the team.
  12. Someone on call. Incidents do not keep office hours: a robot knows neither weekends nor nights.

None of these lines is optional for a platform that collects money on behalf of third parties. Each one has a cost, in subscriptions and above all in time.

What it costs, line by line

Here is the monthly budget of a small custom-built marketplace, hosted in the European Union, at a level you can defend in front of a B2B customer. The prices are the ones the vendors publish (before VAT, read on 9 November 2026). Dollar prices are counted at par with the euro, an approximation.

Line Low High What we priced
Two application servers (redundancy) €75 €149 OVHcloud Public Cloud, 2 × b3-8 or 2 × b3-16
Load balancer €6 €15 OVHcloud Load Balancer S or M
Managed database, two nodes €139 €326 OVHcloud managed MySQL, Business or Production
Object storage and backup archive €5 €10 500 GB to 1 TB at OVHcloud
CDN for images €5 €10 Bunny, $0.01 per GB in Europe
Web application firewall and DDoS protection €20 €200 Cloudflare Pro or Business
Error tracking €26 €80 Sentry Team or Business
Uptime monitoring and on-call alerts €29 €29 Better Stack, one responder
Transactional e-mail €15 €15 Postmark, 10,000 e-mails
TLS certificates €0 €0 Let’s Encrypt
Infrastructure and tools ≈ €320 ≈ €834
Yearly penetration test, spread over 12 months €1,000 €1,833 €12,000 to €22,000 for a SaaS application, grey box
Operations: 2 to 4 days of a DevOps engineer €1,240 €2,480 €620 a day, the median rate of a DevOps freelancer in France
On-call (call-outs not included) €555 €555 €128 a week, the rate in one French collective agreement
Total per month ≈ €3,115 ≈ €5,702

The table leaves out building the platform itself, the time spent writing and rehearsing the recovery plan, and night-time call-outs, paid on top of the on-call allowance. It also assumes a small marketplace: the infrastructure bill grows with traffic.

The line nobody prices: time

Tools do nothing on their own. Applying updates without breaking the application, reading alerts, tuning the firewall, checking restores, rehearsing the recovery plan, keeping the documentation current, answering a customer’s security questionnaire: that is system administration or DevOps work, every month, for ever.

For one person, the orders of magnitude are known. In France, a freelance DevOps engineer charges a median €620 a day (€500 to €750 depending on experience, according to the TJMètre 2026 survey of 9,212 freelancers). Two days a month is €1,240. An employee costs more: a median of about €45,800 gross a year, around €65,000 with employer contributions by our estimate (about 42 %), close to €5,400 a month, for one person who cannot be on call all year alone.

On-call has its own price: one French collective agreement for engineers and managers sets it at €127.92 a week, about €555 a month, call-outs not included.

That line is often what turns a home-grown platform into debt: the developer who built it leaves, and nobody knows how to restore it any more.

How we do it at Kreezalid

We do not ask you to take our word for it. Here is what runs today under every Kreezalid marketplace, whatever the plan:

  • Hosting in the European Union, on servers we keep up to date: security fixes, certificates, language and database versions.
  • Backups every 4 hours, encrypted, sent to a second data centre with a second provider. The backup server accepts additions only: even a compromised production server could not erase the backups.
  • A restore tested every week, automatically, with an alert if a backup is more than a few hours old or a test fails.
  • Automatic attack blocking, day and night: addresses that look for vulnerabilities or flood the site are banned within seconds.
  • Monitoring from outside, from two continents, and application error tracking, wired to our incident tool.
  • Automated tests and code analysis before every release, and deploys that roll themselves back to the previous version if the new one does not answer correctly.
  • A white-box security audit of the code, carried out in 2026, followed by the fixes.

None of it is billed on top. It is the same foundation for a marketplace on Launch at €129 a month and for one on Extend.

Do it yourself or subscribe: the maths

Over two years, from the table above:

Over 24 months, development excluded Do it yourself Kreezalid
Hosting, security and operations €74,800 to €136,800 included
Subscription — €3,006 (Build, then Launch) to €13,816 (Build, then Extend)
Commission on your sales 0 % 0 %

The gap does not come from the servers, which cost a few hundred euros. It comes from everything around them: the audit, the operations time, the on-call rota. A shared platform spreads those costs over every marketplace it hosts; a home-grown platform carries them alone.

When building and hosting it yourself is still the right call

There are good reasons to: a truly unique journey no platform covers, an engineering team already in place with a real operations budget, or a marketplace that is itself your technology product. In those cases, put the lines above in the budget from day one, not after the first incident.

For everyone else, the question is not “can we build a marketplace?” but “do we want to operate infrastructure exposed to the internet for ever?”. With Kreezalid you stay in control of your marketplace (your domain, your brand, exportable data, an API and an AI connector) without carrying that second job. And you keep all of your commission: we take none.

To compare with the rest of the budget (design, payments, marketing), see our guide to what it costs to create an online marketplace.

Frequently asked questions

How much does it cost to host a marketplace?

At the vendors’ published prices, a small custom-built marketplace hosted at a professional level costs roughly €3,100 to €5,700 a month before VAT: €320 to €830 of infrastructure and tools, the rest in security audits, operations time and on-call. On Kreezalid, hosting, backups and security are included in the plan, from €129 to €599 a month before VAT.

Is a small marketplace really targeted by attacks?

Yes, from day one. Robots looking for vulnerabilities do not choose their targets: they try every address and every domain name. On our servers that comes to almost 20,000 attempts a week, from almost 4,000 different addresses.

What is a disaster recovery plan, and do I need one?

A disaster recovery plan describes how to bring the platform back after losing a server or a data centre: where the backups are, who does what, and how long it takes. A marketplace that collects payments for sellers needs one, and it must be rehearsed: a plan never tested fails on the day it is opened.

Where is a Kreezalid marketplace’s data hosted?

In the European Union, on servers we manage, with encrypted backups kept by a second provider in another data centre.

Sources

Prices and figures read on 9 November 2026, before VAT: