RustDesk for business support: where open source fits and where it stops

What self-hosting actually costs

The licence line is zero and the operational line is not. Running your own relay or rendezvous infrastructure means provisioning and monitoring servers, renewing TLS certificates, applying security patches promptly, testing backups and restores, watching capacity, and having someone reachable when the service fails at the worst possible moment, which for support tooling is during a major incident.

Price those hours at an honest internal rate for a year and compare that figure with a managed subscription. For a small estate with an engineer who enjoys the work, self-hosting often still wins. For a busy desk where those hours would come out of ticket time, it usually does not.

Security posture and governance

Remote access grants privileged entry into every machine you manage, so the governance around it matters as much as the software. Public guidance from the NCSC, CISA and NIST is consistent on the fundamentals, and they apply identically to open-source and commercial tools.

The rows to close deliberately in a self-hosted deployment are account governance, patch cadence and audit. Can multi-factor authentication be enforced on every operator account rather than left optional? Are permissions scoped so a first-line technician reaches only their devices? Is there a documented process to remove access when someone leaves the same day? Who applies security updates to the relay, and within what window of a published advisory?

None of these are arguments against open source. They are the work that a managed service otherwise absorbs, and they need a named owner either way.

The audit trail question

The gap most often found late is evidence. Insurers, auditors, cyber certification schemes and larger customers increasingly ask a simple question: show me who connected to which machine, when, and for how long, for the last twelve months.

Before committing to a self-hosted deployment, establish exactly what your setup records, where those records are stored, how they are protected from the operators they describe, how long they are kept, and how they are exported into a readable format. If the answer requires an engineer to assemble logs by hand, it will not survive an audit and it will not survive that engineer leaving.

When each option is the right one

Self-hosting fits when the estate is small, the team has genuine infrastructure skills and funded time, the data residency requirement is strict, and the audit expectation is light or already met by other systems.

A managed service fits when support hours are the scarce resource, when the estate spans sites and platforms, when audit evidence must be produced on demand, when access has to be revoked reliably during offboarding, and when someone other than your own team should be responsible at 2am.

Write your criteria down as a short list and revisit it annually. Estates grow, audit expectations tighten, and the engineer who set the deployment up eventually moves on. The answer that was right at twenty machines is often the wrong one at two hundred.