A cloud AS2 server is operated on hosted infrastructure and exposed as a managed or self-managed online service. An on-premise AS2 server runs inside infrastructure your organization controls. Both can implement the same AS2 protocol; the difference is where operational responsibility, security controls and lifecycle work sit.
Choose by requirements and total operating model, not by assuming that cloud means automatic security or on-premise means automatic control.
Comparison at a glance
| Area | Cloud AS2 gateway | On-premise AS2 server |
|---|---|---|
| Deployment | Provider or cloud environment | Organization’s data center/private environment |
| Public endpoint | Usually included | Network team must design and expose it |
| Availability | Provider architecture and SLA | Internal architecture and support model |
| Upgrades | Usually provider-managed in SaaS | Internal testing and deployment |
| Private keys | Provider-managed controls or customer-managed option | Internal key custody |
| Certificates | Often inventory and alerts included | Internal tools and processes required |
| Integration | API, webhook, SFTP or agent | Direct internal access and custom integration |
| Scaling | Service limits and plan | Purchased capacity and engineering |
| Cost model | Subscription/usage/service | Software, infrastructure and labor |
| Control | Governed by service capabilities and contract | Maximum implementation control, maximum responsibility |
Architecture and network exposure
AS2 partners need a stable receiving endpoint. In a cloud service, DNS, internet routing, TLS termination and redundant ingress are commonly part of the platform. On-premise deployment requires firewall rules, load balancing, certificates, monitoring and a design that does not expose internal systems unnecessarily.
For on-premise, place the AS2 edge in an appropriate network zone and pass validated payloads inward through a controlled interface. For cloud, review the provider’s network isolation, source-IP controls, DDoS protection, TLS policy and regional architecture.
In both cases, an open port is only the network layer. Partner AS2 IDs, message certificates and MDNs still need correct bilateral configuration.
Availability and support
An SLA number does not explain failure behavior. Ask:
- Is the endpoint active across more than one failure domain?
- Are outbound and inbound queues durable?
- What happens during deployment or maintenance?
- How are partner outages queued and retried?
- Who receives alerts outside office hours?
- What evidence is available during an incident?
- How often is recovery tested?
With on-premise software, your organization answers these questions. With a managed cloud gateway, the provider should answer them contractually and technically.
Security and private-key custody
On-premise deployment lets internal security teams control host hardening, network access and key storage directly. That control is valuable only if the organization has the staffing and processes to patch, monitor, back up and recover the service.
A cloud provider can centralize hardening and operations, but requires due diligence. Review:
- encryption at rest and in transit;
- key storage, export and administrative access;
- tenant isolation;
- role-based access, MFA and SSO;
- logging and administrative audit;
- vulnerability management;
- incident response and notification;
- data location and subprocessors where relevant;
- deletion and export behavior.
Clarify whether your AS2 identity and keys are portable. Portability reduces lock-in and makes continuity planning more credible.
Certificate lifecycle
AS2 certificates expire and partner changes are bilateral. A cloud service may provide inventory, alerts and managed coordination. On-premise software may expose the same technical features, but your team must own the process and contact every partner.
Evaluate overlap support, scheduled activation, fingerprint visibility, bulk partner impact and emergency replacement. A renewal process is more important than a reminder email. Use AS2 certificates explained to assess the complete lifecycle.
Integration with ERP and EDI systems
Cloud gateways normally integrate through REST API, webhooks, SFTP, object storage or a connector. This creates a clean boundary but depends on reliable authentication, idempotency and reconciliation.
On-premise servers can access internal folders, queues and databases directly. That can reduce network hops, but tight coupling makes upgrades and recovery harder. Avoid letting an ERP depend on product-specific AS2 tables.
Whichever model you choose, retain a stable mapping from ERP document to AS2 Message-ID, MDN and EDI acknowledgment. The AS2 integration guide describes these patterns.
Compliance and audit evidence
Both models can support a controlled environment. The evidence you need may include:
- partner and profile configuration history;
- certificate fingerprints and activation dates;
- message transmission attempts;
- MDN disposition, signature and MIC status;
- payload access events;
- administrative changes;
- retention and deletion events;
- recovery and incident records.
With a cloud service, verify access and export through the product and contract. On-premise, ensure logs are centralized and protected from the same administrators who operate the service.
Compliance is not inherited from a hosting label. Map each requirement to an owner and evidence source.
Cost: subscription versus total cost of ownership
A cloud AS2 price may include infrastructure, endpoint availability, upgrades, backups, monitoring and support. Confirm partner, message, volume, storage, API and premium-support limits.
On-premise cost can include:
- license or open-source support;
- production and disaster-recovery infrastructure;
- load balancer, firewall and public IP operations;
- monitoring, log storage and backups;
- security patching and penetration testing;
- private-key protection;
- certificate rotation across partners;
- after-hours support;
- upgrades, testing and specialist training.
Open-source software can reduce license cost without reducing operational work. Compare a three-year realistic scenario with growth and incident effort, not only first-year invoices.
Performance and scale
Define message volume, peak concurrency, maximum size, retention and latency. A cloud service may scale automatically within documented limits. On-premise capacity can be engineered precisely but must be purchased, tested and monitored.
Benchmark the full path: internal submission, AS2 processing, network, partner response, MDN validation and downstream handoff. A fast HTTP upload does not prove sustainable end-to-end throughput.
Change management
In managed cloud, the provider usually deploys protocol and security updates. Ask how changes are communicated, tested and rolled back, and whether a sandbox receives them first.
On-premise gives your team scheduling control but also creates an upgrade backlog risk. Track supported versions and partner interoperability rather than leaving stable software unchanged indefinitely.
Partner-profile changes need governance in either model. Use approvals and audit logs for AS2 IDs, endpoints, certificates and algorithms.
Lock-in and exit planning
Before choosing a cloud service, test export of:
- partner configuration;
- public certificates and, where contractually supported, owned private keys;
- message metadata and MDN evidence;
- payload archives;
- audit records;
- integration definitions.
For on-premise software, assess format portability and specialist dependency. Owning a virtual machine image is not a useful exit plan if only one person understands the configuration.
When cloud AS2 is a strong fit
- The team wants a production endpoint without operating internet-facing AS2 infrastructure.
- Partner onboarding speed and certificate operations are priorities.
- API, webhook or file-based integration is sufficient.
- Usage fits transparent service limits and pricing.
- Provider controls meet security and data requirements.
- A documented SLA and specialist support reduce real internal workload.
When on-premise AS2 is a strong fit
- A validated requirement prohibits the relevant hosted model.
- Internal teams already operate secure, highly available integration infrastructure.
- Private-key custody must remain inside a specific controlled boundary.
- Deep local integration or unusual protocol customization is required.
- The organization can fund upgrades, certificate operations and 24/7 response.
Hybrid options
A cloud AS2 gateway can connect to internal systems through a private link, VPN, outbound-only agent, API or SFTP. An on-premise gateway can also use cloud monitoring or integration services. Hybrid design can satisfy network constraints without moving protocol responsibilities into the ERP.
Avoid a hybrid model that duplicates partner profiles in several gateways without a clear source of truth. Complexity should solve a requirement, not merely reflect organizational boundaries.
Decision scorecard
Score each option using evidence:
- Partner interoperability and required features
- Security and private-key controls
- Availability and tested recovery
- Certificate and partner operations
- ERP/EDI integration effort
- Monitoring and audit evidence
- Three-year total cost
- Scale and documented limits
- Change management and support
- Portability and exit plan
Weight the categories before receiving vendor proposals. This prevents a polished feature demo from changing the importance of requirements after the fact.
If the hosted model fits, review the AS2Connection cloud AS2 gateway, managed AS2 server and transparent pricing.
For a product-neutral requirements checklist, read the AS2 gateway architecture and selection guide.
