Ilya Ornatov — owner, NW Maids. Written 5 August 2026. All figures as of that date.
NW Maids does about $5M a year in residential cleaning across five cities, with more than 100 cleaners in the field and a three-person remote back office.
Like most businesses that size, the software bill had accumulated rather than been decided. Tools got added to solve a problem in a particular month and then nobody revisited them.
Here's what I replaced, with the real monthly cost of each:
| Was paying | Monthly | Replaced with |
|---|---|---|
| Front | $153 | Chatwoot |
| Help Scout | $94 | Chatwoot |
| Zapier | $143 | Activepieces |
| Process Street | $58 | Donetick + BookStack |
| Hubstaff | $71 | Kimai |
| SignEasy | $30 | DocuSeal |
| YouCanBookMe | $24 | Cal.com |
| Gross replaced | $573 |
Everything on the right runs on a single Hetzner server.
Hosting: $51/month, backups included. Cloudflare Tunnel, Cloudflare Access, SSL, and Watchtower for automatic container updates are all $0.
Net: about $522/month. Roughly $6,264 a year.
All seven cancellations are confirmed — not "scheduled," not "in progress." The old subscriptions are dead.
The migration was more than pointing a domain somewhere new. The volume is the part people underestimate:
That second point is worth sitting with. A meaningful share of the savings didn't come from open source being cheaper. It came from finally looking at what I was actually paying for and finding that a third of it was redundant. You could capture some of this without self-hosting anything.
This is the part I'd most want someone evaluating this to read.
The moment you move off SaaS, you become the security team. Nobody is patching that box but you. So the evaluation can't be features and GitHub stars — it has to include disclosure history, patch cadence, and blast radius.
Three of the most commonly recommended tools in this category didn't survive that screen:
n8n — the default recommendation for self-hosted automation. Active remote code execution vulnerability. An automation platform holds credentials to every system it connects to; RCE there means an attacker inherits your entire integration surface.
FreeScout — the usual Help Scout replacement. Zero-click RCE reachable via inbound email. A support desk exists to receive mail from strangers. A support desk with a zero-click email RCE is not a support desk; it's an open door with a logo on it.
Vikunja — a cluster of 2026 CVEs. Not one bad week, a pattern.
I picked Activepieces, Chatwoot, and Donetick instead.
I want to be precise about what this does and doesn't mean. I'm not claiming the tools I chose are invulnerable — every one of them will have a CVE eventually. I'm saying that at the time I evaluated, the disclosure histories and architectures were meaningfully different, and that difference was worth more to me than feature parity.
I run automatic container updates and I still rejected these three. Patch speed doesn't save you when the architecture is the problem.
This is the section that matters more than the savings number, and it's the one most write-ups skip.
Still on the bill, on purpose:
The rule I used:
Replace the glue and the commodity tools. Never replace your system of record or your industry-specific platform.
Glue is replaceable because when it breaks, work queues up and you fix it. A time tracker going down costs you an afternoon of annoyance. A system of record going down costs you the thing the business is made of.
There's also a competence argument. A booking platform built for residential cleaning encodes a decade of decisions about recurring appointments, crew assignment, and cancellation logic that I would have to rediscover badly. The open-source alternative always looks close enough. It usually is close enough. Right up until it isn't, on a Saturday, with 100 cleaners in the field.
This has been in production for about four weeks. The server was provisioned on 6 July 2026. E-signature, time tracking, scheduling, and the automation platform came up 6–7 July. SOPs on the 8th. The shared inbox on the 13th. The legacy automation platform was fully zeroed out 28–29 July.
Four weeks is not a track record. Ask me again in six months, and weight anything I say accordingly.
I don't know what this costs me in maintenance time. I don't track it. Maintenance so far has been episodic incident-fixing rather than a scheduled thing, and I'm not going to estimate a number that sounds good. If someone tells you their self-hosted stack takes "about two hours a month," ask how they measured it.
The savings figure is a subtraction, not a profit. $573 minus $51 is real arithmetic on real invoices. It doesn't account for my time, and my time isn't free.
I'd rather talk someone out of this than have it go badly.
Don't do this if you have no sysadmin instinct and no interest in developing one. Not "can you code" — I can't, in the traditional sense. But you need to be the kind of person who reads a changelog before updating, and who finds a stray open port irritating rather than invisible.
Don't do this if a Saturday outage is a real emergency for your business. When Front goes down, a company with a support team is fixing it. When Chatwoot goes down, that company is you, and it doesn't matter what else was happening that day.
Don't do this if you won't own patching. Automatic container updates help. They are not a security program. You still have to read advisories and make judgment calls.
Don't do this for the money alone. $6,264 a year is real for a business my size, and it is not worth taking on infrastructure risk if that's the only reason. The better reasons are control over your data, freedom from per-seat pricing as you grow, and knowing exactly what's running.
And don't start with your system of record. Start with the time tracker. If that goes badly, you've learned something cheap.
Consolidate before you migrate. A third of my savings came from noticing that 129 automations were really about 14. That audit is free and you can do it this week without touching a server.
Screen for security before features. The tool you'll regret is the one you picked because it had the nicer interface.
And write down what you refuse to move before you start. My list — booking, email engine, call attribution, accounting — was decided in advance, which meant I never had to make that call at 11pm feeling clever.
I write these up in full, including the failures. The second case study covers the AI operations layer built on top of this stack — its guardrails, the three exceptions I granted deliberately, the four times something went wrong, and the six things I can't measure.