Self-hosted prospecting: what it takes, and what you keep
Running an open-source prospecting tool yourself: what you need to set up, what the AGPL asks of you, the Vercel plan question, and when the hosted route makes more sense.
Prospect lists and reply history are some of the most sensitive data a small company has, and a hosted prospecting tool holds them for you, often priced per seat, sometimes with credits on top. Self-hosting is the other way to do it. It’s not free of effort, so here’s what it involves, using Coldlyne’s repository as the worked example.
What you get
- Your data stays with you. Prospects, sequences and replies sit in your own database, and nothing passes through us.
- Your own providers. You connect your mailboxes, SMS, letter and telephony accounts, and pay those providers directly. There are no credits to buy, because there’s nothing in the middle to resell.
- Code you can read. When a tool sends in your name, being able to check what it does is worth something.
What you need
Coldlyne is a Next.js application with a Postgres database, designed to run on Vercel with Neon. Locally, it starts like this:
git clone https://github.com/Coldlyne/coldlyne
pnpm install
cp .env.example .env.local # then fill it in
pnpm db:migrate
pnpm dev
Beyond the database, an instance needs a few settings, all described in its README:
BETTER_AUTH_SECRETandBETTER_AUTH_URL, andCOLDLYNE_ADMINSfor who may sign up;COLDLYNE_SECRETS_KEY, generated withopenssl rand -base64 32, which seals every connection’s credentials. Keep it safe: without it they can’t be opened, and members have to connect again;- one way to sign in: your company’s OpenID Connect provider, a Google OAuth app, or addresses and passwords;
CRON_SECRET, sent by the scheduler to the routes that send, read and watch.
RESEND_API_KEY is optional and covers only Coldlyne’s own mail to its members, such as sign-in links and invitations. It never carries prospecting: Resend’s acceptable use policy forbids cold outreach, and your prospecting leaves from your own mailboxes.
Everything else is connected per workspace, from the Connections page, not in environment variables.
The scheduling catch
Sequences only work if something wakes them up. Coldlyne has three jobs: sending every 15 minutes, reading mailboxes hourly, and watchlists daily. Vercel’s Hobby plan limits cron jobs to once a day, and a more frequent expression fails at deployment, so you need a paid plan there, or another scheduler that calls those routes with Authorization: Bearer <secret>.
What the AGPL asks of you
Coldlyne is under the AGPL-3.0. Compared with the ordinary GPL, it has one added requirement: “if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version”.
In practice, running it as it is requires nothing special from you. If you change it and offer it to others over a network, you publish your changes under the same licence. If you’re unsure about your own case, ask a lawyer: this is general information.
What you take on
Be honest with yourself about this list:
- Updates and migrations. Each deployment runs its own migrations against its own database. Someone has to do it, and read what changed.
- Backups and access. Your database holds personal data, and you decide who can reach it.
- Being responsible for the data. Hosting it yourself means you answer for it under the GDPR, including objection requests and how long you keep data.
- Deliverability is still your job. Hosting doesn’t change how inboxes see you. You still need SPF, DKIM and DMARC, a separate sending domain and a slow warm-up, whichever tool you use.
- Provider accounts. Each channel means an account with its own console, terms and verification.
When not to self-host
If nobody on your team is comfortable reading a migration or rotating a secret, you’ll be better off with a hosted product, and that’s no failure. Coldlyne’s hosted plan isn’t open yet, and it will be the same software, on a database in Frankfurt. If you want to hear when it opens, tell us.
And if you’re comfortable with all of the above, you can connect your assistant to your own instance at /api/mcp and run your prospecting from Claude or ChatGPT.