Build vs. buy: the real cost of running your own GeoIP and validation stack

"It's just a database lookup." That's how every in-house geolocation and validation project gets scoped, and for about a week it looks true. You download a GeoIP file, write an IBAN checksum, wire up a VAT check, and the demo is flawless. Then production shows up. Two quarters later it's a rotating cast of cron jobs, a stale dataset nobody noticed, and a VAT endpoint that breaks every time a government service has a bad afternoon. Here is the build-versus-buy decision priced honestly — the line items that never make it into the original estimate.

The 80% that looks free

The first 80% of a geo-and-validation stack is genuinely easy, and that is exactly what makes it dangerous. Parsing a MaxMind GeoLite2 file into a lookup table is an afternoon. An IBAN mod-97 checksum is a dozen lines. Email syntax validation is a regex you can write from memory. Each one runs on your laptop, passes the tests you thought to write, and demos perfectly to the team. The estimate practically writes itself: a week, maybe two.

But none of that is the actual job. The job is keeping those answers correct, fast, and available for the next three years — for inputs you didn't anticipate, while the ground shifts underneath you. That work is invisible on day one and unavoidable by day ninety. It doesn't appear in the estimate because it doesn't appear in the demo. The build is a rounding error; the maintenance is the whole cost.

The 20% nobody demos

The expensive part is everything the happy-path demo skips. Five costs in particular surface only once you are in production, and not one of them ever fully goes away:

• Data licensing that isn't optional — the free GeoIP tiers are the inaccurate ones. Usable accuracy for IP, phone-carrier and address data is a paid, annually-billed license with redistribution caps you have to read carefully. free describes the demo dataset, not the production one.
• A refresh treadmill that never stops — IP allocations get reassigned between registries and ISPs, exchange rates move by the minute, and disposable-email domains spin up faster than any weekly list can track. Every dataset decays the moment you stop refreshing it, and each one decays on a different clock.
• Third-party uptime you don't control — VAT validation ultimately calls VIES, the EU's cross-border service, and VIES has bad days: maintenance windows, per-member-state rate limits, silent timeouts. When it's down your checkout is down, and your on-call engineer can only wait for a system in another country to recover.
• Accuracy drift that nobody owns — there is no failing test for 'our geo data is quietly wrong now'. The lookup keeps returning an answer; it just gets less true over time, until a customer is taxed in the wrong country or a fraudulent address sails through, and it's a trust problem instead of a bug.
• On-call for plumbing — every item above eventually pages a human. A refresh job fails, an upstream schema changes, a checksum rejects a valid input. That is senior-engineer attention spent keeping infrastructure breathing instead of shipping the product it exists to support.

The bill compounds after year one

Here is what turns a one-time project into a permanent line item: the cost compounds. Year one you ship four location lookups and four validators. Year two someone needs address autocomplete, a new market brings a new tax regime, or a payment provider surfaces an IBAN edge case you never handled — and each addition inherits the same refresh, monitoring and on-call burden as the originals. The stack only grows, and every dataset you add is another clock ticking toward the next stale-data incident.

The knowledge doesn't stay either. The engineer who understood exactly how the GeoIP refresh and the VIES retry logic fit together changes teams or leaves, and what they carried in their head becomes a folder of cron jobs nobody wants to touch. The second year is rarely cheaper than the first — it is usually the year the accumulated drift and the missing owner finally collide.

Put a number on it

Engineering time is the cost that hides best, so make it explicit. Take a conservative build across all eight data types a typical product touches — IP geolocation, GPS geocoding, timezone and currency, plus email, phone, VAT and IBAN validation — and price it at a blended, fully-loaded senior rate. The figures below are illustrative, not a quote; swap in your own rates. The shape is what survives.

// Illustrative annual TCO of a self-hosted geo + validation stack.
// Blended, fully-loaded senior engineer ~ $150/hour. Plug in your own.
const RATE = 150

const build   = 10 * 5 * 8 * RATE   // 10 eng-weeks to build      => $60,000
const upkeep  =  3 * 12 * 8 * RATE   // ~3 eng-days/month forever   => $43,200
const license = 12_000               // GeoIP + carrier data, /yr   => $12,000
const onCall  = 15_000               // incident + drift response   => $15,000

const yearOne = build + upkeep + license + onCall  // ~ $130,000
const ongoing = upkeep + license + onCall          // ~ $70,000 every year after

Round it however you like — the conclusion holds. You are not weighing an API bill against zero. You are weighing it against a recurring five-to-six-figure line item, most of it senior engineering time spent maintaining plumbing instead of shipping product, and it comes due again every year. That is the number the 'we'll just build it' estimate quietly leaves out.

When building really is the right call

Buying is not automatically correct, and pretending it is would be its own kind of dishonesty. In-house is the right answer in three real cases. First, when the data is your core product — if you sell geolocation, fraud scoring or compliance, the stack is the thing you are paid to be best at, and outsourcing it makes no sense. Second, when your volume is large enough that per-call pricing genuinely loses to owning the infrastructure; at hundreds of millions of lookups a month, the arithmetic can flip hard. Third, when a regulatory or contractual mandate forbids the data ever leaving your network, and no vendor's terms can satisfy it.

If you are in one of those cases, build deliberately: staff it, own it, and budget the maintenance from day one. The failure mode is not building — it is building by accident, discovering the maintenance tax a quarter in, and finding that nobody's name is on it.

The honest buy case

For everyone else — most teams, most of the time — the math favors a single integration you don't maintain. The value isn't that an API is magic; it's that the refresh cadence, the upstream outages, the accuracy drift and the pager are somebody else's full-time job instead of a standing tax on yours. One base URL, one auth scheme, one status page to watch instead of eight.

That is the shape Locabium is built around: the whole family behind one API at https://api.locabium.com. The location endpoints — GET /v1/geoip, GET /v1/geocode, GET /v1/timezone, GET /v1/currency — and the validation endpoints — POST /v1/validate/email, POST /v1/validate/phone, POST /v1/validate/vat, POST /v1/validate/iban — are exactly the eight datasets above, kept current and monitored so you don't stand up eight pipelines yourself. You still own the decision. Just make it against the real number, not the demo.

The question was never 'can we build it?' — you can, in an afternoon. It's whether maintaining eight datasets forever is the best use of the engineers who could be building your actual product.