Desktop Native Application — enterprise stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Code Signing Certificate - Windows (OV/EV, SmartScreen Reputation)
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsFree: $0 self-signed (SmartScreen warning, no trust) / OV: $129-250/yr, 1 cert, unlimited signatures / EV: $399-699/yr includes HSM token ($99 value), renewal yearly, $0 overage but time-stamp $0.01/sig after 10k via DigiCert
Code Signing Certificate - Apple Developer ID (macOS Outside App Store)
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsFree: $0 Apple ID (7-day ad-hoc cert, no notarization) / Paid: $99/yr - unlimited Developer ID certs (2 active), unlimited app signing, includes notary service, TestFlight for Mac, no overage
Notarization Service - Apple Notary (Gatekeeper Stapling)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFree with $99 dev program: ~unlimited notarizations (fair use ~1000/day), 30-120 sec avg, $0 overage / Standalone Apple ID: not allowed / Third-party wrapper: Gon $0 OSS, $0 cost
Installer Hosting & CDN Distribution (MSIX, MSI, DMG, PKG, AppImage)
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsFree: GitHub Releases $0 2GB/file, 500 API calls/hr / R2: 10GB storage free, 10M Class A ops free / S3: $0.023/GB storage, $0.09/GB egress, CloudFront $0.085/GB / Paid CDN: $50-500/mo base + $0.01-0.08/GB overage
Auto-Update Service / Release Server (Sparkle, Squirrel.Windows, Electron autoUpdater, MSIX App Installer)
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsFree: OSS Sparkle/Squirrel/Velopack $0 self-hosted, S3 hosting costs only / Hazel self-hosted $0 / Paid hosted: Update.rocks $29/mo 10k checks/mo free then $0.50/1k checks, Electron Release Server $0 self-host
Crash Reporting & Native Symbolication (Sentry Native, Crashpad, Breakpad)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFree: Sentry Dev $0 5k errors, 10k transactions, 1GB attachments / Bugsnag: 7.5k sessions free / Paid: Sentry Team $29/mo 50k errors $0.00036/overage, 100k replays, Business $99/mo 100k errors, symbol storage $0.023/GB
Artifact Storage & Versioned Binaries (PDB, dSYM, MSI, DMG archive)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsFree: GH Artifacts 500MB storage 30-day retention free / R2 10GB free / Artifactory Cloud Free: 2GB storage 2GB transfer / Paid: S3 $0.023/GB-mo + $0.09/GB egress, JFrog Pro $37/mo 10k GiB-minutes included, overage $0.08/GB
Build CI/CD - Windows/macOS/Linux Runners (Native Build Matrix)
Automates testing and deploying your code. Saves enormous time and prevents “works on my machine” releases.Pricing & free-tier limitsFree: GH Free 2000 Linux mins, Windows 2x factor, macOS 10x factor (200 effective macOS mins) / Team $4/u/mo + overage $0.008/min Linux, $0.016/min Windows, $0.08/min macOS / Self-hosted runners $0 but infra $5-99/mo
OS Compatibility Testing VMs / Device Lab (Win 10/11, macOS 12-15, Ubuntu/Fedora)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFree: Local VMs $0 hardware cost only / Parallels Pro $99.99/yr includes 3 macOS + 1 Win11 VM / AWS EC2 Mac: $1.083/hr $26/day + EBS $0.08/GB-mo / Azure Win11: $0.084-0.188/hr per vCPU, overage $0
Symbol Server / Debug Symbols (PDB, dSYM, Breakpad SYM, Source Indexing)
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsFree: Sentry free tier 5k PDB/dSYM files ~1GB free / MS Public Symbols $0 read-only / Self-hosted S3 $0.023/GB storage, $0.09/GB transfer / Paid: Sentry Business unlimited symbols in plan, Artifactory Pro $37/mo 5GB artifact storage then $0.08/GB
Telemetry & Usage Analytics (Desktop privacy-compliant, offline-first)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsFree: PostHog 1M events/mo free, 1M recordings, no CC / Plausible OSS $0 self-host / Paid: PostHog Scale: 1M free then $0.000248/event ($0.248/1k), Mixpanel Growth $28/mo 1M events then $0.28/1k overage
License / Entitlement API for Desktop Licensing (Offline Activation, Floating)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFree: Cryptlex free 100 active licenses, $0 / Keygen OSS $0 self-host + $5/mo VM / Paid: Keygen Cloud $29/mo Startup 250 licenses, $99/mo 1000 licenses $0.10/license overage, Cryptlex $29/mo 500 licenses, $99/mo 5000
Dependency & Vulnerability Scanning (Native deps, vcpkg, Conan, CocoaPods, NuGet)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsFree: Dependabot $0 unlimited / Grype/Syft $0 unlimited scans / Snyk Free: 200 tests/mo, 1 project limit / Paid: Snyk Team $25/dev/mo $0.50/test overage, GHAS $49/dev/mo Team $0 overage, 500 API calls/hr
Secrets Management for Signing Keys (EV HSM PIN, Apple API Key, Notary creds)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFree: GH Secrets $0 (10 env secrets per repo) / 1Password Connect free tier 250 calls/mo / Doppler Free: 5 users, 500 secrets / Paid: Vault Cloud $22-95/mo cluster $0.03/secret, AWS KMS $1/key/mo + $0.03/10k requests overage, Doppler $8/u/mo
Code Signing - Linux (GPG for DEB/RPM, Snapcraft, Flatpak, AppImage Signing)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFree: GPG $0 unlimited signatures, key 4096-bit / Snap Store $0 unlimited snaps, 100GB bandwidth / Flathub $0 unlimited / Paid: Snap Store Proxy private $15k/yr + support, no overage on public store
Installer Builders & Packaging Pipeline (WiX, MSIX, create-dmg, pkgbuild, AppImageKit)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFree: WiX $0 unlimited MSI/MSIX / Electron Builder $0 / AppImage $0 / Paid: Advanced Installer Pro $499/yr per user, Architect $979/yr, InstallShield $3k-6.6k/yr per seat, no overage - perpetual
Application Monitoring & Health Dashboard (Startup time, ANR, Hang Reporting)
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsFree: Sentry 10k perf tx free, 5k errors / OpenTelemetry B $0 self-hosted / Paid: Sentry Business $99/mo 100k tx then $0.0004/tx overage, Datadog RUM $1.50/1k sessions + $15/mo APM host, Better Stack $24/mo 100 monitors
Feature Flag / Remote Config for Desktop (Kill switch, staged rollout)
Stores API keys and credentials safely, separate from your code. Leaking secrets is one of the most common breaches.Pricing & free-tier limitsFree: Unleash OSS $0 unlimited flags self-host / Flagsmith 10k reqs/day free, $0 / ConfigCat free 10M reqs/mo trial / Paid: LaunchDarkly $10/mo 1k MAU then $0.15/overage / GrowthBook $20/mo 100M reqs then $0.10/1M overage / Unleash Pro $80/mo 15k events
Backup & Disaster Recovery for Build Artifacts & Signing Infrastructure
Automates testing and deploying your code. Saves enormous time and prevents “works on my machine” releases.Pricing & free-tier limitsFree: S3 versioning $0 feature cost + storage $0.023/GB / B2 free 10GB / Wasabi free egress / Paid: S3 CRR storage $0.023/GB destination + $0.02/1k reqs, B2 $0.006/GB-mo + $0.01/GB download over free 1GB/day, Veeam $0 agent
Hardware Security Module (HSM) for EV Signing & Key Protection (YubiHSM, CloudHSM)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFree: SoftHSM $0 emulation (not compliant for 2023+ EV) / YubiKey $50-90 one-time no sub / Paid: YubiHSM 2 $650 + $0/mo, AWS CloudHSM $1.45/hr $1,065/mo + $1.45/HSM/hr extra, Azure HSM $2.50/hr $1,800/mo, KeyLocker $95/mo per key then $0.10/sign over 5k
Hardware Test Lab / Bare Metal Test Rigs (GPU, Audio, USB Peripherals, printers)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsFree: Existing hardware $0 / Paid: TinyPilot KVM $169 one-time + $0/mo / MacStadium hosted lab $149/mo M1 mini to $399/mo Mac Studio, on-demand $0.50-4/hr, Equinix Metal $0.32/hr $230/mo reserved
Static Code Analysis (SAST) & Binary Hardening Scan (Control Flow Guard, Hardened Runtime)
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsFree: CodeQL public $0 unlimited / Semgrep Community $0 10k lines per scan / SonarQube CE $0 unlimited Loc self-host / Paid: Semgrep Pro $40/dev/mo then $0.10/scan over, SonarCloud $150/mo 100k LoC then $150 per 100k overage, GHAS $49/dev/mo
Performance Profiling Infra (ETW/WPT for Win, Instruments for macOS, perf/Linux, Tracy)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFree: WPT $0 unlimited captures / Xcode Instruments $0 unlimited / Tracy OSS $0 / perf $0 / VTune free tier 1 seat community / Paid: dotTrace $149/yr per seat, VTune Pro $399/yr, Superluminal $199-399/yr, no per-GB overage
Automated UI Testing (WinAppDriver, XCUITest, PyAutoGUI, SikuliX, Appium Windows Driver)
The visual and experience layer of your product. Good design drives conversion and trust.Pricing & free-tier limitsFree: WinAppDriver $0 unlimited tests / Appium $0 unlimited / XCUITest $0 unlimited / SikuliX $0 / Paid: Ranorex $2,880 one-time + $990/yr maintenance, TestComplete $8,999/yr per floating user, Cirrus UI $0.06-0.12/min macOS over free 50hr/mo
Localization / i18n Build & Delivery Pipeline (Strings, .resx, .po, XLIFF)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsFree: Weblate self-host $0 + VM $5/mo / Crown Free: 60k words 1 project, $0 / Pontoon $0 / Paid: Crowdin Pro $99/mo then $0.10k per 1k words overage, Lokalise $120/mo 20k keys $0.12/key over, Phrase $135/mo
Documentation Hosting (Offline Help Bundle + Online Docs, Search, Versioning)
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsFree: GH Pages $0 100GB transfer / Cloudflare Pages $0 unlimited transfer / RTD free 1GB storage / Paid: GitBook $40/mo 5 seats $8/seat/mo over, ReadMe $120/mo 4 seats $24/seat over, Algolia DocSearch $0 free for OSS then $0.50/1k searches after
Community / Beta Distribution Channel (TestFlight for Mac, Alpha/Beta tracks, staged rollout)
User-generated content, discussion, and keeping it safe. Needs moderation once you have real volume.Pricing & free-tier limitsFree: GH Pre-release $0 unlimited / TestFlight Mac $0 100 testers + 10k external via public link (with $99 program) / MS Store flight $0 10k testers / Paid: No extra cost beyond store fees ($99 Apple, $19 MS Dev $19 one-time), AppCenter Dist $0 legacy 5GB/mo
Compliance Logging / Audit Trail for Releases (Who signed what, when, with which HSM)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsFree: CloudTrail 1 trail free 90-day + S3 free tier / Rekor public $0 unlimited logs / GH audit log free 1000 events / Paid: CloudTrail data events $0.10/100k, Papertrail $7/mo 1GB 30-day $0.10/GB over, Datadog $0.10/GB ingest then $0.10/GB 15-day retention
Release Management & Code Signing Approval Workflow (4-eyes, time-locked signing)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFree: GitHub Environments $0 1 required reviewer for public / Sigstore Cosign/Fulcio $0 unlimited keyless / EJBCA CE $0 / Paid: Keyfactor $15k/yr includes 10k signs then $0.10/sign, Microsoft Trusted Signing $19/mo account 5000 signs $0.02/sign over, DigiCert TLM $299/mo min
Log Aggregation for Desktop Fleet (Opt-in crash + usage logs from installed base)
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsFree: Grafana Cloud free 50GB logs/mo, 14-day retention / Loki OSS $0 + VM $5/mo / Axiom 500MB/day free / Seq $0 self-host / Paid: Datadog $0.10/GB ingest + retention $0.10/GB-mo over 15 days, New Relic 100GB free then $0.30/GB ingest overage
Private Package Repository / Internal Update Mirror (Air-gapped enterprise)
Where your source code lives and is collaborated on. Non-negotiable for any team or serious project.Pricing & free-tier limitsFree: Nexus OSS $0 unlimited / MinIO $0 / GH Packages free 500MB 1GB transfer / CodeArtifact first 2GB free / Paid: JFrog Enterprise $27.5k/yr + $0.20/GB over 10TB, Nexus Pro $21.6k/yr unlimited storage, CodeArtifact $0.05/GB-mo + $0.05/10k requests overage
Driver Signing & WHQL / Kernel Extension Notarization (Windows ATTES/HLK, macOS KEXT)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFree: Attestation signing $0 with valid EV cert / Apple KEXT $0 with dev program / HLK studio $0 license trial / Paid: EV cert $399-699/yr + Microsoft Store Dev one-time $19 + dedicated HLK controller $0.50/hr Azure, third-party lab $5k-15k/submission, driver $0 overage
Enterprise MDM Deployment Integration (Intune WIN32, JAMF Pro, Munki, AutoPkg)
Automates testing and deploying your code. Saves enormous time and prevents “works on my machine” releases.Pricing & free-tier limitsFree: Munki $0 unlimited / AutoPkg $0 unlimited / Intune trial 30-day 100 devices / Fleet OSS $0 / Paid: JAMF Pro $4/device/mo $100/mo base, Pro $6.33/u/mo Intune (Enterprise E3 includes), Workspace ONE $4.40/device/mo then $0 volume over 1000 $3.50
Penetration Testing & Binary Hardening Verification (DEP, ASLR, CFG, Hardened Runtime, notarization check)
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsFree: BinSkim $0 unlimited / checksec $0 / VirusTotal public free 500 req/day 32MB file / Paid: VirusTotal Enterprise $600/mo $30k/yr unlimited API 650MB files, Veracode $12k/yr starter 5 apps then $2k/app overage, Pentest $15k-50k one-time
SBOM Generation & Supply Chain Attestation (SLSA Level 3, Sigstore, in-toto)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFree: Syft $0 unlimited SBOMs / Grype $0 unlimited scans / Cosign $0 unlimited attestations / Rekor public $0 / Paid: Chainguard $30k/yr includes 100k builds then $0.20/build overage, Anchore Enterprise $36k/yr, no overage on OSS tools
Dedicated Build Farm / Self-Hosted macOS & Windows Builders (MacStadium, On-Prem, Orka)
Automates testing and deploying your code. Saves enormous time and prevents “works on my machine” releases.Pricing & free-tier limitsFree: Self-hosted runner $0 infra existing / GH self-host $0 / Paid: Mac mini cloud $99/mo per mini $0.50/hr overage, Orka $500/mo starter 3 nodes then $0.11/vCPU/hr + $0.15/GB RAM/hr, EC2 Mac $1.083/hr $650/mo reserved 24x7, Equinix $0.64/hr
WORM / Immutable Release Audit & Long-term Archival (SOX, SEC 17a-4 Compliance)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsFree: S3 Object Lock feature $0 + storage $0.023/GB standard, Glacier $0.004/GB-mo / B2 Object Lock $0 feature, $0.006/GB / Paid: Deep Archive $0.00099/GB-mo 180-day min + $0.02/GB retrieval over free, Azure Immutable: $0.023/GB-mo hot + $0.10/10k writes over 5000 free ops, LTO-9 tape $150 one-time per 18TB
Global Edge Distribution with Signed Installer Verification & Rollback (Staged rollouts, Revocation)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsFree: Cloudflare Free $0 unlimited bandwidth but 100MB-512MB file limit chunk / GH Releases free 2GB/file / R2 free egress $0 10GB / Paid: Fastly $50/mo min $0.12/GB over first 10TB then $0.08/GB, CloudFront $0.085/GB first 10TB $0.02/10k requests over 10k free, rollback feature $0 cost - CDN purge $0.005/purge over 1000 free
How this enterprise desktop native application checklist works.
Each requirement below is something a enterprise desktop native application build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.