Enterprise self-hosted runs the **full Pathrule Cloud product on your own infrastructure**, in your cloud, VPC or on-prem environment. It is the deployment model for organizations that need data residency, a security review, or a procurement path that keeps data inside their boundary.

This is an enterprise offering. To start a deployment or a proof of concept, [talk to sales](mailto:hello@pathrule.io).

## How it works

Self-hosted is **not a different backend**. It is the same managed Pathrule product, pointed at a **customer-hosted database** instead of ours. It ships as **signed container images** you run with Docker Compose, including the app, the web console and the remote MCP connector.

The split is clean:

- **Your side (data plane):** your database, your data, your backups, your identity. Everything your team authors stays on your infrastructure.
- **Our side (control plane):** licensing and entitlement, the commercial relationship, and the closed source. We never hold your data.

## Identity through your SSO

Users authenticate through **your own identity provider** over SAML or OIDC, not through Pathrule-hosted accounts. The first providers we certify are **Microsoft Entra ID, Okta, and Google Workspace**.

## Full team features on your infra

Because the deployment runs the complete stack, the team layer runs entirely on your side: **realtime sync, live activity, and overlapping-write detection** all work without traffic leaving your environment.

## AI mode

AI features are a toggle:

- **Hosted proxy:** use our AI proxy; we meter and bill usage.
- **Bring your own key:** point the deployment at your own model provider key, and AI traffic goes directly to your provider.

## Licensing and data safety

The deployment is gated by an **entitlement license**, not a live billing dependency at runtime. The design is built so you never lose access to your data:

- On license expiry, **writes pause but reads and existing data stay available**. There is never a hard lockout.
- If the license service is briefly unreachable, the last valid entitlement is honored for a **grace window** before anything degrades.

## Security and compliance

Self-hosted is built for security review: **audit logs**, role-based access control, **signed images with an SBOM**, and data-residency guarantees because the data never leaves your infrastructure.

## Support and upgrades

We support the latest and previous major versions, with sequential, customer-triggered upgrades and a backup and restore runbook. Versioning and end-of-life terms are part of the contract.

## Open source instead

If you want a free, fully local single-developer setup rather than a hosted team deployment, see the [Open source core](/docs/editions/open-source-core).