Pathrule, on your own infrastructure.
Run the full team context layer inside your VPC. Your database, your identity, your backups, with SSO, audit logs and dedicated support. The commercial relationship and the source stay with us; your data never does.
Licensing, entitlement and an optional AI proxy. We hold the commercial relationship and the source. We never hold your data.
Control plane stays with us. Data plane is yours.
Self-hosted is not a different backend. It is the same managed product, pointed at a customer-hosted database, delivered as signed container images you run with Docker Compose.
Your side, the data plane
- Your database, data and backups
- Realtime sync, live activity, overlap detection
- Your SSO and your users
- Nothing leaves your boundary
Our side, the control plane
- Licensing and entitlement
- Optional metered AI proxy
- The closed source and updates
- Never your data
Built for security review.
Data and privacy
- Source code never leaves your disk
- Encrypted in transit and at rest
- No training on your content
Identity and access
- SSO via SAML or OIDC
- Role-based access and per-node overrides
- Step-up reauth on sensitive actions
Operations and support
- Signed images with an SBOM
- Supported versions, sequential upgrades
- Dedicated support and security review
AI, your way
AI features are a toggle. Use our metered proxy, billed at cost plus a margin, or point the deployment at your own model provider key so traffic goes straight to your provider.
Never a data hostage
Licensing is entitlement-based, not a live billing dependency. On expiry, writes pause but reads and existing data stay available. A grace window protects you from transient network loss. There is never a hard lockout.
What governance teams get
Self-hosted is built so a security review can verify the claims, not just read them. The data plane is yours, the control plane is ours, and the boundary between them is small and documented. Here is exactly what crosses it, who can sign in, what gets recorded, and how the deployment is operated.
Two documented egress paths, and nothing else
| Path | What it carries |
|---|---|
| License refresh (always on) | License key, install id, version, active-seat count. No PII, no paths, no content. |
| AI request (hosted-proxy mode only) | The prompt content for AI features. Removed entirely by bring-your-own-key or AI off. |
Sign-in through your identity provider
Users authenticate through your own identity provider over SAML or OIDC. They do not use Pathrule-hosted accounts, and Pathrule is not in the runtime sign-in path. The first providers we certify are Microsoft Entra ID, Okta, and Google Workspace. The first successful sign-in for a person creates their membership in the licensed organization automatically, so you do not pre-provision every user by hand, and your admins manage roles from there. Identity lives with you. What stays with us is only the entitlement relationship.
Roles and audit
Access is role-based across owner, admin, editor, and viewer, with workspace-private access on top so a node can be restricted to specific people. Administrative surfaces are limited to owners and admins. Mutations are recorded as a change history you can review: who changed what, and when. Read-level auditing is available on request for contracts that require it, off by default because recording every read carries a cost you should opt into deliberately, not inherit.
A supply chain you can inspect
The deployment ships as signed container images with a software bill of materials attached per release, and the compose file pins each image by digest. The upstream Supabase images are vendored unmodified. No vendor secrets ship inside the bundle: our billing keys and our model-provider key never reach your infrastructure. The only vendor cryptographic material in the bundle is the public key used to verify your license, which is why license checks keep working even if our control plane is briefly unreachable.
Operated and supported for the long term
The admin sidecar exposes liveness and readiness health endpoints you can point your own monitoring at, and a one-command health check that reports database reachability, migration state, and license status. A support bundle produces redacted diagnostics with content lines stripped, so you can share a problem without sharing your data. We support the latest and previous major versions, with sequential, customer-triggered upgrades that never auto-mutate your database, plus a documented backup and restore runbook.
Support tiers
| Tier | Response target | Channels |
|---|---|---|
| Standard (included with every contract) | Next business day | Email and a shared Slack or Teams channel. |
| Premium (negotiated add-on) | Eight business hours, plus upgrade-assistance sessions | Adds scheduled video and a named contact. |
Start with a time-limited proof of concept on your own infrastructure before you commit. Talk to sales for terms.