Not sure which fits? We will tell you straight.
A 30-minute call, your constraints, an honest recommendation - including when self-hosting is more work than it is worth for you.
Self-hosted is how most of our customers deploy, and it is what the platform was built around - air-gapped, local LLM, nothing leaving the network. If you would rather not run it yourself, the same engine is available in your own cloud account or as a dedicated instance we operate.
The choice is where it runs, not what you get. Every edition, every scanner and every feature is identical across all three - there is no cut-down deployment.
Your infrastructure, your network, your rules
Docker Compose or Kubernetes inside your own perimeter. Nothing calls home, the LLM runs locally, and the platform works with no internet route at all. This is what regulated buyers deploy, and it is the configuration the product was designed around.
Same install, running in your own cloud account
The identical deployment inside your AWS, Azure or GCP subscription. The data plane stays in infrastructure you own and bill for, so residency and network policy remain yours, while you skip running hardware.
A dedicated instance we operate for you
Single-tenant: your own instance, your own database, operated and upgraded by our team. For teams that want the platform without owning the runbook. It is a dedicated deployment, not a shared multi-tenant pool.
The honest version of the question. In the first two, nothing crosses your perimeter - including the AI, which runs locally. In managed, your code reaches an instance we operate, and that is the trade you are making for not running it yourself.
Four rows decide this for most teams: where the data sits, who patches it, who holds the keys, and whether you need to operate without an internet route.
| Self-hosted | Your cloud | Managed | |
|---|---|---|---|
| Where the code and findings live | Your network | Your cloud account | Dedicated instance we run |
| Air-gapped operation | Yes | If your account allows it | No |
| Who applies upgrades | You | You | We do |
| Who holds the encryption keys | You | You | You, escrowed with us |
| Infrastructure to run | Yours | Yours | None |
| Time to first scan | About 10 minutes | About 10 minutes | Same day |
| Feature set | Complete | Complete | Complete |
Managed is a dedicated single-tenant instance. We do not operate a shared multi-tenant pool, and there is no free metered tier - the trial is a full 30-day proof of concept, in whichever model you plan to buy.
Moving between them is a supported path, not a migration project. Teams that start managed and later bring it in-house keep their findings, history and evidence - the deployment changes, the data does not.
A 30-minute call, your constraints, an honest recommendation - including when self-hosting is more work than it is worth for you.