Available on request
Self-hosted SecurityVault,
on your own Kubernetes.
Run SecurityVault inside your own Kubernetes cluster, with your team controlling access, storage and outbound integrations. Self-hosting uses the same platform charts and images as the hosted service and is available on request, with installation scope agreed with our engineers.
Status
What does self-hosted include?
Availability
Available on request. Our engineers set it up with you on your cluster.
Same platform
The same platform capabilities, from SAST, SCA and SBOM and secrets to containers, Kubernetes, cloud posture and deployment gates, with the same trust boundaries.
Delivery
Images are delivered from our registry with credentials we issue to you, and each installation is sized and scoped with you before it starts.
Deployment options
Hosted or self-hosted: which fits your organisation?
| Area | Hosted | Self-hosted |
|---|---|---|
| Data location | India, on infrastructure we operate (see the trust page) | Your cluster, in your network |
| Operated by | SecurityVault | Your team, installed with our engineers |
| Our access to your data | Governed by the data processing agreement | Access controlled by your team; support scope agreed separately |
| Capabilities | Full platform | Full platform |
| Availability | Available | Available on request |
Data boundary
Does any data leave your network?
Telemetry
Off by default. When you enable it, telemetry goes to a collector inside your cluster, not to us.
AI
AI triage is advisory and runs on a model served inside your cluster; no prompt or finding is sent to a third-party AI service. AI cannot write a finding's status or disposition.
Outbound
Only what you configure: the repositories, registries and cloud accounts you connect, the notification and ticketing integrations you enable, and public vulnerability feeds (KEV, EPSS, NVD, OSV, GHSA) if you turn them on.
Our access
Your team controls access. Installation support and any diagnostic information you choose to share are scoped with you.
Requirements
What do you need to run it?
We size every installation with you. Full requirements are shared under NDA; the design principles are on the architecture page.
Cluster
A supported, current Kubernetes version with Helm.
Capacity
Compute and storage sized to the repositories, images, clusters and cloud accounts you govern, including capacity to serve the local AI model; GPU acceleration is supported.
Ingress and secrets
Standard Kubernetes ingress and certificate management, with integration into your existing secrets manager.
Network
Plan access to your scan targets, the installation image registry, and any enabled vulnerability feeds or integrations. We review the required destinations with you.
FAQ
Self-hosting questions
- How do I get self-hosted SecurityVault?
- Self-hosting is available on request. The full platform runs from the same Helm charts and images as our hosted service, and every installation is set up with our engineers.
- Does any data leave my cluster?
- Not by default. Telemetry is off, and when you enable it, it goes to a collector inside your cluster. AI triage uses a model served inside your cluster. Outbound traffic is what you configure: the repositories, registries and cloud accounts you connect, and public vulnerability feeds if you turn them on.
- Can it run air-gapped?
- An air-gapped installation bundle is not currently available. Installations pull images from our registry using credentials we issue to you, so the cluster needs outbound access during installation and upgrades. Describe any restricted-network requirements when you contact us.
- Can SecurityVault staff access a self-hosted installation?
- You control access to your installation. Any access or diagnostic material needed for installation and support must be agreed with your team; share only what is needed for the support task.
- Is self-hosted a different product from hosted?
- No. Same charts, same images, same trust boundaries. Commercial terms differ; capabilities do not.
Self-hosted
Run it inside your network.
Tell us about your cluster and constraints. An engineer who works on the platform replies with next steps.