Self-Hosted Deployment
The full platform. Inside your perimeter.
ManySignal self-hosted runs every component — ingestion, entity graph, detection engine, AI triage, and response automation — on infrastructure you own and operate. No telemetry leaves your environment. No cloud dependency for runtime operation.
Self-hosted deployment components
Ingestion workers
Kafka-compatible consumers and REST ingest endpoints. Scale horizontally by adding worker replicas.
Normalization service
Stateless processing containers. Vendor parsers ship as signed OCI images on a monthly release cycle.
Entity graph database
Embedded graph database with optional external managed graph for large deployments (AWS Neptune, Neo4j).
Event store
ClickHouse-based columnar store for hot-tier events. Cold tier writes to any S3-compatible object storage.
AI inference runtime
Ollama or vLLM-compatible inference server for on-premises model hosting. Connect to air-gapped quantized models.
Platform API server
Single Go binary. Ships as a Helm chart with configurable resource requests. Horizontal scaling supported.
Workflow engine
Temporal-based workflow orchestrator running entirely within the tenant network boundary.
Web UI
Static single-page application served from the same cluster. No external CDN dependency required.
Update mechanism
OCI image pulls from a private registry mirror you control. Internet connectivity not required at runtime.
What changes vs. cloud-hosted
You manage the infrastructure
Self-hosted runs on your Kubernetes cluster, your storage, and your network. The ManySignal Helm chart configures resource requests, anti-affinity rules, and PodDisruptionBudgets. You are responsible for cluster upgrades, node health, and storage availability.
- Kubernetes 1.27+ required; EKS, GKE, AKS, and bare-metal tested
- Minimum 24 cores and 96 GB RAM for a production deployment
- High-availability configuration requires 3 availability zones
You manage the infrastructure
Updates are on your schedule
Platform updates ship as new Helm chart versions. You pull the chart update, review the changelog, run the migration scripts, and apply. Release notes flag breaking changes. No automatic updates touch your environment without your initiation.
- Monthly minor releases, quarterly major releases
- Migration scripts are idempotent — safe to run multiple times
- Canary deployment supported for zero-downtime major updates
Updates are on your schedule
AI runs on-premises
The inference runtime supports running quantized open-weight models on GPU nodes you own. For air-gapped deployments, models are distributed as signed OCI artifacts via a private registry. The platform ships with recommended models tested for security task performance.
- NVIDIA A100, A10G, and L40S GPU tested
- CPU-only inference supported for smaller deployments (higher latency)
- Model performance benchmarks published per release
AI runs on-premises
Self-Hosted — FAQ
Does self-hosted require an internet connection?
No. Air-gap operation is fully supported. You need an internet connection only to pull Helm chart and OCI image updates from the ManySignal registry mirror — and even this can be mediated through an internal artifact proxy. Runtime operation has no internet dependency.
How does licensing work for self-hosted?
Licenses are issued as signed JWT tokens with an embedded entity count and expiry date. The platform checks the license at startup and at midnight daily. License files can be updated without a restart by placing the new file in the configured secrets directory.
What monitoring do you recommend for self-hosted?
The platform exposes Prometheus metrics on a configurable port. A reference Grafana dashboard ships with the Helm chart. We also provide a health API endpoint suitable for external uptime monitoring. Detailed runbooks for common failure modes are included in the operator documentation.
Is support available for self-hosted deployments?
Yes. Support for self-hosted deployments includes access to the operator documentation, a private Slack channel with the engineering team, and SLA-backed incident response for critical production issues. Support engineers can access diagnostic bundles you generate — no direct access to your environment is required.
What are the infrastructure prerequisites for self-hosted deployment?
A minimum of 9 Kubernetes nodes (8 cores / 32 GB RAM each) across three availability zones. Object storage (S3 or S3-compatible) for raw event archives. GPU acceleration is optional for self-hosted AI model inference but not required when using a hosted model API endpoint.
How are platform updates delivered for self-hosted?
Updates are delivered as versioned Helm chart releases. A changelog and migration guide accompany each release. Updates can be applied with zero downtime via rolling deployments. Breaking changes are announced 30 days in advance with a migration path documented.
Can we restrict which AI models the self-hosted platform uses for triage?
Yes. Self-hosted deployments can configure the triage agent to use a specific hosted model API endpoint (OpenAI, Anthropic, Azure OpenAI) or a locally deployed open-weights model. Model configuration is per-feature and version-pinnable — no forced updates to the AI layer.
How does the self-hosted option satisfy data sovereignty requirements?
In self-hosted mode, all data — telemetry, entity graph, case records, audit logs, and AI inference — remains within your infrastructure. No data egresses to ManySignal cloud systems. The platform communicates with ManySignal only for licence validation and optional threat intelligence feed updates, both of which can be proxied or disabled.
What is the deployment timeline for a self-hosted installation?
Customers with an existing Kubernetes cluster typically complete initial deployment in 1–2 days following the operator runbook. Full connector configuration, baseline training, and analyst onboarding run over the following two weeks. ManySignal's implementation team provides hands-on support throughout.
Full capability. No cloud dependency.
Talk to the deployment team about sizing, GPU requirements, and the self-hosted deployment timeline for your environment.