Skip to content

Private betaRequest early access →

Sign in

Self-hosted

Your infrastructure. Your data residency.

The same standards-native IAM and agent governance you get in the cloud — running entirely on infrastructure you control, with a signed, digest-pinned supply chain.

Release bundleFig. 1
  • signaturesigned, verified before deploy
  • digestsevery image pinned by digest
  • sbomattached to each image
  • provenancebuild attestation present
Deployrefuses on any failed check

Why self-host

Eight things that travel with the install

Each one is a mechanism in the platform today, and each stays on your side of the boundary.

Data residency & sovereignty

Keep every identity and audit record inside your own jurisdiction — whichever one that is. Built for sovereign requirements and regulated data-locality mandates.

Cosign-verified images

The reference deployment is the distribution artifact. Every image is vulnerability-scanned before it is signed and carries signed build provenance and an SBOM; the server verifies the signature and both attestations, then deploys the exact verified digests — fail closed.

Air-gap friendly

Docker Compose + Postgres + Redis + Caddy on a single host, with egress network control. No mandatory phone-home for the platform to run.

Patches you can apply unattended

A patch release carries no new database migration and no new required configuration key — checked in CI on every version tag, before the images are built or signed. That is what makes a patch total-rollback-safe: the previous digests and an unchanged schema are a complete revert.

Agent identity, governed by your rules

Each agent holds its own credential and a risk level that sets a minimum oversight mode — configurable stricter, never weaker. Authority comes from a bounded delegation, sensitive actions can be gated on human approval, and a separately-permissioned kill switch contains an agent mid-session, killing tokens already issued and announcing it.

Evidence that travels with the install

Compliance readiness, the hash-chained audit log and its integrity check run inside your deployment, not ours — so the evidence an auditor asks for is produced on your side of the boundary, air-gapped if that is where you run.

Assurance evidence you can verify offline

We run scored assurance scenarios against the platform itself, and each finished run exports as signed JSON and a PDF that verify against a published key without calling home. It is Zynth's own programme, deployed as an opt-in overlay: a self-hosted install runs the platform, not our assurance runs.

Supported releases & backports

A licence includes supported versions and security backports — the obligation we take on so your install stays current and safe.

Self-hosted licences

Licences open after the private beta

Self-host is built, not pending: every version tag builds an offline bundle of scanned, cosign-signed images with signed build provenance that verifies without calling home, and the reference deployment above is that artifact. What the private beta gates is the licence — there is nothing to buy yet. The door that is open is the beta itself: tell us about your environment and your residency requirements here, and we will come back to you when licences open.

What a licence conversation will cover

  • Deployment review
  • Residency & sovereignty scoping
  • Security & compliance package

Not available during the private beta — no self-host licence can be issued yet. Register your requirements and we will contact you when licences open.

Before you apply: please read

Private beta, AI-first operations. Perihelium is built and operated with AI agents in the loop and may change or be interrupted without notice. It carries no service level during the beta. Back up your own data; Zynth does not guarantee its retention during the beta.

This is the private-beta waitlist — the same one, tagged so we can see self-host demand separately. Put your deployment target (cloud, on-prem or air-gapped), your residency requirements and your timeline in “what you want to test”, and we will come back to you.

About you
About the application
Stage
Platform (any that apply)
What you would connect
Integrations (at least one)
Scale and timing
Expected human identities
Expected AI agents
When could you start testing?
Consent

No newsletter, no third-party form service: this goes straight to Zynth and nowhere else. Private beta, operated AI-first: no service level, and you are responsible for backing up your own data. The private beta is invitation-only; an invitation is not guaranteed.

This page is the summary. The documentation has every endpoint, parameter and edge case.