Self-Hosting

Included on the Enterprise plan. Book a demo, opens in a new tab. Not included on the Team plan. Not included on the Starter plan. Not included on the Free plan.

Self-hosting runs the entire Confident AI platform inside your own cloud account. Your traces, datasets, prompts, and evaluation results stay in your network, and you control the region, networking, and security posture. Nothing is sent to Confident AI's systems.

How a deployment works

A self-hosted deployment has two parts, and you run them in order:

Provision infrastructure with Terraform
A published Terraform module creates the Kubernetes cluster, the PostgreSQL database, object storage, and the keyless identity wiring the app needs. It deploys into a VPC or VNet you already have, it never creates one for you.
Deploy the application with Helm
The confident-ai Helm chart installs the app (backend, frontend, evaluation service, and workers) along with in-cluster ClickHouse and Redis. You feed it the outputs from the Terraform step.

Terraform owns the cloud resources. Helm owns everything that runs inside the cluster. Keeping them separate means you can manage infrastructure and application lifecycles independently, and you can bring your own cluster if you already run one.

Find your self-hosting path in < 15 minutesExplore deployment options and get a tailored walkthrough of architecture, security, and rollout for your environment.Book a demo

Pick your cloud

AWS

EKS, RDS PostgreSQL, and S3, with EKS Pod Identity for keyless access.

GCP

GKE, Cloud SQL, and GCS, with Workload Identity for keyless access.

Azure

AKS, PostgreSQL Flexible Server, and Blob storage.

What runs where

Terraform provisions the managed cloud services. Helm installs the workloads inside the cluster.

Provisioned by Terraform (managed services)	Installed by Helm (in-cluster)
Kubernetes cluster (EKS / GKE / AKS)	`confident-backend`: core API
PostgreSQL (RDS / Cloud SQL / Flexible Server)	`confident-frontend`: the dashboard
Object storage (S3 / GCS / Blob)	`confident-evals`: evaluation service
Keyless workload identity	`confident-evals-worker` and background workers
Code executor, managed Redis, and secret store (all optional)	`confident-otel`: trace ingestion collector
	ClickHouse and Redis (unless you point at managed services)

By default ClickHouse and Redis run in the cluster, so a base deployment needs only the cluster, PostgreSQL, and object storage. Managed Redis and a cloud secret store are opt-in.

What you get from Confident AI

Two things come with your Enterprise license. Both are covered on each cloud's Deploy page.

Next steps

Deploy on AWS

Deploy on GCP

Deploy on Azure

Last updated on July 29, 2026