# Self-Hosting

Self-hosting runs the entire Confident AI platform inside your own cloud account. Your traces, datasets, prompts, and evaluation results stay in your network, and you control the region, networking, and security posture. Nothing is sent to Confident AI's systems.

> Self-hosting is available on Enterprise plans. [Talk to the platform team](https://www.confident-ai.com/book-a-demo) to get a license key and access to the container images.

## How a deployment works

A self-hosted deployment has two parts, and you run them in order:

#### Provision infrastructure with Terraform

A published Terraform module creates the Kubernetes cluster, the PostgreSQL database, object storage, and the keyless identity wiring the app needs. It deploys into a VPC or VNet you already have, it never creates one for you.

#### Deploy the application with Helm

The `confident-ai` Helm chart installs the app (backend, frontend, evaluation service, and workers) along with in-cluster ClickHouse and Redis. You feed it the outputs from the Terraform step.

Terraform owns the cloud resources. Helm owns everything that runs inside the cluster. Keeping them separate means you can manage infrastructure and application lifecycles independently, and you can bring your own cluster if you already run one.

## Pick your cloud

#### [AWS](/docs/self-hosting/aws)

EKS, RDS PostgreSQL, and S3, with EKS Pod Identity for keyless access.

#### [GCP](/docs/self-hosting/gcp)

GKE, Cloud SQL, and GCS, with Workload Identity for keyless access.

#### [Azure](/docs/self-hosting/azure)

AKS, PostgreSQL Flexible Server, and Blob storage.

## What runs where

Terraform provisions the managed cloud services. Helm installs the workloads inside the cluster.

| Provisioned by Terraform (managed services)                   | Installed by Helm (in-cluster)                              |
| ------------------------------------------------------------- | ----------------------------------------------------------- |
| Kubernetes cluster (EKS / GKE / AKS)                          | `confident-backend`: core API                               |
| PostgreSQL (RDS / Cloud SQL / Flexible Server)                | `confident-frontend`: the dashboard                         |
| Object storage (S3 / GCS / Blob)                              | `confident-evals`: evaluation service                       |
| Keyless workload identity                                     | `confident-evals-worker` and background workers             |
| Code executor, managed Redis, and secret store (all optional) | `confident-otel`: trace ingestion collector                 |
|                                                               | ClickHouse and Redis (unless you point at managed services) |

By default ClickHouse and Redis run in the cluster, so a base deployment needs only the cluster, PostgreSQL, and object storage. Managed Redis and a cloud secret store are opt-in.

## What you get from Confident AI

Two things come with your Enterprise license. Both are covered on each cloud's Deploy page.

> - **Image pull credentials** (`imagePullSecrets`): the first-party images are hosted in Confident AI's private registry. You get credentials to pull them into your cluster.
> - **License key** (`CONFIDENT_LICENSE_KEY`): a signed key that enables the features your plan includes. Without it, the app starts with all features off.

## Next steps

#### [Deploy on AWS](/docs/self-hosting/aws)

#### [Deploy on GCP](/docs/self-hosting/gcp)

#### [Deploy on Azure](/docs/self-hosting/azure)