Self-hosted operations
Agree hosting, access, processing destinations, operating responsibilities and acceptance for a private deployment.
Deployment components
A private installation includes application access, evaluation processing, data storage and background work. Agree the architecture and approved processing destinations with the deployment team. Version-specific infrastructure, model provisioning and migration instructions belong in the operator deployment package.
A private deployment defines where services run; it does not by itself guarantee zero egress, unlimited capacity, certification, or a particular availability level.
Configure deliberately
| Concern | Operational requirement |
|---|---|
| Database | Define data ownership, authenticated access, encrypted connections and capacity. |
| Frontend/backend | Set the public app origin and backend origin consistently. Route authenticated management calls to the correct API. |
| Secrets | Keep auth/encryption secrets stable and inject service credentials through an approved secret store. |
| Background work | Verify queued evaluations, recovery, cancellation and operator responsibilities. |
| Migrations | Use the version-specific operator procedure and rehearse backup, migration and rollback. |
| Detectors | Install required models/dependencies or configure approved provider endpoints before declaring readiness. |
| Licenses/limits | Verify the deployment's actual entitlement, quotas, and any enabled license controls. |
Obtain the maintained operator package for your release before installation. Public SDK documentation is not a complete infrastructure runbook.
Verify the environment
Check /health and /ready, then run a scoped SDK evaluation, exporter receipt check, queued Test Lab case, and connected-target regression. Inspect failure and recovery paths, including detector unavailability and worker restart.
A green Secrets check is not broad detector readiness. A response from the frontend is not proof that queued work can execute. OAuth/SSO and billing require their own configuration and acceptance tests.
Egress and retention
Inventory all model, judge, telemetry, alert, authentication, and payment destinations. Self-hosting does not automatically disable external services. Review capture settings, retention, backup access, report sharing, and historical content. See data handling.
Latency and capacity
Measure the actual deployed regions, database round-trip time, cold connections, detector startup, concurrency, and model calls. Reuse connection pools and inspect query plans. Local benchmarks and controlled added-delay tests cannot certify a remote database deployment.
Release acceptance
Agree the supported integration/version, permitted data, target network access, failure policy, operator responsibilities, backup/recovery procedure, and acceptance criteria. Policy templates support engineering review; they do not establish regulatory certification. Compliance evidence explains that boundary.
For deployment planning, contact the team.