Self-hosted AI company OS: security, compliance, and data sovereignty

Why do teams self-host a company OS?

Three drivers come up consistently. Data residency: regulated industries and privacy-sensitive teams need customer records and internal documents to stay in a specific jurisdiction or network boundary. Compliance posture: when auditors ask where data lives, who can access it, and what the AI did with it, 'on our infrastructure, with these audit logs' is a shorter conversation than a vendor questionnaire chain. Cost shape: per-seat SaaS pricing compounds across 4–10 tools; a self-hosted OS costs whatever your infrastructure costs.

There's a fourth driver specific to AI-native platforms: model control. If agents read your CRM and docs, some teams want inference to happen on hardware they own. Aexy's LLM gateway treats local models (via Ollama) as a first-class provider, so agent workloads can run without any data leaving your network.

What does the self-hosted architecture look like?

Aexy deploys with Docker Compose and uses deliberately boring, auditable components:

• PostgreSQL for all structured data — CRM records, tasks, workflows, people data.
• Redis for queues and caching; Temporal for durable background workflows (syncs, automations, agent runs).
• S3-compatible object storage (RustFS) for files and documents — swappable for any S3 API.
• A FastAPI backend and Next.js frontend, both in the public repository — you can read every line before you run it.
• LLM gateway with pluggable providers: Anthropic Claude, Google Gemini, or fully local via Ollama, with per-provider rate limits.

How does self-hosting support a compliance program?

To be precise: self-hosting doesn't make you compliant with anything by itself — certifications like SOC 2 attach to organizations and their processes, not to software you install. What self-hosting changes is how much of the compliance surface you control.

Data processing agreements shrink when the processor is you. Access control integrates with your existing infrastructure rather than a vendor's IAM. Retention and deletion policies are enforced on your storage. And for AI specifically, Aexy's immutable agent audit log — every run, tool call, policy decision, and config change — gives reviewers the evidence trail that 'we use AI responsibly' claims need.

Self-hosted vs. cloud: the honest trade-offs

Self-hosting costs operational attention: you own upgrades, backups, monitoring, and incident response for the platform itself. Small teams without infrastructure experience often start on managed cloud and move later — the open-source license guarantees that migration path stays open, in both directions.

The decision rule that serves most teams: if you have a compliance requirement, a data-residency constraint, or an ops-capable team and cost sensitivity, self-host. If you have none of those, cloud is faster and the exit door stays open.

Frequently asked questions