Self-hosted and VPC
Run the same platform inside your own infrastructure, so evaluation data never leaves your network. Available on Enterprise.
A clear picture of what self-hosting changes and what it does not, and the right question to bring to a call.
Everything else in these docs describes the hosted platform, where your application sends responses to us and we score them. Self-hosted runs the same platform inside your own infrastructure instead — your evaluation data never leaves your network.
It is available on the Enterprise plan, and it is set up with our team rather than from a download page. This page is what it is and who it is for; the deployment itself we walk through with you.
When it is the right choice
- Your data cannot leave your network. Regulated industries — healthcare, financial services, legal — where prompts and responses carry protected or privileged material.
- You have a data-residency requirement. A specific region, or a specific cloud account.
- Your security review needs it. Some procurement processes will not clear an external service handling production traffic, whatever the certifications say.
- You already run in a private VPC and would rather keep evaluation inside it than open an egress path.
- You run fully air-gapped. Self-hosted runs offline with no outbound connection at all — including Max-Accuracy, whose reasoning judge stays on-node.
If none of those apply, the hosted platform is simpler and you can start today with the Quickstart. Self-hosting is a deployment decision, not an upgrade — the scoring is identical either way.
What stays the same
- The same deterministic scoring: six categories, 49 dimensions, reproducible run to run
- The same SDK and the same
observe()call — you point it at your deployment instead of ours - The same dashboard, experiments, prompt registry and monitoring
Which means everything in these docs still applies. Your integration code does not change.
What is different
- Where it runs. Your infrastructure or your VPC, under your network controls and your access policy.
- Where the data sits. Prompts, responses and retrieved context stay in your environment.
- How it is licensed. An annual licence rather than the per-evaluation pricing of the hosted plans, so evaluation volume does not change the bill.
- How it is upgraded. On a schedule you control, coordinated with us, rather than continuously.
Compliance
The hosted platform holds SOC 2, supports HIPAA with controls and a BAA, and is GDPR compliant. Self-hosting is usually chosen alongside those rather than instead of them — most teams who ask for it need the certification and the data boundary.
Talk to us
Deployment is scoped to your environment, so the useful next step is a conversation rather than a download. A call covers what runs where, what you provide and what we provide, the prerequisites in your infrastructure, and licensing.
Book a demo below, or email info@variably.dev with a sentence about your environment and the constraint driving the requirement — it makes the first call much shorter.