Skip to main content
Planned release. Self-hosted Asymptote is in development and offered to design partners through a Private Deployment engagement; the Helm chart and Terraform modules described in this section are not generally available yet. This section describes the planned release: chart names, values keys and paths may change before it ships. Today’s Asymptote Cloud dashboard uses hosted services for sign-in and product analytics; the self-hosted release replaces them, as described in System Architecture. Contact us to take part.

Overview

Asymptote gives security teams visibility and control over the AI agents their developers run: what each agent was asked, which tools and commands it ran, which files and MCP servers it touched, and which policies it broke. Self-hosted Asymptote runs the whole platform in your own cloud account, so agent telemetry, findings and users never reach Asymptote.
  • Everything Asymptote Cloud does runs in your Kubernetes cluster: the dashboard, API, policy checks, detections, background reviews and the analytics store.
  • Agent Beacon on your endpoints is the same as in every option. You point it at your deployment instead of ours.
  • Asymptote has no access to the deployment unless you open a support session. The deployment sends nothing back to Asymptote: no telemetry, usage analytics, license checks or reporting. See Network requirements for everything it does reach.
See Hosting Options to compare self-hosting with Asymptote Cloud and BYOC storage.

Deployment

  • Ships as a Helm chart with signed container images. Runs on Amazon EKS, Google Kubernetes Engine, Azure Kubernetes Service, or any conformant Kubernetes cluster.
  • Optional reference Terraform for AWS, Google Cloud and Azure creates the cluster and the services the chart needs. See Terraform.
  • Works on private networks: endpoints can reach the ingest and policy endpoints over your VPN only, and images can be mirrored into your own registry.
  • See Deployment Options to choose a path, and Kubernetes Deployment for the install.

LLM configuration

  • Policy checks and background reviews call an LLM endpoint you provide.
  • Supported: Amazon Bedrock, Vertex AI, Azure OpenAI, and any OpenAI-compatible API, including models you serve yourself.
  • Usage is billed by your provider, in your account.

Database requirements

  • PostgreSQL 15 or later, for application state: users, devices, policies, findings and audit records. Use your cloud’s managed PostgreSQL. You provision and maintain it.
  • ClickHouse, the analytics store for search, timelines and detections. The chart runs it in your cluster through the ClickHouse operator, or connects to a ClickHouse you already operate.
  • Object storage, the system of record for raw telemetry: S3, Cloud Storage or Blob Storage, with new-object notifications.

Version management

  • Asymptote publishes a chart version with each release, with release notes and a runbook.
  • Upgrade with helm upgrade on your schedule. Database and ClickHouse migrations run during the upgrade.
  • Asymptote supports the current release and the two before it.

Endpoint and runtime support

  • Every runtime Beacon supports on macOS, Linux and Windows, including Claude Code, Codex, Cursor, GitHub Copilot and Gemini CLI. See Runtimes.
  • Live policy enforcement is answered by the policy service in your cluster.
  • Endpoints enroll with your deployment. See Connecting Endpoints.

Getting started

Self-hosted Asymptote is offered to design partners through a Private Deployment engagement while the release is built. Asymptote’s engineers size the deployment with you and work with your platform team on the first install. Contact us to start.

Deployment Options

Choose a path and see what you need to provide.

System Architecture

The services, how data flows between them, and the security model.

Kubernetes Deployment

Install the Helm chart, step by step.

SSO

Sign in through your SAML or OIDC identity provider.