- Docs
- Guides
Deployment Options and Data Location
The three ways to run Archigov — self-host, supported self-host and a managed instance — and exactly where your data, backups, keys and AI requests go in each.
#One Image, Three Ways to Run It
Archigov is one container image, and every option runs that same image with every feature. What differs is who runs it, where it runs, and where AI comes from.
| Self-Host | Supported Self-Host | Managed Instance | |
|---|---|---|---|
| Who runs it | You | You, with vendor support and assisted upgrades | We do |
| Where it runs | Your infrastructure | Your infrastructure | A dedicated instance in the region you choose |
| Licence | AGPL-3.0 | AGPL-3.0 | AGPL-3.0 (we operate it) |
| AI | Your own provider and keys | Your own provider and keys | Included models, or your own model tenant |
Prices are on archigov.com. The rest of this page is about data: where it lives and where it travels.
#Self-Host: Everything Stays Where You Run It
Both self-hosted options keep all state on the volume you give the container:
| Data | Where it lives |
|---|---|
| The database: model, decisions, reviews, positions, the audit chain | /data/app.db on your volume |
| Nightly backups (last 14) and pre-migration snapshots | /data/backups, on the same volume, so copy them off the host |
| A continuous replica, if you use Litestream | The object storage or disk you choose. Put it in the same jurisdiction as the instance |
| Signed evidence packs | /data/evidence-packs |
| Keys: evidence signing, session, the generated secret key | /data/keys. Never replicated; keep a copy in your secret store |
What leaves the container, and only when you configure it:
- Azure: read-only metadata calls to Resource Graph, Defender for Cloud and Azure Policy, with your read-only identity.
- Microsoft Entra ID: sign-in, when
AUTH_MODE=entra. - Azure DevOps: read-only work-item queries, and the service hook you point at the instance.
- Your AI provider, for the AI features you switch on (see below).
- endoflife.date: only when the platform admin chooses Refresh in the Legacy Register. It fetches public product support dates and sends nothing about you.
Nothing is sent to us. There is no telemetry and no licence check, and the instance does not phone home.
Need UK-only data residency, or everything inside your own tenant? Self-host, for example in your organisation's Azure subscription in UK South. It is the same single container.
#Managed Instance: The Region You Choose
We run a dedicated instance for you. It is never shared with another organisation.
| Regions | Western Europe, Eastern Europe, Eastern North America, Western North America, or Asia-Pacific, chosen when the instance is set up |
| Jurisdictions | EU or US. With a jurisdiction, the instance's data is stored and processed only inside it |
| Database and replica | The instance's database is replicated continuously, to storage in the same region or jurisdiction. The recovery point is seconds, not a day |
| Sign-in | Your Microsoft Entra ID |
| Evidence-signing keys | Generated per instance; the public key is published to you, so you can verify every pack yourself |
A region and a jurisdiction are different promises.
- A region places your instance there, and its storage on a best-effort basis.
- A jurisdiction is a guarantee. EU and US are the two available; with one, compute and storage both stay inside it.
There is no UK-only jurisdiction, so UK-only residency means self-hosting.
#Where AI Requests Go
AI is off by default and enabled per feature. What a feature sends is the context it needs: the text of the review, design or decision, the relevant catalogue items, and for pre-review the application's resources (see AI in Archigov). Where that goes depends on the option:
| Option | Model | Where inference runs |
|---|---|---|
| Self-host, either option | The provider you configure: OpenAI, Claude (Anthropic), Mistral, Ollama or any OpenAI-compatible endpoint | Wherever that provider or endpoint runs. With Ollama, or an endpoint in your own tenant, nothing leaves your network |
| Managed: included AI | Hosted models we provide | In the EU, whichever region hosts your instance |
| Managed: AI Premium add-on | Frontier models under zero-retention contracts | The provider's processing locations, stated in your data processing terms |
| Managed: your own model tenant | Your deployment, for example Azure OpenAI | The region you deploy it in. This is the way to keep AI inside your region |
Included AI cannot be pinned to an instance's region, so it runs in one place, the EU, for every managed instance. If your AI must stay in your region, use your own model tenant, or self-host with an endpoint you control.
AI provider keys are encrypted at rest, and are never returned by the API, audited or exported, in every option.
#Choosing
- Data must stay in the UK, or inside your own tenant: self-host or supported self-host.
- No capacity to operate it: a managed instance. Choose the EU or US jurisdiction if residency must be guaranteed.
- AI must stay in your region: self-host with your own endpoint, or a managed instance with your own model tenant.
- Recovery measured in seconds: a managed instance, or self-host with continuous replication.
To run it yourself, start with Self-host in production.
Something unclear or out of date? Write to hello@archigov.com or open an issue on GitHub.