Self-host Provostry.
For teams whose ledger of decisions and evidence must never leave their network. This page is everything an evaluator needs to know up front — the only step that involves a human is the license itself, because a license is a contract.
01 · What ships
One container, no external dependencies to start
- A single container — the API serves the executive operations center itself. No separate frontend deployment, no CDN requirement.
- Zero-dependency ledger to start — an append-only JSONL file. Switch to Postgres (with row-level tenant isolation) by setting one connection string. No migration ceremony to begin evaluating.
- Fully air-gapped operation — no phone-home, no external calls required to run. Customer chat/ticketing integrations (Slack, Teams, Jira) are optional per-org connections you can simply not configure.
- Verified in CI — the test suite (including a Postgres integration suite) runs on every commit; Provostry's own CI attests its own changes into its own ledger.
$ docker compose up # dashboard + API on :4400
$ curl -X POST localhost:4400/api/v1/events -d '{"type":"evidence_bundle", ...}'
02 · Configuration surface
Environment variables you'll actually touch
| Variable | What it does |
|---|
| PROVOSTRY_DATA | Ledger file location (default: bundled data dir). Ignored when Postgres is set. |
| PROVOSTRY_DATABASE_URL | Postgres connection string — flips the ledger backend to Postgres with per-tenant row-level security. |
| PROVOSTRY_MULTITENANT | Set 1 to give each account its own isolated ledger. |
| PROVOSTRY_SIGNING_KEY | Enterprise: HMAC-signs every appended event — the ledger becomes tamper-evident, not just append-only. |
| PROVOSTRY_CONNECTIONS_KEY | Encrypts customer integration secrets at rest (AES-256-GCM). Without it, secret writes are refused — never stored in plaintext. |
| PROVOSTRY_API_KEY | Root admin credential. Per-agent keys are issued from it and stored hashed. |
03 · Security posture
The properties, stated plainly
- Append-only, hash-chained ledger — decisions and evidence are appended, never edited. With a signing key, tampering is detectable.
- Per-agent hashed API keys — agents cannot impersonate each other; the audit trail names the real actor.
- Tenant isolation enforced twice — Postgres row-level security and explicit tenant filters in every query, so even a superuser connection doesn't leak across tenants.
- Webhook signatures verified, fail-closed — billing and chat callbacks are HMAC-verified over raw bytes with replay windows; unsigned traffic is rejected, not tolerated.
- Customer secrets encrypted at rest — integration credentials are AES-256-GCM encrypted and never returned by any API, including to their owner.
- RBAC + signed audit export — enterprise features for the people whose job is to check ours.
04 · Evaluation
Read the code, then decide
The governance and validation engine is proprietary — it's the product — but it is readable under evaluation: you get the source, you audit it on your terms, and the client SDK and integration adapters are Apache-2.0 outright. We'd rather you verify than trust; that's the product's whole thesis applied to us.
The one human step: a self-hosted enterprise license is a signed agreement with support attached, and no honest website can turn a contract into a button. One email starts it — say what your environment looks like (cloud, on-prem, air-gapped) and you'll get the evaluation source and terms back, not a sales sequence.
Request evaluation source + terms
Prefilled so it takes a minute. Not sure you need self-hosting? Create a hosted workspace — self-serve, free to start — and see it run today.