What stays inside your boundary

The point of self-hosting is that the parts that matter never leave. Inside your boundary you run the whole control plane, not a thin client that phones home. Key points:

• The portal (the developer-facing surface) runs inside the boundary.
• The engine (the control plane that generates manifests and CI steps, delegates execution to your tools, and records results) runs inside the boundary.
• Governed AI runs inside the boundary too: you connect your own model provider, and the gateway, policy, approvals, and budgets stay on your side.
• Compliance evidence (the audit trail and the data your reports draw on) stays where you can point at it and hand it to an oversight body.
• Open-core, Apache-2.0 core. The core is open-source under Apache-2.0, so you can read and run it yourself. For a sovereignty review, "no black box" is a real answer, not a slogan. Some enterprise capabilities ship as add-ons on top of the open core.