Zensu
Enterprise · Self-hosted

Run Zensu on your own infrastructure

The full Product Lifecycle Manager — self-hosted on your own Kubernetes or a single VM, with complete control of your feature data. Air-gapped, zero outbound, no telemetry, no license-check call. Or stay on our EU-hosted SaaS, operated in Germany. Sales-assisted, annual terms.

Contact sales See install paths
0
outbound calls
no telemetry · no analytics · no license check
3
install paths
Helm · VM / Compose · air-gapped bundle
100%
your data
feature data stays inside your perimeter
EU
hosted option
Open Telekom Cloud · Germany
Data sovereignty

Self-host on your own Kubernetes.

Run Zensu entirely behind your own perimeter — in your own Kubernetes cluster or on a single VM — with no dependency on Zensu's SaaS and full control of your feature data.

  • Deploy the full suite — backend, frontend, MCP server, wiki, PostgreSQL — inside your own cluster or VM. Nothing runs on zensu.dev.
  • Your feature data, security profiles, and audit trail never leave your perimeter. You own the database and every backup.
  • Same container images and single-host routing contract as our hosted service. On-prem is a first-class target, not a stripped-down fork.
Air-gapped

Zero outbound. No phone-home.

Zensu is built to run with no internet access at all. With DEPLOYMENT_MODE=self-hosted the backend runs a fail-fast startup check and refuses to boot if any provider still points at the public internet — turning "is it really offline?" into a guarantee.

No telemetry

The backend and MCP server send no usage telemetry. Nothing about your features, users, or activity is reported anywhere.

No analytics

No third-party analytics, no trackers, no external CDN scripts. The frontend loads nothing from outside your perimeter.

No license-check call

There is no license server to phone. Nothing in the backend or MCP server reaches out to validate a license or ask permission to run — offline-first by design.

After loading the images and configuring internal endpoints, the deployment makes zero outbound internet connections. The only outbound HTTP it can make at all is to an internal AI gateway, embeddings endpoint, or SMTP relay — each off or internal-only in an air gap.
Supply-chain trust

Cosign-signed bundle, syft SBOMs.

Every release bundle is signed and inventoried so you can verify exactly what you are running — and prove it to your security team — without trusting a download or reaching the internet.

  • The air-gap bundle ships a cosign-signed SHA256SUMS — key-based, no transparency log, so it verifies fully offline against the bundled cosign.pub.
  • syft generates an SPDX SBOM per image, so your supply-chain review has a complete component inventory before anything is loaded.
  • The installer verifies checksums before doing anything and aborts on a mismatch; the public verifier key is published out-of-band on zensu.dev/security.
Compliance

EU-hosted, or fully under your control.

Two deployment models, both built for regulated teams: a German-operated, EU-hosted SaaS, or a self-hosted install where your feature data never leaves your perimeter. GDPR either way.

EU-hosted on Open Telekom Cloud

Prefer managed? Our hosted SaaS runs in Germany on Open Telekom Cloud — infrastructure operated by Deutsche Telekom to BSI C5 and ISO 27001. Your feature data stays in the EU at rest; optional AI (Product Studio) and email use US sub-processors under EU SCCs.

GDPR and on-prem control

Tag any feature GDPR, SOC2, or HIPAA, with an exportable audit log of every status transition, security review, and revision. Self-host for full control: the data lives in your database, under your data-protection regime.

Support & SLA

A direct line, with commitments.

Enterprise is sales-assisted with annual terms — dedicated support, a service-level agreement, tailored onboarding, and invoicing built around how your organization buys software.

Dedicated support with SLA

A direct support channel with response-time commitments, instead of community or shared email. Support tiers and SLA terms are part of your agreement.

Tailored onboarding

We help you stand up the install path that fits your environment — Helm, VM, or air-gapped — and get your team productive on the lifecycle.

Invoicing and annual terms

Custom annual agreements with invoicing, billed per organization with seat tiers. Sales-assisted, never self-serve — priced for the deployment you need.

Install paths

Three ways to deploy.

The same container images and single-host routing contract across all three paths. Full operator documentation ships inside the bundle and is provided with your agreement.

Kubernetes (Helm)

Existing cluster, multi-node, GitOps, scaling.

Umbrella Helm chart — bundled or bring-your-own database.

VM / Docker Compose

Single host, simplest footprint, appliance-style.

docker-compose.prod.yml + Caddy, one install.sh.

Air-gapped bundle

No internet access at all — load image tarballs offline.

Signed, checksummed bundle + private-registry overrides.

Talk to us about Enterprise.

Self-hosted is the Enterprise SKU — per organization, seat-tiered, annual terms, with dedicated support and an SLA. Tell us about your environment and we'll get you a verifiable signed bundle and the operator docs.

See all plans