# Self-hosted overview

> What a self-hosted ACOG installation runs, what it needs from your environment, what it connects to, and how it is licensed.

Product: AI Cost Optimizer Gateway (ACOG). Web version: https://tessarac.com/docs/acog/self-hosted/overview. Last updated: 2026-10-16.

ACOG can run entirely inside your own environment. A self-hosted installation runs the same product as the hosted service, built from the same code, and is installed with one Helm chart.

## What you run

| Service | Role |
|---|---|
| Web | The console, and the single entry point: it serves `/gateway` (the data plane) and `/api` (the control plane) on one address |
| Data plane | The gateway your applications call |
| Control plane | Organizations, users, keys, connections, settings, licensing |
| Metering | Usage, cost and savings, off the request path |
| DLP | Free-text and protected-source detection for data loss prevention |
| Embedder | Embeddings for DLP protected sources and the semantic cache |
| NER | Named-entity detection (names, medical terms) for DLP |

And their datastores: **PostgreSQL** (configuration), **Dragonfly** or another Redis-protocol store (hot state, caches), **ClickHouse** (usage and analytics), and optionally **Milvus** (the semantic cache). The chart can run all of them for you or use ones you already operate.

All images are public at `docker.io/tessarac` and multi-architecture (amd64 and arm64). The data plane and control plane use their `-selfhost` builds (`tessarac/dataplane-selfhost`, `tessarac/controlplane-selfhost`).

## Requirements

| | |
|---|---|
| Kubernetes | Any conformant distribution, with Helm 3 (OCI support) and a ReadWriteOnce StorageClass. See [Install on Kubernetes](https://tessarac.com/docs/acog/self-hosted/kubernetes.md). |
| Size | About 8 vCPU, 16 GiB memory and 60 GiB disk for a single node running the bundled datastores. With the semantic cache, plan for 16 vCPU, 32 GiB and 200 GiB or more. |
| Ingress | One HTTPS address for the web service, with a 660-second idle timeout and a 64 MiB body limit. You provide the TLS certificate; ACOG itself needs no certificates, certificate authority or cert-manager. |
| Email | An SMTP relay (or Amazon SES) for verification, password reset and invitation mail. Required in production. |
| Licence | A licence file and its password, from your Tessarac agreement. See [Licensing](https://tessarac.com/docs/acog/self-hosted/licensing.md). |

## What it connects to

| Destination | Why | Required |
|---|---|---|
| Your AI providers | To serve requests | Yes |
| Your SMTP relay | Mail | Yes, in production |
| Your identity provider | Single sign-on | If you use it |
| Your Git host | DLP protected sources | If you use them |
| Your OpenTelemetry collector or Langfuse | Traces | If you use them |
| Tessarac | | **Never.** No component contacts Tessarac at runtime, licensing included. |

Users' browsers load nothing from outside your installation's address.

## How it differs from the hosted service

| | Self-hosted |
|---|---|
| Sign-in | Passwords, two-factor authentication, passkeys and your own SSO. Members are added by an admin with a one-time password, not by email invitation. |
| Billing | No invoices. The licence switches savings on; without one the gateway runs in pass-through. |
| Keyless connections | Also **install identity**: use the identity your installation already runs as. See [Install identity](https://tessarac.com/docs/acog/self-hosted/install-identity.md). |
| Provider addresses | Any address you configure, including private networks and plain HTTP |
| Semantic cache | Off until you enable Milvus and the embedder |
| Batch hold window | 10 minutes by default (`ACOG_BATCH_HOLD_SECS`); your load balancer's idle timeout must cover it (660 s) |

## Next

1. [Install on Kubernetes](https://tessarac.com/docs/acog/self-hosted/kubernetes.md)
2. [Configuration](https://tessarac.com/docs/acog/self-hosted/configuration.md)
3. [Licensing](https://tessarac.com/docs/acog/self-hosted/licensing.md)