The Infersec self-hosted edition combines the console and API into a single service that you run on your own hardware. It is licensed per deployment and validated against the Infersec licensing service at startup.

Licensing and legitimate use

Each self-hosted license is intended for a single deployment on a single server. When your instance starts, it validates its license key with the Infersec licensing service and reports a fingerprint made up of its container name, a persisted instance ID, and its source IP address.

• One license key covers one running instance.
• If two or more distinct instances (different IP address, container name, or instance ID) validate the same key within a three-hour window, the key is automatically blacklisted.
• A blacklisted key behaves exactly like an invalid key: the instance will fail to start or will shut down.

You can submit an appeal from the Self Hosted - Licenses section of your Infersec console. Blacklist state can only be cleared by Infersec staff via the admin tooling.

If you need to relocate your deployment, stop the old instance before starting the new one on the same key.

Setting a stable container name

Because the container name forms part of the license fingerprint, you must assign a stable hostname to your container. Without a stable name, each redeploy produces a new container name and, combined with the persisted instance ID, can trip the duplicate-detection rule within the three-hour window.

Set a fixed hostname when running the container:

docker run --hostname infersec-selfhosted ...

Or in Compose:

services:
    selfhosted:
        container_name: infersec-selfhosted
        hostname: infersec-selfhosted

Running with Docker

The self-hosted image is published as a single container that bundles the console UI, the public API, and the resource management layer. It is multi-arch (linux/amd64, linux/arm64) and available from the public registry. The :latest tag always points at the current release; pin to a specific version (e.g. :1.83.0) for reproducible deployments.

docker run -d \
  --name infersec-selfhosted \
  --hostname infersec-selfhosted \
  -p 9507:9507 \
  -e SELFHOSTED_PUBLIC_URL=https://selfhosted.example.com \
  -e LICENSE_KEY=your-license-key \
  -e SESSION_SECRET=your-session-secret \
  -e DB_PRIMARY_HOST=... \
  -e DB_PRIMARY_PORT=... \
  -e DB_PRIMARY_DATABASE=... \
  -e DB_PRIMARY_USER=... \
  -e DB_PRIMARY_PASSWORD=... \
  -e REDIS_HOST=... \
  -e REDIS_PORT=... \
  -e REDIS_DB=... \
  -e REDIS_LOCK_DB=... \
  -e REDIS_API_CACHE_DB=... \
  rg.nl-ams.scw.cloud/infersec-public/infersec-production/selfhosted:latest

Or with Compose:

services:
    selfhosted:
        image: rg.nl-ams.scw.cloud/infersec-public/infersec-production/selfhosted:latest
        container_name: infersec-selfhosted
        hostname: infersec-selfhosted
        ports:
            - "9507:9507"
        environment:
            SELFHOSTED_PUBLIC_URL: https://selfhosted.example.com
            LICENSE_KEY: your-license-key
            SESSION_SECRET: your-session-secret
            DB_PRIMARY_HOST: ...
            DB_PRIMARY_PORT: ...
            DB_PRIMARY_DATABASE: ...
            DB_PRIMARY_USER: ...
            DB_PRIMARY_PASSWORD: ...
            REDIS_HOST: ...
            REDIS_PORT: ...
            REDIS_DB: ...
            REDIS_LOCK_DB: ...
            REDIS_API_CACHE_DB: ...

The instance requires a MySQL-compatible database and Redis. Provide your LICENSE_KEY (issued from the Self Hosted - Licenses section of the console) before starting the container.

Keep the container identity stable. The license validation fingerprint includes the container hostname. Set a fixed hostname (and container_name) and preserve it across redeployments — do not let it be generated randomly. Running the same LICENSE_KEY under a different hostname within 3 hours is detected as use on a second instance and will automatically blacklist the license. If you are migrating hosts, decommission the old container first.

Behaviour when the licensing service is unreachable

• At startup, the instance must reach the licensing service successfully. If it cannot, it will not start.
• While running, if the licensing service becomes temporarily unreachable, the instance continues to serve requests for a 72-hour grace period. If the service remains unreachable beyond that window, the instance shuts down.
• A license that is reported as invalid, expired, or blacklisted causes an immediate shutdown.

Plans and limits

Self-hosted plans are billed annually. Each tier caps the number of active endpoints, connected sources, active tool services, and simultaneous requests per endpoint. See the pricing page for the current tiers and limits. Bypassing or attempting to bypass these limits is prohibited under the Terms of Use and may result in immediate license suspension without refunds.