On this page
- The Answer
- Why This Matters: Control and Convenience Usually Pull Against Each Other
- What "Single-Tenant", "On-Prem" and "Air-Gapped" Actually Mean
- HIPAA, GDPR Data Residency and Custody: The Drivers That Force the Choice
- Proof: A Real On-Prem AI Deployment
- What Self-Hosting CreateOS Studio Involves
- Common Questions
- About CreateOS
- Next Step
The answer
Self-hosted AI agents run on infrastructure you control, such as your VPC or your own data center, so prompts, documents and tool credentials stay inside your boundary and no other customer shares the runtime or database that touches your data. Self-hosting does not have to mean losing the governed, managed agent platform. CreateOS Studio runs in our cloud, your VPC, or on-premise, with the same permissions, guardrails, audit log and traces in each. Enterprise self-hosted and on-prem deployments are set up with our team.
Why this matters: control and convenience usually pull against each other
The default assumption in regulated AI is that you pick one of two bad options. Option one: a multi-tenant SaaS platform with a good builder, where your data lives in shared infrastructure you do not control. Option two: roll everything yourself on-prem (provision the cluster, wire the databases, build the agent runtime, own the upgrades) and lose every convenience the SaaS gave you.
That tradeoff is real because of how the two architectures differ. The Cloud Security Alliance defines a single-tenant solution as one where the runtime and data are dedicated to a single organization and not shared with another operating instance, while multi-tenant means one instance of software or infrastructure serves multiple customers with only logical isolation (Cloud Security Alliance). Single-tenancy isolates a security event to one customer; in multi-tenancy, an event affecting one tenant can reach others through shared resources.
The thesis of this post: you do not have to choose. The infrastructure can be yours and isolated while the agents on it stay governed.
What "single-tenant", "on-prem" and "air-gapped" actually mean
These terms get used loosely. Here is the precise distinction that governs a regulated deployment decision.
| Model | Who shares the runtime/database | Network exposure | Typical driver |
|---|---|---|---|
| Multi-tenant SaaS | Multiple customers, logical isolation only | Internet-facing | Speed, cost, prototypes |
| Single-tenant | One organization, dedicated runtime + DB | Private network or VPC | Contractual isolation, audit scope |
| On-prem | One organization, your hardware/datacenter | Your perimeter | Data residency, custody |
| Air-gapped | One organization, physically/logically isolated | No external connectivity | Classified, CUI, highest-sensitivity |
Air-gapped is the strictest tier. NIST SP 800-53 control SC-7 specifies boundary protection through monitored, controlled interfaces, including complete isolation for critical assets, and controls like SC-39 and MP-5 govern process isolation and how any data crosses the boundary (NIST SP 800-53, SC-7 family). An air-gapped AI deployment means the model, the orchestration, and the data sit inside that controlled boundary with no internet path out.
Each tier trades external convenience for control. For self-hosted AI agents the practical question is which outside services the agent still calls. Model providers, connected apps and document parsing all sit on that list, and each one is a path across your boundary.
HIPAA, GDPR data residency and custody: the drivers that force the choice
Three legal and operational pressures push teams off multi-tenant SaaS.
Healthcare: HIPAA and the business associate chain
Under HIPAA, any vendor that handles protected health information on a covered entity's behalf is a business associate and must sign a Business Associate Agreement under 45 CFR 164.504(e), using appropriate safeguards and complying with Subpart C of 45 CFR Part 164 for electronic PHI (HHS.gov, Business Associate Contracts). Since the 2009 HITECH Act, business associates are directly liable for compliance (HHS.gov, Direct Liability of Business Associates). Single-tenant isolation narrows the audit surface to one organization, which makes the BAA and the safeguards easier to defend.
Finance and the EU: GDPR data residency
GDPR Chapter V (Articles 44 to 50) governs international transfers of personal data and requires either an adequacy decision or an appropriate safeguard such as Standard Contractual Clauses for any transfer outside the EEA (EUR-Lex, GDPR Chapter V). The Schrems II judgment invalidated the EU-US Privacy Shield and forced case-by-case assessment of transfer mechanisms. Region-pinned, single-tenant compute lets a team keep EU personal data on EU infrastructure and prove it, instead of arguing about where a shared multi-tenant instance physically processes data.
Legal and government: custody
Law firms and public-sector teams often cannot let matter files or case records leave their custody at all. For them, where the agent runs and what it retains matter more than any feature list.
Proof: a real on-prem AI deployment
CreateOS built a litigation intelligence layer that turns raw matter files (contracts, notices, handwritten notes, scanned annexures, photographs) into a source-cited Timeline Brief before the first strategy meeting. It is designed to cut manual Timeline Brief preparation time by up to 40% depending on matter complexity, and it surfaces a 400+ page contract as the dozen clauses that bear on the live question. It runs in one of three deployment modes: CreateOS cloud, the firm's environment, or fully on-premise.
Sheena Kohli, Legal and Investor Relations Lead at NodeOps, framed the design constraint directly:
"Litigation teams don't have a fact problem. They have a fact-finding problem. The workflow is right. What's missing is the intelligence layer that sits between the documents and the strategy meeting. CreateOS exists to put that layer in place, on the firm's own infrastructure, with every fact cited and every gap flagged before the first hearing."
The load-bearing phrase is "on the firm's own infrastructure." The litigation teams did not stand up a Kubernetes cluster or hire DevOps. They got the intelligence layer and kept on-prem custody.
A second proof point from a different sensitivity profile: an industrial AI pilot connected a Maharashtra-based textile manufacturer's existing CCTV to CreateOS, processing 50,000+ hours of video (roughly 75 TB) over a 75-day pilot with no in-house DevOps team. Different industry, same pattern: the platform handled the heavy infrastructure, and the customer chose data custody and deployment mode.
What self-hosting CreateOS Studio involves
A self-hosted Studio is the same product as the cloud one: the same agent builder, the same five stages (Define, Ground, Act, Govern, Operate), the same governance. What changes is who runs it. The Self-hosting and operations page lists what the operator owns:
- Core services. A database, Redis, an auth secret, and a secret vault key, plus the agent runtime and the Model Gateway endpoints. Knowledge bases need a vector store and object storage on AWS, Azure or GCS. Sign-in codes and invitations need SMTP.
- Who can get in.
SIGNUP_MODEisinviteby default: only people with a live invitation can sign in.approvalandopenmodes exist for wider rollouts. - Background jobs. Workflow schedules and the workflow repair sweep run built in. Knowledge base processing and queued Slack events need an external scheduler. Every cron call must carry
CRON_SECRET; while it is unset, every cron endpoint refuses all requests. - Ingress. Besides the app under its base path (default
/studio), forward/mcp,/api/v1/agents/*and/.well-known/*to Studio. - Health and limits.
GET /studio/api/versionreturns{"status":"ok"}for liveness probes. Runs started through an API key, MCP or Slack are limited to 60 per minute each by default. - Model access. The Model Gateway connects OpenAI, Anthropic, AWS Bedrock (with a region you choose) and OpenRouter. An admin sets an allowlist per provider, so only approved models appear in the agent picker.
Be precise about the boundary. Tools and knowledge base document parsing are configured with external service API keys, and model calls go to the provider you connect. A deployment with no outbound network path at all is a scoping conversation with our team, not a setting.
What does not change when you self-host is the governance layer (Govern):
- A role decides what a person can create; a per-object permission decides what they can reach. Both must pass.
- Refused requests are written to the audit log with the reason. Rows are append only.
- A trace records each step of a run with timings, tokens and cost.
- API keys and OAuth tokens are encrypted and never returned by the API or the UI.
Studio or Sandbox? Studio is the product for building, governing and running agents in your boundary. The CreateOS Sandbox is only for running untrusted or agent-written code in isolated microVMs; it is not the governance layer.
If your decision hinges on the isolation and compliance posture specifically, the single-tenant + on-prem details and the broader enterprise capabilities pages are the right next read.
Common questions
What are self-hosted AI agents?
Self-hosted AI agents are agents that run on infrastructure you control, such as your VPC or your own data center, instead of a shared multi-tenant service. The runtime and databases that touch your prompts, documents and tool credentials are not shared with any other customer, which narrows the audit surface and supports data-residency and custody requirements.
Does self-hosting AI agents mean giving up a managed platform?
No. A self-hosted CreateOS Studio is the same product as the cloud one, with the same agent builder, permissions, guardrails, audit log and traces. The difference is that your operators run the database, Redis, agent runtime and scheduled jobs. Enterprise self-hosted and on-prem deployments of Studio are set up with the CreateOS team.
What is the difference between single-tenant, on-prem, and air-gapped?
Single-tenant means the runtime and database are dedicated to one organization rather than logically shared. On-prem means that dedicated deployment runs inside your own perimeter or chosen environment. Air-gapped is the strictest tier: the system is physically or logically isolated with no external network path, used for the highest-sensitivity data.
Which compliance regimes drive teams to self-hosted or single-tenant AI?
HIPAA pushes healthcare teams toward isolation to narrow their business-associate audit surface under 45 CFR 164.504(e). GDPR Chapter V data-residency rules push EU and finance teams to keep personal data in specific regions. Legal and government teams need custody of matter files and case records that shared SaaS cannot give them.
Can CreateOS Studio run in an air-gapped environment?
CreateOS Studio runs in the CreateOS cloud, a customer VPC, or on-premise. Its documentation does not describe an air-gapped mode: tools and knowledge base document parsing use external service keys, and model calls go to the provider you connect. A deployment with no outbound network path is scoped case by case with the CreateOS team.
How do self-hosted AI agents in CreateOS Studio reach language models?
Through the Studio Model Gateway, which connects OpenAI, Anthropic, AWS Bedrock (with a chosen AWS region) and OpenRouter. An admin sets a per-provider allowlist so only approved models appear in the agent picker, and each member gets a scoped gateway key, so model spend is attributable to the person who ran the agent.
What does a team operate when it self-hosts CreateOS Studio?
The operator runs the core services (database, Redis, secret vault key, agent runtime), sets who can sign in with SIGNUP_MODE (invite-only by default), schedules two background jobs externally with a CRON_SECRET, forwards /mcp, /api/v1/agents/* and /.well-known/* to Studio, and probes GET /studio/api/version for liveness.
Has CreateOS run real on-prem deployments?
Yes. A CreateOS litigation intelligence layer runs in CreateOS cloud, the firm's environment, or fully on-premise, and is designed to cut Timeline Brief preparation time by up to 40%. Separately, an industrial AI pilot processed 50,000+ hours of CCTV (about 75 TB) over 75 days with no in-house DevOps team.
About CreateOS
CreateOS is the unified execution layer for AI, backed by NodeOps orchestration. It coordinates infrastructure, compute, LLM orchestration, agent deployment, and monetization in one place instead of three. CreateOS Studio, its product for governed agents, runs in our cloud, your VPC, or on-premise. Founded by Naman Kabra, building in Web3 since 2017.
Next step
If you are weighing self-hosted AI agents for a regulated workload, bring your compliance regime (HIPAA, GDPR data residency, or custody requirements) and we will map it to a deployment. Book a demo, or read how Studio governs agents.
