Deployment · Sovereign

Sovereign deployment. Fully self-hosted. License-controlled.

For banks, defense, government, and air-gapped enterprise. Obsfly runs entirely in your environment. We never see your data — but we do see your license, every day, and your access ends cleanly when your contract does.

Single Helm chart

Data plane + control plane + UI shipped as one bundle. No external dependencies after install.

Air-gapped supported

Private registry mirror, signed image bundles. No outbound network required at runtime.

Annual license

Signed JWT loaded once, validated locally on every start and every hour at runtime. Tier, max DBs, expiration baked in.

License-aware lockdown

30-day expiry warning in the UI. 7-day post-expiry grace (read-only). Hard stop after grace. No surprises, no abandonment.

License lifecycle

What happens day-to-day, and what happens when the contract ends.

Obsfly ships a daily-heartbeat license controller. While your contract is active you barely notice it. As the renewal window approaches, the lifecycle below kicks in deterministically — no rug-pulls, no surprise blackouts.

Active

License valid. Full feature set. Heartbeat sent daily where the network allows (you can disable phone-home in air-gapped mode).

Renewal window (T-30 days)

Warning banner in UI. Email and webhook reminders to your account contact and the renewal stakeholder.

Expired (T+0)

Read-only mode. Existing dashboards / alerts continue to function. Agent ingestion pauses — no new data is collected.

Grace ended (T+7 days)

Hard stop. UI returns 'license required.' Backend refuses requests. Customer keeps every byte they collected — Obsfly never deletes their ClickHouse.

What our license controller actually sees

On non-air-gapped Sovereign deployments, every Obsfly binary phones home once per day with the following — and nothing else. Air-gapped customers can disable phone-home entirely; renewals are then handled with a signed file delivered offline.

# Daily heartbeat from a Sovereign deployment

{
  "workspace_id":  "ws_acme_prod",
  "license_id":    "lic_2026_acme_42",
  "deployment":    "sovereign",
  "version":       "0.4.2",
  "uptime_hours":  168,
  "db_count":      37,
  "active_users":  12,
  "metrics_total": 4_812_557_321,
  "samples_total": 18_244_902,
  "anomalies_24h": 84,
  "errors_24h":    0
}

No query text. No row data. No PII. Open-source phone-home module under packages/license/ — review it, fork it.

· · ·

Procurement-friendly. SOC2-ready. Built to be audited.

Sovereign starts at $80k/year. We'll send the security questionnaire pre-filled and a Helm chart you can install in your sandbox today.

Book a demo Read the docs