Self-Hosting

Run the whole product on your own infrastructure. Your documents never transit ours.

Self-hosting means the application, the database, the real-time backend, file storage, and document conversion all run on a Linux server you control. This page explains what that involves for a buyer and an IT lead evaluating it — it is not an install procedure. The detailed runbook is supplied with your images once you're on the Enterprise plan.

What Self-Hosting Means

You run a fixed set of services on your own server, on your own domain, behind your own TLS certificate. Nothing about your workspace — documents, files, database rows, converted slides — is sent to Omada's infrastructure. We publish container images; you pull and run them.

This is not an air-gapped deployment. Your server needs outbound internet access to pull our images and updates, and to reach whichever third-party services you choose to configure — an email provider, an AI provider, OAuth sign-in. Fonts and static assets are bundled into the image, so your users' browsers do not fetch them from anyone else. Air-gapped operation is a possible future option, not something this release supports.

What You'll Need

Requirement	Detail
A Linux server	macOS and Windows are not supported. The stack uses Docker's host networking mode, which does not exist on Docker Desktop for those platforms — this is a networking constraint, not a policy choice.
Docker Engine with the Compose plugin	You pull our images; you never build one yourself.
A DNS name for the server	A real hostname (`omada.yourcompany.com`), not an IP address. Passkey sign-in refuses to enrol against an IP.
Your own TLS certificate and key	Issued by your own CA or a public one. We don't issue or renew certificates for you.
Outbound network access	Required — see above. This is not an air-gapped topology.
A way to send outbound mail	A transactional email provider's API key, or your own SMTP relay.

What Runs on Your Server

Service	What it does
Web application	The Omada interface your users open in a browser.
Database	Stores your workspace data.
Real-time backend	Powers live sync — documents, chat, and dashboards updating instantly across users.
File storage	Holds every file and document your team uploads, on a volume on your own server.
Document converter	Renders and converts documents and slide decks — the piece that keeps your files off our infrastructure.
TLS proxy	Terminates HTTPS using your certificate and routes traffic to the application.
Admin dashboard	A visual tool for inspecting your database and backend, for your IT team's own use.

AI Is Your Choice

Omada works without AI. If you don't configure a model, the Operator app (Omada's AI assistant) is hidden from navigation entirely — everything else in the product works as normal.

If you do want AI features, you choose how:

Option	What it means
Managed gateway	Point at Omada's managed AI gateway with an API key we provide.
Bring your own key	Connect your own provider account. Your prompts and data go directly to your chosen provider, not through us.
Neither	AI features stay off.

This matters for data sovereignty: a self-hosting customer's whole point is often keeping data under their own control, and the AI path is no exception.

Authentication

Users sign in with passkeys or email and password.

One decision here is irreversible: passkey sign-in binds each enrolled credential to the hostname you choose at install. If you change that hostname later, every previously enrolled passkey silently stops working — browsers won't offer them, with no error and no log line — and every user has to re-enroll from scratch. Choose your hostname deliberately before your first user signs up, and don't revisit it once real users are on the system.

Diagnosing Your Deployment

Once installed, a Self-Hosting settings page inside the product gives your IT team a preflight check, plus a feature-by-feature status: for every optional feature that's switched off (AI, meeting transcription, huddle, email, file conversion, and others), it names the specific configuration that's missing rather than leaving your team to guess. This is the primary tool for your IT team to diagnose why something isn't working, without opening a support ticket.

Current Limitations

This release is a proof-of-concept installation, not a hardened production package. We're stating the gaps plainly rather than dressing them up:

Limitation	Detail
No automated backup or restore	Your database and file volumes hold everything. Backing them up and restoring them is on you until this ships.
No automated upgrade path	Upgrades follow a documented manual sequence — pull new images, redeploy backend functions and migrations, then restart. There's no rolling upgrade or automatic rollback.
Linux only	Host networking is required, and it isn't available on macOS or Windows Docker Desktop.
Self-registration is open by default	Anyone who can reach your sign-up page can create an account. Restrict access at the network layer (don't expose the sign-up route publicly, or front it with your own access control) until an in-product setting exists.

Getting Started

Self-hosting is available on the Enterprise plan. You get access to our private container registry and a full install runbook covering secret generation, environment configuration, TLS setup, and verification steps in detail — this page intentionally doesn't reproduce that procedure.

Step	What happens
1	Contact us about the Enterprise plan.
2	We provision your private registry credentials.
3	You receive the install runbook and `docker-compose.yml` template.
4	Your IT team installs on your server and verifies with the built-in preflight check.

Contact	Details
Sales	sales@omada.ws