Self-hosted AI security agents, in your VPC or air-gapped
Enclave's security agents run where your code and cloud are allowed to be: as SaaS, in your private VPC, or fully air-gapped, on model API keys you control.
Security work that stays inside your boundary
AI security tools read source code, cloud configuration, and live applications. For regulated and classified environments, that work has to stay inside a boundary the organization controls, and so do the model calls behind it.
Enclave is an agentic application security platform that can be self-hosted. The same agents that map your attack surface, verify findings, prepare fixes, and retest after deploy run in your environment, with the model provider and keys you choose.
Three ways to deploy Enclave
SaaS
Hosted by Enclave. Connect repositories and cloud accounts and agents start working the same day.
Private VPC
Enclave deployed inside your own VPC on AWS, Google Cloud, or Azure, next to the code and infrastructure it investigates.
Air-gapped
A fully air-gapped deployment for regulated and classified environments.
Your model provider, your API keys
Bring your own model API keys
Use your own Anthropic, OpenAI, or Google API keys, so model usage runs under your provider agreements.
Or run models through Enclave
If you would rather not manage keys, Enclave can provide the models. The agent harness is purpose-built for security research either way.
Use the coding agents you already license
Fixes are written as pull requests or infrastructure-as-code changes and can be dispatched to the coding agents your team already licenses.
Your engineers decide what ships
Approval gates per repository
You decide, repository by repository, what agents may do without a person approving it.
Nothing merges without a human
Agents prepare each change and route it to its owner. Your engineers approve every merge.
An audit trail for every closed finding
After deploy, agents re-run the original attack path and log the exploit path, the exact change, and the retest result.
Self-hosted deployment FAQ
Can Enclave be self-hosted?
Yes. Enclave deploys as SaaS, in your private VPC on AWS, Google Cloud, or Azure, or fully air-gapped. Self-hosted deployment is part of the Enterprise plan.
Can we use our own LLM API keys?
Yes. You can bring your own model API keys from Anthropic, OpenAI, or Google, or run models through Enclave.
Which clouds does a private VPC deployment support?
AWS, Google Cloud, and Azure. Enclave also connects to all three as environments its agents investigate.
Is the self-hosted product different from the SaaS product?
No. It is the same platform: a live security graph, agentic investigations, verification and triage, batched remediation, and closure verification.
Who approves the changes agents propose?
Your engineers. Approval gates are set per repository, agents open pull requests or infrastructure-as-code changes for the owner to review, and nothing merges without a human.