One platform, six ways to run it.
The same WeldForge binary runs on your laptop, your Kubernetes cluster, our shared cloud, a dedicated cluster we operate for you, your on-prem data centre, or an air-gapped vault. Pick the model that fits your data residency, compliance and operations posture — the upgrade paths between them are all supported.
The six models
Self-Host — OSS
You pull the source, you run the cluster. Docker Compose for dev, Kubernetes manifests for production, Flyway-managed schema on any Postgres 14+.
- Runs on: your infra (bare metal, any cloud, laptop)
- Data location: yours
- Upgrades: you pull, you apply
- Support: GitHub issues & discussions
- Best for: side projects, evaluation, OSS apps, hobbyists
Self-Host — Supported
Same binary, same cluster, but you get a human on the other end of an email. We ship a security advisory feed and a ticket queue with 2 business-day SLA.
- Runs on: your infra
- Data location: yours
- Upgrades: you apply — we provide release notes and upgrade guidance
- Support: email, 2 business-day, advisory list
- Best for: small-to-mid teams running their own IdP who want backup for the weird cases
Cloud — Shared
Multi-tenant cluster we operate. Tenant isolation is enforced at the application layer (every query is tenant-scoped); data sits in a region-pinned Postgres.
- Runs on: WeldForge cloud (EKS / af-south-1 + EU-West-1)
- Data location: region you pick at sign-up
- Upgrades: we ship them
- SLA: 99.5%–99.95% depending on tier
- Best for: SaaS teams, B2C products, mid-market B2B
Cloud — Dedicated
Your own single-tenant cluster. Private data plane, custom domain on our root nameservers, VPC peering into your cloud account, BYO KMS for JWT signing keys.
- Runs on: WeldForge-operated single-tenant cluster
- Data location: region of your choice
- Upgrades: we ship them in your maintenance window
- SLA: 99.95%
- Best for: enterprise with strict privacy, noisy-neighbour concerns, or regulatory multi-region requirements
On-prem — Managed
Your data centre, our operations team. We operate the cluster over a pull-based GitOps control plane — you open no inbound ports. Suitable for on-prem banking, defence, national-ID platforms.
- Runs on: your infra, any supported Kubernetes distribution (OpenShift, RKE2, vanilla K8s, k3s)
- Data location: yours
- Upgrades: GitOps-driven, we stage, you merge
- SLA: 99.99% operational
- Best for: regulated industries, sovereign clouds
Air-gapped Appliance
Signed release bundles delivered on physical media or a secure air-gap transfer. FIPS 140-3 build, offline licence activation, quarterly cadence.
- Runs on: fully offline infrastructure
- Data location: yours, no external connectivity
- Upgrades: signed bundles, quarterly
- SLA: by contract
- Best for: defence, intelligence, sensitive critical infrastructure
How to pick
| If you… | …pick |
|---|---|
| want to try the platform today, no friction | D1 — Self-Host OSS |
| are shipping a SaaS product and the IdP is not your core differentiator | D3 — Cloud Shared |
| have a compliance or residency constraint that forbids shared infrastructure | D4 — Cloud Dedicated |
| already run Kubernetes and know your platform team, but want a support contract | D2 — Self-Host Supported |
| are a bank, insurer, healthcare provider or gov body that can't send audit data off-prem | D5 — On-prem Managed |
| operate classified or sovereign systems | D6 — Air-gapped Appliance |
Data residency
Where the database row sits matters for POPIA, GDPR, HIPAA and most industry-specific regulations. WeldForge Cloud currently operates in two regions, with more opening as customer demand warrants.
Africa
Primary: AWS af-south-1 (Cape Town).
Appropriate for POPIA, South African financial-services and healthcare data-residency requirements.
Europe
Primary: AWS eu-west-1 (Dublin). EU-residency pin available as an add-on ($399/mo).
Appropriate for GDPR, Schrems-II-compliant processing arrangements.
Other regions
Cloud Dedicated and On-prem Managed tiers operate in any region your cloud provider offers — US, UK, UAE, Asia-Pacific, Latin America.
Self-host
You pick. Postgres 14+, Java 21, and a container runtime is all the platform requires.
Compliance posture
The hosted tiers ship with the audit artefacts attached; for self-hosters the platform produces the raw evidence and we package it on request.
Built-in
- Append-only audit log, HMAC-signed webhook fan-out
- MFA policies enforceable per tenant
- Password-policy + bcrypt-cost enforcement
- Admin role separation with tenant scoping
- Password & secret-at-rest encryption
Certifiable against
- SOC 2 Type II (Cloud Business+)
- HIPAA (Cloud Dedicated with BAA)
- PCI-DSS SAQ-A-EP
- POPIA (Operator agreement available)
- GDPR (Processor addendum available)
- ISO 27001 (Cloud Scale+, roadmap 2026-Q3)
Audit evidence we emit
- Every admin action with actor, target, tenant, IP
- Every authentication success/failure with MFA method
- Every token issuance (grant type, client, tenant)
- SCIM lifecycle events
- PKI issuance and revocation events
Packaged artefacts
- SOC 2 Type II report —
$1 500 / yr - HIPAA BAA & access-review pack —
$1 500 / yr - PCI-DSS SAQ-A-EP —
$1 500 / yr - POPIA Operator agreement —
$750 / yr
Moving between models
None of these are one-way doors. The data model is identical across all six deployment modes, so the transition is an export, a restore, and a DNS cut-over.
Self-host → Cloud
We run a one-off pg_dump | gzip | restore on our side, point your customer-facing DNS at our NLB, rotate any API keys that crossed over, and done. Typical cut-over window: 30 minutes read-only, 5 minutes write-blocked.
Cloud Shared → Cloud Dedicated
Your rows are copied into a fresh single-tenant cluster over VPC peering, JWT signing keys are rotated once traffic is moved, and the shared-cluster tenant is marked migrated. No customer-visible downtime.
Cloud → Self-host
We hand you a timestamped pg_dump, the Flyway migration history, a Helm values file matching your shape, and a 72-hour handover call. You keep running the same software.
Cloud → On-prem / Air-gap
Requires a one-off Professional Services engagement to stand up the on-prem control plane, wire your CA into your existing PKI, and handover the GitOps pipeline. From $8 500 depending on target platform.