// self-hosted editions

One product.
Two clear editions.

Run Hodos inside your own boundary. Start with the complete Free core; choose Enterprise when you need organization-wide federation, compliance evidence, fleet operations or contracted support.

Your infrastructureYour graph stays inside your boundary.
No per-seat pricingAdoption should not become a tax.
No phone-homeLicence verification is local and offline.

Free

public release

Free

forever · no seat cap · no entity cap

The entire product for one workspace, on your own infrastructure. Not a trial and not a crippled edition — the complete graph, the complete governance engine.

  • Catalogue, graph explorer, query builder, impact analysis and where-used
  • MCP server — governed context for your agents
  • Collectors: GitHub, Kubernetes, OCI registries, Hetzner, Hubble and the collector SDK
  • Schema-as-code, workflows-as-code, dashboards-as-code — plan / apply, reviewed in git
  • RBAC, ABAC and ReBAC enforcement, field-level grants, audit log, OIDC single sign-on
  • Scorecards, initiatives, golden paths, supply-chain and dependency views
  • Fair source (FSL-1.1-ALv2), becomes Apache-2.0 two years after each release
See how it runs

Enterprise

enterprise pilot

Contact sales

annual licence by deployment scale · never per seat

Everything in Free, plus the controls a compliance function asks for and the scale features a fleet needs. Unlocked by a signed licence file, verified offline.

  • SAML and SCIM — enterprise identity federation and provisioning
  • Multiple workspaces, cross-workspace rollups, separation of duties
  • ReBAC at scale — precomputed reachability for large graphs
  • Access reviews, attestation, tamper-evident audit export, SIEM streaming
  • Compliance report generation and plan-time access diffs
  • Visual policy authoring, custom role builder, guardrail policies at scale
  • Air-gapped fleet tooling and a Kubernetes operator for running Hodos itself
  • Support with response targets, and a named engineer who knows your deployment
Discuss an Enterprise pilot

Enterprise is currently delivered as a design-partner pilot. Scope and availability are confirmed before deployment.

// the edition boundary

Security is core. Organization-wide proof is Enterprise.

Always in Free

Policy evaluation, RBAC, ABAC, ReBAC, field-level grants, audit history, OIDC and the ability to configure Hodos as code.

Enterprise

SAML and SCIM, access reviews, tamper-evident export, separation of duties, fleet operations and contracted support.

Never

A crippled community edition, per-seat pricing, a mandatory external control plane or a network licence check.

// capability boundary

Free versus Enterprise.

A stable product boundary that is easy to understand and operate.

CapabilityFreeEnterprise
Graph & catalogue
Live graph on Postgres + Apache AGE (openCypher)
Catalogue, entity pages, ownership resolution
Impact analysis, blast radius, where-used at any depth
Graph explorer and visual query builder
Schema-as-code: custom kinds, relations, migrations, plan/apply
Dashboards, data products, portal pages
Agents & MCP
MCP server — policy-filtered context on every call
Agent inventory, capability catalogue, workload identity
Agent lifecycle workflows and governed egress
Per-agent tokens and verified subjects
Integrations
GitHub, Kubernetes, OCI, Hetzner, Hubble collectors
Collector SDK — build your own source
CLI, REST API, Terraform provider, GitHub Action
Runner operationsself-runfleet management
Access control
RBAC, ABAC and ReBAC evaluation engineThe enforcement mechanism is never sold — governance you cannot inspect is governance you cannot trust.
Field- and attribute-level grants
OIDC single sign-on
SAML federation and SCIM provisioning—
Enforced SSO, directory group-to-role sync, multiple identity providers—
Visual policy authoring and custom role builderhand-authored YAML
ReBAC at scale (precomputed reachability index)—
Audit & compliance
Append-only audit log, queryable decision history
Explain-this-decision surface
Audit export to SIEM, tamper-evidence—
Access reviews and attestation—
Compliance report generation, plan-time access diffs—
Multi-step approvals and separation of duties—
Scale & operations
One workspace
Multiple workspaces and cross-workspace rollups—
Runs fully offline / air-gappedThe product itself needs no phone-home in any tier. Only fleet tooling for air-gapped estates is sold.
Air-gap fleet tooling, Kubernetes operator for Hodos itself—
Supportcommunity after public releasecontracted response targets
// questions

Before you choose.

Can I evaluate Hodos before installing it?

Yes. The public demo runs the real product against synthetic data. It requires no account and does not accept uploads or information about your company.

Why are there only two editions?

A middle tier would exist mainly to make Free feel incomplete. The useful product stays in Free. Enterprise adds federation, compliance evidence, fleet-scale operations and contracted support.

Does the licence require an outbound connection?

No. Enterprise uses a signed licence file verified locally. The product can run offline and air-gapped.

Can I manage Hodos as code?

Yes. The public API is the source of truth, and the CLI, Terraform provider and GitOps flows build on that API. Public links appear here only after their repositories and documentation are available.

Evaluate first. Install when you are ready.

The demo uses synthetic data. A self-hosted deployment keeps your real graph inside your boundary.

See the demo modelDiscuss an Enterprise pilot