Control Zero Self-Hosted
Core governance controls, inside your network.
The private-preview deployment brings the gateway, policy engine, audit store, dashboard, and admin CLI into your infrastructure. Request scanning runs on supported gateway traffic; response scanning must be explicitly enabled and defaults off. End-to-end self-managed I/O capture is not yet available across every surface.
// 001
What We Solve
The private preview exposes working controls for supported deployment paths while the remaining coverage matures. Shadow AI discovery is coming soon, and self-managed I/O capture is not yet end-to-end across every surface.
AI Coding Tools
AI Coding Tool DLP
MCP-level policy controls can evaluate supported tool calls before execution. Coverage depends on the assistant and deployment path; self-managed I/O capture is not yet end-to-end across every coding surface.
Chat Applications
Chat Application DLP
COMING SOONThe self-managed SSL proxy path is planned to inspect request content sent to browser-based AI chat services and apply detect, block, or mask rules per domain. It is not yet deployable: it ships in no self-managed stack today. This is separate from the beta browser extension, which enforces in the page -- a deny rule cancels the paste and the send, a mask rule rewrites the matched value in place -- and, separately, while any live, enabled block rule is scoped to browser_ext_network (a detect or mask rule on that scope installs nothing), blocks the chat endpoint on URL rather than on content.
API Traffic
API-Level DLP
The gateway proxy scans LLM API requests for PII and can apply masking, model, cost, and tool-call policies inline. Response scanning runs only when explicitly enabled and is off by default.
Discovery
Shadow AI Discovery
COMING SOONPlanned endpoint and network discovery will surface unauthorized AI tools, exposed API credentials, and hidden model traffic. This capability is not yet available end-to-end.
// 002
How Deployment Works
The private preview centers on Docker Compose. Standard requirements: Docker 24+, 4 GB RAM, 2 CPU cores, 10 GB disk. Preview participants can evaluate networking, storage, and access-policy configuration in their environment.
01
Pull Images
Authenticate with the Control Zero container registry and pull the latest images. All images are signed and verified. Works on any Linux host with Docker 24+.
02
Configure
Set your license key, network bindings, and policy configuration in the compose environment file. Optional: TLS certificates, log destinations, proxy settings.
03
Deploy
Run docker compose up. Preflight health checks verify the environment automatically. All services start, connect, and report status. No outbound internet required after initial pull.
Air-gap tarball and Kubernetes Helm packaging are gated to private-preview evaluations. Hybrid (cloud control plane + self-hosted data plane) is planned for a future release.
Deployment Architecture
// 003
Key Capabilities
Licensing
License Management
Seat-based, time-limited licenses with offline validation. No phone-home requirement. Grace period and read-only mode prevent disruption during renewal.
Monitoring
Health Checks
Preflight checks verify the environment before installation. Postflight checks confirm all services are operational. Run manually or integrate with your monitoring.
Diagnostics
Support Bundles
Generate diagnostic packages with automatic secret redaction. Includes service logs, container state, system info, and health check results.
Observability
Metrics and Logging
Prometheus metrics endpoint with seven metric families. Structured JSON logs with correlation IDs. Configurable log levels. Compatible with Splunk, Elasticsearch, Grafana, and Datadog.
Security
Anti-Tampering
Policy bundles are cryptographically signed and verified on every load. Configuration integrity monitoring detects unauthorized changes. Binary checksums verified on startup.
Network
SSL Proxy
COMING SOONPlanned chat DLP for browser-based AI services: deploy a CA certificate to endpoints and configure detect, block, or mask modes per domain, with scoped inspection rather than blanket interception. Not yet deployable -- it ships in no self-managed stack today.
DLP
Multi-Locale PII Detection
Request scanning runs 64 built-in detectors across 12 pattern packs: a global baseline plus EU, Japan, Korea, Hong Kong, Singapore, Taiwan, Indonesia and Malaysia locales, and financial, medical and secrets category packs. Response scanning is available only when explicitly enabled and defaults off. Configure detect, mask, or block behavior.
Rate Limiting
Configurable Rate Limits
Per-user, per-organization, and per-provider rate limits. Standard headers (X-RateLimit-Remaining). All limits configurable at runtime without restart.
i18n
Multi-Language Dashboard
Dashboard available in English and Korean, with an extensible locale system. Adding a new language requires only a single translation file.
Coding Tools
Coding Assistant Hooks
GA(Cursor and Antigravity adapters BETA; Kiro IDE hook ships disabled)On Claude Code, Gemini CLI and Cursor IDE a deny rule stops the call before it runs, across every tool family. On Codex CLI and Cursor CLI that gate covers shell commands only: those are the calls those hosts deliver to a hook. On Kiro CLI it covers every tool family for direct tool calls, and from SDK 1.13.12 a deny on the use_subagent spawn stops the sub-agent being created at all -- on any earlier SDK that matcher is never installed, so such a rule silently never fires; a sub-agent’s own tool calls are gated only when that sub-agent runs an agent config carrying our hooks, because Kiro resolves hooks from the sub-agent’s own config rather than inheriting the parent’s, so a sub-agent spawned with no explicit agent_name runs its own tool calls ungated once it starts. The spawn itself is still gated -- the parent’s hook fires either way. That remaining gap is the host’s (kiro #7755). Kiro IDE governs no tool call today, and that is our choice, not a vendor gap: the installer does write the hook Kiro IDE’s current loader reads, but we ship it disabled pending a soak. Kiro IDE’s deterministic block also requires the v2 hook provider; on the default v1 provider a deny is mediated by the model rather than enforced. On Antigravity our adapter fails closed -- empty output is read as a deny -- while the host treats that deny as advisory in its headless and always-proceed modes, so the call may still run. Local audit logging is available where supported.
Browser DLP
Browser Extension DLP
BETA(manual install; not in the Chrome Web Store)The Chrome and Edge MV3 extension scans content in the page on supported AI chat sites. A deny rule cancels the paste before it lands and cancels the send before it leaves; a mask rule rewrites the matched value in place. Separately, while any live, enabled block rule is scoped to browser_ext_network, the extension installs a declarativeNetRequest rule that blocks the chat endpoint outright (a detect or mask rule on that scope installs nothing) -- that block is matched on URL, not on content, so it is a coarse cut-off rather than a per-request decision. Request bodies are captured and scanned for the audit trail on the observation path.
// 004
Compliance
Every governance decision is recorded, queryable, and exportable. Built for environments where audit readiness is a requirement, not a feature request.
Audit
Append-Only Audit Trails
Every policy evaluation is logged with timestamp, agent identity, action, resource, decision, and the policy that matched. Audit records are append-only.
Privacy
PII Detection and Masking
Request DLP scanning is on by default for JSON gateway traffic. Response scanning must be explicitly enabled and defaults off. Configure detect, mask, or block modes per policy.
Transparency
Full Decision Logging
Every allow and deny decision includes the complete evaluation context: which policy matched, why it matched, and what action was taken. No silent decisions.
Integration
SIEM Export and Streaming
Pull the audit trail as JSON, ArcSight CEF, or RFC 5424 syslog -- the formats Splunk, ArcSight, and QRadar ingest directly -- bounded by a date range. Self-managed deployments can also stream every decision to a SIEM collector as it lands, over UDP, TCP, or TCP+TLS with optional mutual TLS. Filtering by agent, action, or decision is available on the dashboard audit view, which also downloads CSV.
Ready to evaluate Self-Hosted?
Tell us about your use case, scale, and timeline. We ship a preview package, a private documentation portal, and a direct line to the team during early access.