Self-host vs cloud

Same codebase, three editions (community self-host, enterprise self-host, cloud), structurally different products. Pick on the basis of which value matters most: data locality + control (self-host), enterprise compliance on-prem (self-host enterprise), or network effects + zero ops (cloud).

The bright line

The four things that physically cannot exist on a lone self-host instance, by definition:

Cross-org anonymized benchmarks — needs other tenants to compare against.
The managed brain proxy — a service we run with the model under our SLA.
Multi-tenant onboarding tooling — admin surfaces for managing N tenants.
Centralized cross-tenant analytics — same reason.

Cloud charges for those. Self-host is otherwise the same product.

Full comparison

Capability	Self-host community	Self-host Enterprise	Cloud
9 modules (CRM, projects, finance, HR, content, social, SEO, portal, analytics)	✅	✅	✅
Knowledge graph + ontology	✅	✅	✅
Agent (chat, insights, actions)	✅ bundled Ollama / BYO key	✅ bundled Ollama / BYO key	✅ managed brain — no key, bigger models
Embeddings / semantic search	✅ BYO key or local	✅ BYO key or local	✅ managed
File projection (`memory.md` / `skills/`)	✅ (self-host exclusive)	✅	❌
Integrations (webhooks, BYO API keys)	✅	✅	✅
Managed connectors (CCD provides the API key, you don't paste one)	❌ no platform vault	❌ no platform vault	✅ for select providers (Resend, Stripe, Ayrshare)
Import / export / manual backup	✅	✅	✅
Automated daily encrypted backups (AES-256-GCM pg_dump → object storage)	❌ run `./ccd backup create` manually	❌ run `./ccd backup create` manually	✅ daily, platform-managed
Single small org	✅ honor-system	✅	✅ unlimited seats / multi-org
SSO / SAML (Google Workspace, Entra, Okta, OneLogin, custom)	❌	✅ license-gated	✅
ABAC (attribute-based access policies)	❌	✅ license-gated	✅
Audit deep (tenant-wide search + signed exports)	❌	✅ license-gated	✅
System-admin DSAR queue (operator-only — bulk fulfillment, cross-user export)	❌ no system-admin portal	✅ license-gated, operator-run	✅ via CCD ops on request
Self-serve DSAR (user privacy page — `/api/me/data-export`, `/api/me/deletion-request`)	❌ license-gated, not in community	✅ license-gated	✅
Cross-org benchmarks	❌ impossible solo	❌ impossible solo	✅ network moat
Managed hosting (no Docker, auto-update)	❌	❌	✅
Marketplace templates, referral program	❌	❌	✅
Priority support / SLA	❌ community	✅ vendor SLA	✅

All self-host editions require a LICENSE_KEY. Community runs on a free 1-seat 1-year community-tier JWT (mint via the self-serve issuance page — no payment, no sales call). Enterprise runs on a paid, seat-counted enterprise-tier JWT issued by sales. Same binary verifies both; the tier claim in the JWT decides what the entitlement layer unlocks. See Self-host Enterprise for issuance + verification details.

About the "System-admin DSAR queue" row. This is the system-admin console (the /admin/* super-admin tree at admin.<basedomain>), not a tenant-admin feature. Tenant admins never see it on any edition — they use the self-serve DSAR page for their own data. On self-host Enterprise the operator IS the system admin and runs the queue themselves. On cloud, CCD ops runs the queue on the customer's behalf when requested via support. Community has no super-admin portal at all (single-tenant install, no /admin/* tree).

Decision tree

Choose self-host community if:

You're tinkering, evaluating, or building on the platform.
You have a single small org and don't need network features.
You're fine running without SSO / SAML / advanced audit.

Choose self-host Enterprise if:

You need data to stay on-prem (HIPAA, EU data-residency, security clearance, customer firewall) AND
You need SSO / SAML / ABAC / deep audit / system-admin DSAR queue.
Same binary as community — flip on by setting EDITION= selfhost-enterprise and swapping the community LICENSE_KEY for an enterprise-tier one.

Choose cloud if:

You want zero ops — no Docker, no model updates, no migration runs.
You want the managed brain — no API key to manage, bigger models.
You want cross-org benchmarks (am I selling slower than peers?).
You want managed connectors + automated encrypted backups.
You're past the single-small-org envelope (10+ users, multiple orgs).

Migration paths

Self-host → cloud. Export your tenant's data via the built-in export, sign up for cloud, import. The migration honors the unified schema — same shape, same ids, same RLS.

Cloud → self-host. Same path in reverse. Your tenant export is a plain JSON dump + a SQL migration.

You don't need to commit either direction at install. The product is identical for the 90% you care about; only the physically un-replicable features change.

Pricing