# Self-hosting and security

> How Koshra runs as a self-hosted Docker stack, how sessions and secrets are handled and where your data lives.

Canonical: https://koshra.si/docs/self_hosting
Last updated: 2026-11-07

Koshra runs on a server you control, next to the tools your team already uses.

## Own your AI team

Run a server-hosted Koshra deployment with assisted setup. It is built on an Apache-2.0-licensed foundation. Koshra distribution and support are separate agreed terms. Security has the limits.

## The stack

Koshra runs as a small set of Docker containers: a web app, an API, a background worker, a supervisor and a Postgres database. Routines and tasks run on the server around the clock, not on a laptop.

## Sessions

Protected pages and API routes refuse requests without a signed-in session. The task and dispatcher routes also refuse requests from untrusted origins.

## Secrets

Provider keys and other credentials are kept in the app's encrypted secret store, not in chat or prompts.

## Your data

Chats, tasks, the Brain and bot memory are stored in the database on your server. Model calls go to the model provider you chose for that bot.

## Changes

Assisted self-hosting is available by arrangement. Production changes should have a reviewed backup and rollback plan. That is not a claim that every past change had one.