A recurring conversation with agencies and regulated teams: the tool is a good fit, and the client contract says the source does not leave our network. Historically that ended the evaluation.
The usual answer is "deploy the whole platform yourself", which trades one problem for a worse one. Now you operate a database, a queue, a worker fleet and an upgrade path, to run a tool you wanted so you could do less operations work.
Split the thing that has to be local
Only one part of this genuinely has to sit next to your source: the bit that clones the repository and runs the agent. Specifications, approvals, comments, the audit trail — none of those are your source code, and none of them need to move.
So that is where the line is drawn. A runner you install polls us for work. When a run is assigned, the clone, the agent and the commit all happen on your machine. The pull request is still opened server-side, which keeps provider handling and formatting identical whether or not you self-host.
Polling, not an inbound connection
The runner asks us for work roughly every fifteen seconds. It is a deliberate choice: no inbound port, no firewall exception, no certificate for us to hold. If the machine is off, runs queue. If the token is revoked, it stops on the next poll.
Installation is one command and it sets up a boot service, so the thing survives a reboot without anyone remembering it exists.
Be honest about what crosses the boundary
Self-hosting is not a magic wall, and a vendor who implies otherwise has not thought about it properly. Two credentials do cross: the repository token, because the runner has to clone and push, and a model key, because the agent has to call a model. Both are decrypted for the run that needs them.
Supply your own model key and even that leaves our contract. What does not cross, in either configuration, is your source code.
A detail we got wrong
Worth stating, because it is the kind of thing that is easy to leave broken. Cloning with a credential in the URL leaves that credential in the repository's git config — and the agent's working directory is that repository. Repo-controlled code could have read a write-capable token straight out of it.
The remote now holds a clean URL and the credential is supplied only for the push itself. The same fix landed on both the hosted path and the runner. If you are building something in this shape, go and check that one.