Appearance
Deployment options
You can run Schildmark on your own servers or let us host it. The product is the same in every option; what changes is who runs the servers and where the data lives.
| Self-hosted, one server | Self-hosted, two servers | Hosted by us | |
|---|---|---|---|
| Who runs the servers | You | You | Us |
| Where your data lives | Your server | Your servers | Our infrastructure, one stack per customer |
| Who runs the install | You, with the install command we send | You, two install commands, core first | Us |
| First administrator password | Shown only in your terminal; never sent to us | As one server | Kept sealed by us and handed to you |
| Good for | Most organisations | Larger fleets, or separating the engine from the consoles | Teams that do not want to run servers |
| Minimum memory | 8 GB | 6 GB (core) + 4 GB (app) | n/a |
Self-hosted
You prepare a Linux server (or two) that meets the requirements. We create your organisation in our control plane and send you an install command. Run it on the server: it checks the host, installs Docker, installs the Leitstand node, asks for your console's domain, and installs the stack. When it finishes it prints your console address, the administrator sign-in, the DNS record to create and the ports to open.
After the install, the Leitstand node keeps a single outbound HTTPS connection to our control plane, which we use to apply configuration you ask for, deliver your licence, and see the stack's health. It needs no inbound access.
- One server: Install on one server.
- Two servers: Install on two servers.
Hosted by us
We install and run the stack for you on our infrastructure, with its own servers. You receive the console address and the first administrator's sign-in. Endpoints enrol exactly as in a self-hosted stack, and still need to reach the stack on 443 and 1514; see Network and firewall.
Optional hosted services
Two services can run for your stack in our environment instead of on your servers. Each is a paid add-on on your licence, for a self-hosted stack or one we host. For prices, talk to sales.
- Hosted Schildmark Analyst: the AI analyst with our LLM gateway, so you need no LLM endpoint of your own.
- Hosted patching: the patch service and vulnerability verification.
How it works:
- Each customer gets its own set of containers in our environment, on its own isolated networks, with its own credentials. No container, network or credential is shared with another customer's hosted services.
- Your stack reaches them over one outbound encrypted connection that it opens itself (TLS 1.3, both sides pinning each other's certificate). Nothing on your side is opened to inbound traffic.
- Your users keep using your own console address and sign-in, and your endpoints keep talking to your stack: nothing is reconfigured when a service moves.
- The hosted services sign in to your stack with their own restricted accounts. Their data (Schildmark Analyst conversations, patch jobs and history) is still stored in your stack.
- They follow your stack's release: after an upgrade they move to the new release too.
Alert, inventory and vulnerability data the hosted services read leaves your infrastructure for ours while they work on it. Choose them only if that suits you; otherwise Schildmark Analyst uses the LLM endpoint you configure and patching runs on your stack, as by default.
Hosted Schildmark Analyst and your data
Hosted Schildmark Analyst sends questions and the data it reads to an AI provider through our LLM gateway. The gateway enforces, on every request, a monthly allowance for your organisation and your AI data policy:
| Policy | Where your AI requests go |
|---|---|
| Standard | Our standard AI provider |
| BAA only | Only a provider that has signed a business associate agreement (HIPAA) with us; if none is available, requests are refused, never sent to the standard provider |
| Off | Nowhere: every request is refused, and Schildmark Analyst says AI is switched off |
BAA only
We do not have a BAA-covered AI provider in service yet. Until we do, a stack on BAA only gets no AI answers from hosted Schildmark Analyst: requests are refused. Ask us before choosing it.
Past the monthly allowance, AI requests are refused until the next calendar month; ask us to raise it.
Without the control plane
A stack can also be installed by hand from a release bundle, without the Leitstand node. You then do yourself what the control plane does for you (configuration, licence). See Install from a bundle.