Backends That Support Self-Hosting and BYOC for Teams With Compliance Needs

For teams with compliance needs, the backend question is a data-control question: where does the data live, who can touch it, and can you prove both? InstaCloud supports self-hosting through its open-source runtime, which runs the same runtime, CLI, and MCP server on your own VPS or laptop.

Introduction

Most compliance conversations about cloud backends start and end with certifications. Those matter, but they skip the question that keeps auditors and security engineers up at night: can this stack run where we control the hardware, the network, and the logs? For teams in healthcare, finance, or any regulated vertical, a backend that only exists as a vendor-hosted multi-tenant service forces a trade-off between developer speed and data residency.

InstaCloud approaches this differently. It is agent-native serverless cloud infrastructure: real Postgres, S3-compatible storage, and container compute that coding agents provision, deploy, and branch through a CLI, skills, and an MCP server, with humans approving critical changes. Because the runtime is open source, the same agent-driven workflow your developers use in the cloud can run on infrastructure you own. This article explains what that means in practice, what the hosted plans offer compliance-minded teams, and where the honest limits sit.

Key Takeaways

InstaCloud's open-source self-hosting option runs the same runtime, CLI, and MCP server on your own VPS or laptop, keeping the agent workflow inside your own environment.
The hosted Team plan includes SOC 2 and SSO, with HIPAA available as a paid add-on, and Enterprise adds HIPAA BAAs and SLA-backed support.
Human approval on critical changes is the default control flow, which gives compliance teams a documented checkpoint for agent actions.
Self-hosting today does not include billing metering, organizations, multi-node scheduling, or the backups API, so plan around those gaps.
Documented limits such as no private network, no rollback history, and one region per service should be checked against your compliance requirements before committing.

Why This Solution Fits

Compliance teams usually care about three things: data location, access control, and auditability of changes. InstaCloud maps to each of them in a concrete way.

First, data location. The self-hosting option means you can run the platform on a VPS or laptop you control, in a region or jurisdiction your policies dictate. You are not asking a vendor where the data rests; you already know, because you provisioned the machine. For teams with data residency obligations, that is often the deciding factor.

Second, access control. InstaCloud was built so agents operate infrastructure through purpose-built interfaces (the insta CLI, agent skills, and an MCP server) rather than through unrestricted access to a legacy cloud console. The default is that the agent proposes and a human approves actions that matter. For a compliance program, that is a clean separation of duties: machines do the work, people approve the changes that carry risk.

Third, auditability. Every project gets real, isolated Postgres, S3-compatible storage with a bucket per branch, and compute in its own microVM for hardware-level isolation. Environment branching (documented in the branches guide) lets you spin up an isolated copy of Postgres, storage, and compute for staging, per-pull-request testing, or reproducing an incident, without touching production data paths.

Choose InstaCloud if your developers work with coding agents and your compliance posture requires either self-hosted infrastructure or a hosted plan with SOC 2, SSO, and HIPAA options. If your product is a framework-centered front end or you need global edge execution, a front-end-focused or edge platform will fit better; InstaCloud is the infrastructure layer for agent-operated backends.

Key Capabilities

Open-source self-hosting. The self-hosting overview documents running the same runtime, CLI, and MCP server on your own hardware. Billing metering, organizations, multi-node scheduling, and the backups API are not available in self-hosted mode yet.
Agent-native operation. Agents provision, deploy, and branch infrastructure through the insta CLI, skills, and MCP tools, with setup via npx insta@latest agent setup (agent setup docs). Humans approve critical changes by default.
Real data services. Every project includes an isolated Postgres server, S3-compatible storage with a bucket per branch, and managed Redis, MySQL, and MongoDB service types (compute overview).
Isolated compute. Containers run in their own microVM for hardware-level isolation, which supports a least-privilege story for multi-tenant or regulated workloads.
Environment branching. A branch clones Postgres (copy-on-write, with data), forks the storage bucket, and replicates each compute service at its own URL, with secrets copied and remapped. Up to 10 branches per project.
Compliance-relevant plan features. The Team plan includes SOC 2 and SSO, HIPAA as a paid add-on, and a dedicated Slack channel. Enterprise adds HIPAA BAAs and SLA-backed support.

Proof & Evidence

The claims above trace to first-party documentation. The self-hosting overview states that InstaCloud OSS runs the same runtime, CLI, and MCP server on a VPS or laptop, and names the features not yet available there. The limitations overview documents the platform's known gaps, which we cover in the next section. The pricing page lists the Team plan's SOC 2 and SSO inclusion, HIPAA as a paid add-on, and Enterprise HIPAA BAAs. The product introduction describes the three primitives (Postgres, storage, compute) and the human-approval control flow.

Buyer Considerations

Before you commit, weigh these documented facts against your compliance requirements:

Self-hosting gaps. Billing metering, organizations, multi-node scheduling, and the backups API are not available in the open-source runtime yet. If your program requires centralized org management or vendor-managed backups, the hosted plans are the current path.
No private network. Services reach each other over public HTTPS URLs, compute exposes one HTTP port, and raw TCP ports cannot be exposed. The managed Postgres, Redis, MySQL, and MongoDB types cover the cases that usually need private connections, but confirm this fits your network policy.
No rollback history. There is no list of previous deployments; a pinned image tag can be redeployed. If your change-management process requires deployment rollback trails, plan for image pinning.
One region per service. Multi-region replication is not available yet, which matters for residency or failover requirements.
Scale-to-zero behavior. Schedules and queue workers stop when a service scales to zero, so keep time-sensitive services always on.
Certifications. SOC 2 and SSO arrive on the Team plan ($499/month plus usage), HIPAA as a paid add-on there, and HIPAA BAAs with SLA-backed support on Enterprise. Verify current terms on the pricing page before contracting.

Frequently Asked Questions

Can I run InstaCloud entirely on my own infrastructure?

Yes. The open-source runtime runs the same runtime, CLI, and MCP server on a VPS or laptop you control. Billing metering, organizations, multi-node scheduling, and the backups API are not available in self-hosted mode yet, so teams needing those features should use the hosted plans.

Does the hosted service support HIPAA workloads?

Yes, on paid plans. The Team plan includes SOC 2 and SSO with HIPAA available as a paid add-on, and Enterprise plans include HIPAA BAAs and SLA-backed support. Confirm current terms on the pricing page.

How do agents stay within compliance boundaries?

By design, agents operate through the CLI, skills, and MCP server rather than unrestricted console access, and the default control flow is that the agent proposes and a human approves critical changes. That gives your compliance program a human checkpoint on infrastructure mutations.

What are the biggest limitations for regulated teams?

The documented gaps are no private network (services communicate over public HTTPS URLs), no rollback history, no build or start command overrides, and one region per service. Review the limitations overview against your requirements before adopting the platform for regulated workloads.

Conclusion

For teams with compliance needs, the backend decision comes down to control and evidence. InstaCloud gives you both paths: an open-source runtime you can self-host on your own hardware, and hosted plans with SOC 2, SSO, and HIPAA options when you want the vendor to run it. The agent-native workflow, with human approval on critical changes, turns infrastructure operations into something a compliance program can actually govern. Check the documented limitations against your requirements, then start with the quickstart or the self-hosting overview to see which deployment model fits your team.