On-premise deployment
On-premise deployment
Beam's collector already runs on the endpoint and writes to local disk by default — nothing to change there. For teams that also want the fleet dashboard inside their own network, it's a Next.js app backed by Postgres that you deploy and own, so agent activity never has to reach Beam's cloud.
This isn't a separate product tier — it's the same open-source core, deployed on infrastructure you control instead of ours.
What stays inside your network
Beam is local-first at the endpoint by design. On-premise deployment extends that to the fleet dashboard, so the whole stack — collection, storage and review — sits behind your own perimeter.
- Collector
Binds to loopback, not the network
127.0.0.1:4319 by default. Events never leave the machine unless you export them yourself.
- Storage
Your disk, your database
The endpoint writes local NDJSON at 0600. The dashboard's Postgres instance lives wherever you run it — your VPC, your data center.
- Dashboard
A Next.js app you deploy
Same Auth.js-backed control plane Beam runs, packaged as a normal app: point it at your own Postgres and it's yours to operate.
- Network
No required outbound calls
Self-hosted end to end, the stack has nothing to phone home to. Any egress you see is from the AI tools you're monitoring, not from Beam.
- Access
Your credentials, your session store
Manager and team-member accounts live in your Postgres. Beam never holds a copy.
- Source
Open-source core
The collector is open source, so you can read exactly what ships to your endpoints before you trust it with production repos.
What that means in practice today
- Managed installer
- Not shipped — you provision Postgres and run the app yourself
- SSO / SAML
- Not shipped in v1 — credentials login only
How teams set this up today
- 01
Run the collector on each endpoint
It's local by default — this part needs no network decision to make.
- 02
Stand up Postgres in your own environment
A managed instance or a container you run — Beam doesn't require a specific host.
- 03
Deploy the dashboard app against it
Point the dashboard at your database and set its auth secret. It serves your org from inside your network.
- 04
Point your fleet at it
Endpoints keep recording locally; the dashboard aggregates what your team chooses to bring into it.
What this page is careful not to claim
Beam does
- Run the endpoint collector local-only, with no outbound network requirement by default
- Ship the dashboard as a normal, self-hostable Next.js + Postgres application
- Keep session and account data in a database you provision and control
- Publish the collector's source so you can verify what runs on your endpoints
Beam does not
- Provide a turnkey on-prem installer, Helm chart or air-gapped bundle — you assemble the pieces
- Include SSO, SAML or directory-sync in v1 — credentials login only
- Host or manage the on-premise deployment for you — that's ops your team owns
- Change anything about the endpoint collector, which is local-first whether or not you self-host the dashboard
Questions about on-premise deployment
Is Beam's endpoint agent already on-premise, or only the dashboard?
The endpoint collector already is: it binds to 127.0.0.1 and writes local NDJSON by default, with no cloud dependency. On-premise deployment is really about the fleet dashboard, which is a self-hostable Next.js + Postgres app rather than something you're required to point at Beam's cloud.
Do you provide a Docker image or Helm chart for the dashboard?
Not yet as a packaged installer — the dashboard is a standard Next.js app backed by Postgres via Prisma, and you deploy it the way you deploy any app in your stack. If you need help wiring it up, talk to us.
Does self-hosting change what the collector records or redacts?
No. Redaction, event schema and local storage behavior are identical whether or not you run the dashboard in-house — self-hosting changes where the fleet view lives, not what the endpoint does.
Is there SSO for an on-premise dashboard deployment?
Not in v1. Accounts use credentials login against your own Postgres. If your organization needs SAML or OIDC, tell us — it's a reasonable ask we don't want to overstate as already built.
Related
Keep AI activity data inside your own network
The endpoint is local by default. Self-host the dashboard alongside it and nothing has to leave your infrastructure.