Self-hosted & on-prem
Self-hosted remote desktop, your data stays yours
Deploy the relay and console inside your own perimeter on the Enterprise plan, or use our managed cloud. Sessions, logs and keys live where you decide.
Self-hosting comes with Enterprise and runs the same product as our cloud. Export your logs at any time.
Why teams self-host Vexaro Desk
Some organisations cannot send remote-desktop traffic, logs or recordings to a vendor cloud. Vexaro Desk ships the same product as a self-hosted deployment, so you get control without giving up governance, roles or recording.
Data residency under your control
Session metadata, audit logs and recordings stay on infrastructure you run, in the region you choose.
Closed and air-gapped perimeters
Deploy inside an isolated network where outbound access to a vendor cloud is not allowed.
One product, two deployments
Self-hosting runs the same product as our cloud, and on the Enterprise plan you can move between the two.
Your data, exportable
Export audit logs and user lists as CSV at any time, and see in the console which computer keeps each recording.
How a self-hosted deployment fits together
Three components run inside your perimeter. Operators and devices connect to them exactly as they would to our cloud.
Console & API
The management plane: devices, users, roles, policies, logs and recording details. Served over TLS from your own infrastructure.
Relay network
Carries sessions when a direct path is not available. Runs on your nodes, in your regions.
Agent & clients
The same Windows client and unattended agent, pointed at your console instead of ours. macOS, Linux and mobile apps are planned.
Direct sessions still go peer-to-peer where the network allows and are end-to-end encrypted; when a network forces a relayed connection, traffic stays encrypted in transit through your relay.
Security that travels with the deployment
Self-hosting does not strip features. Encryption, verified session identity, scoped access and a full audit trail are part of the product wherever it runs.
Encrypted in transit
Console and API over TLS; encrypted sessions between Windows apps; the browser viewer through a server in your deployment that decrypts the stream for the browser.
Verified session identity
A direct session checks the other computer's cryptographic identity before any session data flows, and it is never silently downgraded to an unverified path.
Encrypted at rest
Multi-factor secrets, webhook, directory and single sign-on secrets, and the email address on each account are encrypted at rest under a key you supply and control.
Scoped, audited access
Console roles, per-organisation scoping and per-device access rights. Administrative actions and sessions are written to the audit trail.
Self-hosted, without the DIY burden
Open-source, self-host-first tools give you control if you are happy to assemble and operate every piece. Vexaro Desk gives you the same control as a supported, managed product.
DIY / open-source self-host
- Wire up SSO, roles and audit around a core
- Operate and patch every component yourself
- Community support, best-effort
- Assemble recording and evidence tooling
Vexaro Desk self-hosted
- SSO, role-based access and audit built in
- Supported releases and a managed-cloud option
- Dedicated support on the Enterprise plan
- Session recording and evidence packs out of the box
Where self-hosted fits
Self-hosting is the right call when control of data and infrastructure outweighs the convenience of a managed cloud.
Self-hosting is part of the plan
On-prem and self-hosted deployment is included with Enterprise. Talk to us about moving your workspace from our cloud to your own perimeter when you are ready.
See Enterprise pricing- Self-host / on-prem deployment
- 100+ operators, 5,000+ devices
- Custom SLA, dedicated manager
- Unlimited concurrent sessions, webhooks
Frequently asked questions
Keep remote access inside your perimeter
Start in our cloud to evaluate, then deploy the same product on your own infrastructure when you are ready. Same console, same features, your data.
Cloud, or self-hosted on Enterprise. Export your logs at any time.