Self-host Sema4.ai
Stand up a self-hosted deployment in your own cloud account, connect your identity provider, and hand the workspace to your teams.
Audience: IT (the enabler)
Hosted or self-hosted
You can run the platform two ways:
- Hosted by Sema4.ai. We operate the infrastructure. Nothing to provision, nothing to patch.
- Self-hosted in your cloud account. The platform runs in your VPC, against your database and your object storage, under your network policy. This section covers that path.
Choose a deployment target
| Target | Best for |
|---|---|
| AWS EKS | AWS, managed Kubernetes with a sandbox-capable node. |
AWS EKS is the only supported target for this release. If you need a different platform, talk to your Sema4.ai representative.
This release is single node. The application runs on one node and does not scale horizontally, so you size for peak rather than adding capacity later. It also means there is no high availability: losing the node makes the workspace unavailable until a replacement joins, though your data is unaffected. See Caveats and limits.
What you provide
- Access. A hostname and ingress so users and API clients can reach the application, an OIDC identity provider for sign-in, and network egress so the platform can reach your models, data sources, MCP servers, and the Sema4.ai services.
- Prerequisites. A PostgreSQL database, an object storage bucket, and a KMS key for envelope encryption of secrets at rest. The database and the bucket are where your data actually lives, so treat them as the things to size, secure, and back up.
- Compute. A Kubernetes cluster that meets the sandbox's requirements — not a generic cluster, so read Cluster and node requirements before you provision anything.
The deployment flow
- Prepare prerequisites. A cloud account, your license, DNS and TLS for the application hostname, and an identity provider.
- Prepare the cluster. Provision the cluster, the sandbox-capable node, and the StorageClass for the platform's data root. See Cluster and node requirements.
- Install the sandbox runtime. Once per cluster, before the platform. See Install the sandbox runtime.
- Deploy to your target. Follow Deploy on AWS EKS. Complete the values file before you install: it is your check that every prerequisite is in hand.
- Connect your identity provider. Register an OIDC application and wire it into the deployment. See Identity providers (OIDC).
- Configure the workspace. Connect models, integrations, and data sources. See Administration.
What this section covers
Cluster and node requirements→What the cluster and its node must provide before the platform can run.Install the sandbox runtime→Install Kata Containers into your cluster, once, before the platform.Deploy on AWS EKS→The bill of materials and the step-by-step install into your AWS account.Identity providers (OIDC)→Register an OIDC application in Entra ID, Auth0, or Okta and bring the values back to your deployment.Network endpoints→The Sema4.ai hosts your deployment reaches over outbound HTTPS, and the rules to add as you connect more services.Operations reference→How the deployment behaves in operation, and how to diagnose the failures that do not explain themselves.
What this article will cover
- Hosted on Sema4.ai infrastructure, and what the operating boundary is
- VPC deployment in your own cloud account
- Regions and data residency
- Sizing guidance for a first deployment
- Upgrading and patching a self-hosted deployment
- Backups and disaster recovery for the database and the bucket