> ## Documentation Index > Fetch the complete documentation index at: https://midplane.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Cloud vs self-host > Both run the same open-core engine and control plane, so enforcement is identical. Here's how to choose who hosts it. Midplane is one engine with two ways to operate it. The decision isn't about how strong the protection is — it's about who hosts and operates it. The policy model, the rules, and the audit guarantee are the same on both paths. ## The same engine, either way Midplane Cloud runs the **same** open-source engine and control plane that self-hosters run. Cloud layers hosting and managed credentials over it; it never reimplements enforcement. So a query that's denied self-hosted is denied on Cloud, for the same reason, with the same audit row. ## Licensing Midplane is **open core**. Everything in the safety story — the engine, the control plane and dashboard, table access, the guardrails, column masking, and the full audit trail — is **MIT-licensed** and free to self-host. The one Enterprise feature is [SSO/SAML](/docs/cloud/plans#single-sign-on), which lives under a single `ee/` directory in the control-plane source; delete that directory and you still have a complete, working Midplane. On Cloud, Free and Pro run the MIT core and the Team plan adds SSO. Contributions go to the MIT code under [DCO sign-off](https://github.com/midplaneai/midplane/blob/main/CONTRIBUTING.md); Enterprise licensing questions go to [sales@midplane.ai](mailto:sales@midplane.ai). ## Side by side | | Cloud | Self-host | | ------------------ | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | | **Deployment** | Managed, hosted for you | Your environment — one container or binary you run | | **Authentication** | [Better Auth](/docs/quickstart) (email / Google) + per-agent OAuth (machine tokens for CI) | You own sign-in; agents connect over OAuth or machine tokens | | **Credentials** | KMS-encrypted at rest, region-bound | Stay in your environment | | **Audit log** | Searchable, indexed Postgres | Indexed into your own Postgres, plus the dashboard | | **Data residency** | EU or US — immutable, chosen at sign-up | Wherever you run it | | **Dashboard** | Web dashboard | Same web dashboard (you run the control plane) | | **Policy editing** | Policy grid | Policy grid in the dashboard, or policy YAML | | **SSO / SAML** | Team plan | Not in the community build — [contact us](mailto:sales@midplane.ai) | | **Plans** | Free / Pro / Team — see [plans](/docs/cloud/plans) | Free, MIT | | **Support** | Email, direct to the team | Community | A few of these are worth a word: * **Deployment.** Self-host now means running the Midplane **control plane** yourself with `MIDPLANE_SELF_HOST=1` — the dashboard, projects, policy grid, and audit. **One command with Docker** (`./bin/self-host up`) brings up the whole stack; the engine runs as a local subprocess inside it, so there are no per-project containers to manage. See [Quickstart](/docs/quickstart) and the [deploy guide](/docs/self-host/deploy). * **Credentials.** Self-hosting, your credentials live in your environment and never leave it. On Cloud, they're KMS-encrypted at rest — see [how Cloud secures your data](/docs/cloud/security). ## Choose Cloud if… * You want a protected endpoint in minutes with no infrastructure to run. * You'd rather not manage database credentials yourself — KMS-encrypted storage is handled for you. * Data residency matters and you need to pin to the EU or US region. * You want managed hosting and support that scales with your tier. ## Choose self-host if… * Your credentials must never leave your environment. * You want to run inside your own VPC, behind your own ingress. * You want the free MIT core with no hosted dependency. * You prefer policy as version-controlled YAML in your own repo. Many teams start on Cloud to get moving, then self-host once they have a deployment story — the agent setup and policy model carry over unchanged. ## Get started Connect a database and get a protected endpoint — Cloud or self-host. Regions, projects, tokens, the dashboard, and what's on the roadmap.