Open source
The same code, whichever way you run it.
Self-hosted Data Cartel is not a fork, a trial, or a stripped build. It is the same application with one organisation in it and one setting changed.
Why it is built that way
One codebase, one code path.
A separate build for self-hosters sounds harmless and is not. The isolation tests would cover one of the two. A security fix would be a port rather than a release. The two would drift within a quarter, and the drift would be invisible until it mattered.
So there is one path. You run the multi-tenant-safe query layer with a single tenant in it, which is strictly the safer arrangement. The cost to you is an unused column. Once the repository is public, the cloud will run tagged releases of it rather than whatever is on the main branch, which is what will make the claim on this page checkable.
The boundary
Everything you look at is open. The control plane is not.
What stays closed is the machinery for running many companies on one deployment. If you are running one company, it is machinery you would switch off anyway.
- Roadmap, changelog, documents, assets, updatesOpen source
- Departmental Health and its rubricOpen source
- Requests intake and office hoursOpen source
- Weekly digest emailOpen source
- The MCP server and its propose-then-approve write pathOpen source
- Business units, roles, memberships, permissionsOpen source
- Magic-link auth and the invite-only sign-in pathOpen source
- The cross-tenant isolation test suiteOpen source
- Multi-organisation signup and provisioningCloud only
- Subdomain routing, wildcard certificates, custom domainsCloud only
- The audited support impersonation consoleCloud only
- Subscription billingCloud only
- The managed, warmed sending domainCloud only
Licence
AGPL-3.0
Run it internally, modify it, and keep your changes to yourself. Offer it to third parties as a hosted service and you publish your modifications.
Contributions need a signed CLA, which is not in place yet. It is one click on a first pull request once it is. We would rather settle that before the first patch than ask a hundred people to sign something later.
Security
Published with tests, not promises.
Every install runs whatever version its operator last pulled, and we cannot patch any of them. So the repository goes public only once the authorization rules are enforced by an executable test suite running in CI, rather than by documentation and good intentions.
After that, a security fix is a tagged release and a published advisory, so self-hosters find out. Report anything you find to security@datacartel.io.
The repository is not public yet.
It goes public with the first release, once the isolation suite is green in CI. Leave an address and we will tell you the day it does.
Or use the cloud now: start a free trial.