A self-hosted deployment is software installed and operated on an organization’s own servers, virtual machines, or internal cloud accounts rather than running in a vendor-managed SaaS environment. The organization is responsible for updates, access control, logging, backups, and hardening.
In cyber security, this matters because the application sits closer to internal data, secrets, and infrastructure. A vulnerability in a self-hosted workflow tool, for example, can lead to remote code execution or file access on the host machine, exposing credentials, configuration files, or internal services. Defenders should treat self-hosted apps as part of the trusted computing base: limit privileges, isolate the service, patch quickly, and monitor for unusual file reads, process launches, or workflow changes. Self-hosting increases control, but it also increases the organization’s direct exposure when a flaw is abused.