Self-Hosting

Run Thunders inside your own network

Deploy the full Thunders platform in your cloud or datacentre. Your source code, test data, and screenshots stay inside your perimeter.

Trusted by teams at
Microsoft logoMedius logoAllianz logoSncfconnect logoLegalPlace logoTalys logo
Why self-host

Built for teams with strict data policies

Deploy AI test automation without pushing your source code, test data, or screenshots to a vendor cloud. Keep everything inside the perimeter your compliance team already approved.

Your data never leaves your infrastructure

Your tests, test data, and screenshots stay in the region your compliance team already approved.

Bring your own LLM provider

Azure OpenAI, OpenAI, Anthropic, Gemini or OVH AI Endpoints. Route AI calls through providers your legal team has already vetted.

Authentication on Microsoft Entra ID

Sign-in runs end-to-end through Entra ID. Access maps to the groups you already manage. No open signup.

Runs on your cloud, not just ours

Azure, AWS, GCP, Kubernetes, or Docker. Your platform team picks the orchestrator.

Two deployment models

Full self-hosting for teams that need everything inside their perimeter. Browser Engine via Azure Relay for teams that only need the engine locked down.

Built for regulated environments

Compatible with HIPAA, SOC 2, and GDPR requirements. Deployed in production by enterprises with strict data residency mandates.

Deployment models

Two ways to deploy

Pick the model that matches your infrastructure and your compliance requirements. Compare the two below and pick the one that fits.

Model 01

Full self-hosting

The whole platform runs in your infrastructure. Thunders ships container images. Your team runs them on your cloud or on-prem.

What runs on your side
  • Web app, API service, browser engine
  • PostgreSQL 16+ and Redis
  • All test data, logs, and screenshots
Orchestration

Your infrastructure handles everything. Thunders never sees your data. Updates ship through a dedicated container registry on the cadence that fits your change management.

Best fit

Enterprises with data residency requirements, non-Azure infrastructure, or a policy that platforms must live inside their own perimeter.

You supply

Microsoft Entra ID, an email transport (SendGrid or SMTP), object storage (Azure Blob or S3-compatible), and at least one LLM provider.

Model 02

Browser Engine via Azure Relay

Only the browser engine runs on your side. The Thunders cloud handles orchestration. The engine reaches us through outbound HTTPS.

What runs on your side
  • A Browserless Docker instance
  • Outbound-only HTTPS on port 443
  • No inbound firewall rules or VPN
Orchestration

The Thunders cloud orchestrates the tests. Your QA environments never touch the public internet. Bring your own Azure Relay namespace, or use ours.

Best fit

Organisations with HIPAA, SOC 2, GDPR, or data sovereignty constraints that cannot expose QA environments to the internet, but do not need the full platform on-prem.

You supply

Docker and an outbound HTTPS (443) connection. Optionally, your own Azure Relay namespace if you would rather own the transport.

See the full architecture in the deployment guide

Use cases

When self-hosting is the answer

The environments and mandates that push teams to move the platform inside their own network.

01

Run AI test automation without data leaving your network

For enterprises where the answer to “where does the data go” needs to be “nowhere else.” Full self-hosting keeps every test artefact, screenshot, and log inside your network.

02

Meet EU data residency without giving up frontier AI

Point Thunders at OVH AI Endpoints or your own Azure OpenAI tenancy. Keep prompts and generated tests inside the jurisdiction your regulator cares about.

03

Automate testing on private or non-cloud environments

Applications that live behind a VPN, in a private datacentre, or on infrastructure that cannot be IP-whitelisted still get automated coverage. The browser engine relay reaches them without opening a single inbound port.

04

Deploy on the infrastructure you already run

Thunders ships as container images. Your platform team picks the orchestrator and the update cadence. No new vendor cloud to onboard.

Frequently Asked Questions

What runs in my infrastructure with full self-hosting?

All five Thunders components: web app, api service, browser engine, database and Redis Cache. You supply Microsoft Entra ID, an email transport (SendGrid or SMTP), object storage (Azure Blob or S3-compatible), and at least one LLM provider.

Which clouds and orchestrators are supported?

Azure Container Apps is our recommendation for production. AKS and other Kubernetes distributions, AWS ECS and EKS, GCP, and plain Docker are all supported.

Which LLM providers can I use?

Azure OpenAI (including AI Foundry), OVH AI Endpoints, OpenAI, Anthropic, and Gemini.

How does authentication work?

Self-host builds use Microsoft Entra ID end to end. The first user to sign in bootstraps the initial organisation and admin account. After that, new users are provisioned through Entra ID like the rest of your identity stack.

What is the difference between full self-hosting and hybrid mode?

Full self-hosting keeps everything inside your infrastructure. Hybrid mode keeps only the browser engine on your side and lets our cloud handle orchestration.

How do we get images and updates?

Through a dedicated Azure Container Registry namespace and a single pull token covering the five Thunders images. Updates are published to the same registry. Your team pulls on the cadence that fits your change management process.

Ready to ship faster with smarter testing?