An open source AI agent platform an enterprise can self-host

What an enterprise security review asks an AI agent platform to prove

An open source AI agent platform for enterprises has to answer questions a developer trial never asks. Where does the data sit, and who can read it. Where do the credentials live, and can the agent's own code reach them. What does the audit trail record, and can a reviewer export it. Is one session isolated from the next, or do agents share a machine and a blast radius. Kortix is the open-source AI Operating System built to answer those questions with a file a reviewer can open and check.

Kortix keeps the platform in one system: your agents, skills, memory and connectors in one git repo you own, and every session on its own cloud computer. That is what makes the platform auditable, because the configuration and the record of what changed are both text you can read.

Deployment: Kortix Cloud, your VPC, or on-prem

Run it on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free. The self-hosted instance is one Docker Compose stack that the kortix self-host CLI installs, configures and updates on a Linux server you control.

curl -fsSL https://kortix.com/install | bashkortix self-host init --domain kortix.example.com --admin-email you@example.comkortix self-host start

Sessions run on a cloud sandbox provider (Daytona, Platinum or E2B) and call back to the instance, so the instance must be reachable from the internet. Name that boundary in your review before you approve the pilot, and decide which provider key the project uses. The self-hosting page covers DNS, the first sign-in and the checks to run on the box.

Models and keys

The platform is model-agnostic. You can run any model provider with your own keys, and a project can also use the ChatGPT plan it already pays for. A model can be chosen per agent, per session or per message, so a cheap model can draft and a larger one can review. Kortix-managed models run on zero-data-retention endpoints, and a team that brings its own keys keeps the provider contract it already signed.

Who can read the data, and where the run state lives

You own the repo and the data. Connector credentials are brokered server-side and never enter the machine, and secrets are encrypted at rest with a key per project. Each session gets one isolated sandbox, and a session works on its own branch, so a run cannot reach another run's files.

Run state lives in the project's git repo, on a branch named for the session. The agent commits there, opens a change request, and a person merges it. The default sandbox provider places compute, and the instance keeps its own database for accounts, projects and the audit log. If data residency matters, say which region the compute runs in and where the database sits, and write both into the review.

Credential handling, permissions and the audit trail

Per-resource permissions for people and agents. Roles, groups, and an audit trail. Every action is recorded. Reading, exporting and streaming the audit log depend on the plan. The per-session audit view is an Enterprise entitlement, and recording is never gated. SAML 2.0 single sign-on and SCIM 2.0 let you map the platform to your identity provider and provision people when they join or leave.

Approval gates you set. Off until you set them, so a review should confirm which calls carry an Ask. Session work reaches main through a change request. Merge is default-deny for agents, and a person with the merge permission reads the diff first. The management page shows how a reviewer watches a session live and diffs every change to an agent or a skill.

Isolation and the review checkpoints

One isolated sandbox per session. Each session has its own isolated machine and branch. Name the sandbox provider when you describe the boundary, because the isolation story is the provider's. The session's own agent can install, run and break anything, and only what it commits survives, which keeps a bad run from reaching production.

A security review can verify each of these in the code and in the audit log. SOC 2 Type I is held, and SOC 2 Type II is in progress; checked October 2026. GDPR is a posture Kortix runs, not a certificate, so a review should treat it as an operating practice.

How the platforms compare, and how to run the evaluation

The comparison table on this page puts the deployment, data and control rows side by side, each sourced from the vendor's own documentation. OpenHands Enterprise and Dify both document self-hosting and role-based access. Kortix is the one that keeps the agent's reach and the company's memory in a repo the business owns. A team rolling out to the whole org can start from the teams page and check the plan shape on the pricing page before the pilot.

For a broader method, Open-source AI agent platforms: how to choose one your team can own sets out what to test and what to write into the review. Run the pilot on a self-hosted box first: connect GitHub, add a model key, start a session, open the audit log, then decide whether the deployment matches the boundary your reviewers signed off on.