Appearance
On-premise (Kubernetes and Azure Arc)
For estates that cannot use public cloud, Nomain runs on your own Kubernetes cluster, inside your datacenter. This is the same application as every other deployment model, packaged as containers and delivered to your cluster as Helm charts. Your code and its analysis stay entirely within your perimeter.
Two variants
The Kubernetes deployment comes in two variants that share the same workloads and the same security posture. They differ only in how the cluster is managed:
| Variant | What it is | You get |
|---|---|---|
| Azure Arc-enabled Kubernetes | Your on-premise cluster is projected into Azure through Azure Arc. | Azure-side GitOps configuration, policy, and monitoring for the cluster, without any workload data leaving your datacenter. |
| Standalone on-premise Kubernetes | A cluster with no cloud control plane. | Full self-management, suitable for air-gapped environments. |
Azure Arc keeps management in Azure, data on-premise
Azure Arc gives your platform team a single Azure control plane to manage the cluster (GitOps, policy, and observability) while the application, its databases, and all customer data remain on-premise. It is management projection, not data movement.
What runs in the cluster
The platform is the same set of services as the cloud deployments, running as pods:
- The webapp plus the graphs-api, chats-api, recipes-api, and recipes-worker services.
- PostgreSQL with
pgvectorfor chat history, knowledge graphs, repository metadata, and embeddings. - Object storage for source-code artifacts and generated reports.
- An event broker that carries the analysis (recipes) pipeline between services.
How it is delivered and kept up to date
Nomain publishes signed container images and Helm charts for each release. The cluster is configured through GitOps: a controller in your cluster reconciles the deployment from a Git repository you own, so every change is reviewable and auditable, and the runtime does not depend on Nomain infrastructure once it is running.
Foundation models
The analysis and chat features need access to a foundation-model endpoint. On-premise, that endpoint is arranged per environment to match your connectivity and compliance rules: an approved model endpoint that the cluster can reach privately. Nomain works with your platform team to wire the cluster to the endpoint you choose during onboarding.
Security posture
The on-premise deployment inherits the same BYOC principles: your data never leaves your perimeter, no Nomain operator has runtime access, and services authenticate with short-lived identity tokens rather than static credentials. The only outbound calls to Nomain are license validation and a liveness heartbeat, both metadata-only. See Security & compliance.
Sign-in is delegated to your identity provider through WorkOS, exactly as in the cloud models. See Single sign-on.
Related
- Deployment options: the four ways to run Nomain.
- BYOC on Azure: the Azure-native equivalent, if a managed cloud fits.
- Security & compliance: the data boundary and controls.