Choosing an on-premise AI coding assistant. Six questions to ask any vendor.
Running an AI coding assistant on-premise or in your own cloud keeps code and data inside your walls. But 'self-hosted' can mean many things — so ask exactly what runs where, who holds the credentials, and what stops the agent before it acts.
Updated 16 October 2026
Assistants became agents. The checklist changed.
The first AI coding assistants completed lines of code. Today's coding agents run commands, query databases and call internal tools. For an on-premise deployment, that means the questions go beyond where the model runs: they cover where credentials live, how each action is authorized, and what evidence you keep.
Use these six questions with any vendor. Under each is how Kryex answers it. For fully disconnected environments, see running an AI coding agent air-gapped; for how to judge any vendor's controls, see where AI agent policy is enforced.
Six questions for an on-premise AI coding assistant.
What runs inside our network — all of it, or part?
Some 'self-hosted' offerings keep orchestration, storage or licensing in the vendor's cloud. Ask for every component and every outbound connection.
Kryex Code, Kryex Server and Kryex Admin all deploy in your own infrastructure — in your VPC, on-premise or fully air-gapped. Nothing requires Kryex Labs' servers to be reachable.
Which models can we run, and where?
You should be able to use models you host, and choose who gets which.
Enterprise runs only the models you connect: local models through Ollama or LM Studio, or any OpenAI-compatible endpoint you host. Admins grant models per person.
Where do database and tool credentials live?
If the assistant reads credentials from each laptop, on-premise hosting doesn't solve the biggest exposure.
Credentials stay encrypted on Kryex Server, sealed per organization, and never reach the developer's machine.
What stops the agent before it acts?
Logs after the fact aren't control. Ask how a write to production by someone without write access is prevented — and whether the rule lives on a server or in a file a developer can edit.
Every governed action is checked against the person's live READ, WRITE or ADMIN grant on the server before it runs. Default is deny.
Can IT roll it out and lock its policy?
Enterprise rollout means managed installs and a policy users can't loosen.
IT deploys Kryex Code through Intune, Jamf or Group Policy, sets one command policy for every developer's agent, and can lock it on devices, even offline.
What evidence do we keep, and where?
Auditors need a record of every decision, stored in your environment.
A hash-chained, append-only audit log in your own deployment, filterable and exportable to CSV.
Common questions.
What is an on-premise AI coding assistant?
An on-premise AI coding assistant runs on infrastructure your organization controls — your data center or private cloud — so source code, prompts and credentials don't leave your environment.
Is self-hosted the same as on-premise?
Mostly. Self-hosted means you run the software yourself, whether in your own data center (on-premise) or in a private cloud account such as your VPC. Air-gapped is the strictest form, with no connection to outside networks.
Can an on-premise AI coding assistant use GPT or Claude?
Only if your network allows calls to those providers. Fully disconnected deployments use models hosted inside the boundary. Kryex Enterprise runs only the models you connect, whether that's a local model or your company's own endpoint.
Is Kryex an on-premise AI coding assistant?
Yes. Kryex is a governed AI coding agent whose Enterprise deployment runs entirely in your infrastructure — on-premise, in your VPC or fully air-gapped.