Deployment options
Choose where CMDash runs
The same product runs in three places: on CMDash Cloud, on your own servers, or in your own AWS account. Pick by who you want operating it and where your data has to sit.
Why teams pick each one
- CMDash Cloud: You want posture, frameworks and evidence working today, without servers to run or patches to schedule. Deploying CMDash Cloud.
- Your servers (on-premises) Coming soon: Your data must stay inside your own boundary, or your environment is air-gapped. You run CMDash on your hardware and keep the keys. Installing CMDash on your own servers.
- Your AWS account Coming soon: You buy through AWS Marketplace or want the data in your own AWS account, including AWS GovCloud (US), with a template that builds the whole stack. Running CMDash in your AWS account.
Side by side
| What you are deciding | CMDash Cloud | Your servers Coming soon | Your AWS account Coming soon |
|---|---|---|---|
| Who runs it and who patches it | CMDash operates the service, applies every update and patches the platform. | Your team runs it on your own servers. CMDash publishes signed releases and the install guides, and you choose when to update. | Your team runs it in your AWS account from one CloudFormation template and the CMDash AMI. You choose when to update. |
| Where your data lives | One commercial AWS region, us-east-1, operated by CMDash. Data stored in an AWS EU region: Coming soon | On your servers, inside your own boundary. | In your account: the database, the encrypted data volume and two S3 buckets, optionally under your own KMS key. Launch in us-east-1, us-east-2, us-west-1 or us-west-2, or in AWS GovCloud (US) with the GovCloud template. |
| Network requirements | Your users reach CMDash over HTTPS. Connector calls to your tools come from CMDash infrastructure, which has no fixed IP range to allow-list. | The signed license file is checked offline, so a default install never calls CMDash to verify it and has no required outbound call to CMDash. Ports 80 and 443 serve your users. | Ports 80 and 443 only, with 80 redirecting to HTTPS. A license-file install makes no call to CMDash. Connector calls leave from your own VPC, so you can fix and allow-list the address. |
| Identity and single sign-on | SAML 2.0 and OIDC sign-in from the Starter plan; SCIM and LDAP directory sync on Enterprise. | Sign-in, SCIM and LDAP as on Enterprise anywhere, against your own identity provider. You also control who can reach the install on your network. | Sign-in, SCIM and LDAP as on Enterprise anywhere, against your own identity provider. Access to the instance is through AWS Systems Manager, with no SSH by default. |
| Updates | Applied by CMDash across the service. Nothing for you to do. | One click from Settings, Updates, or by installing a new signed release bundle. Each image is verified against the CMDash release signature, and a failed health check rolls back to your previous version. | One click from Settings, Updates, or a new AMI through a CloudFormation stack update. A failed health check rolls back to your previous version. |
| Backup and disaster recovery | CMDash: automatic backups of the hosted database with point-in-time restore. | You. One command writes an encrypted backup archive, a systemd timer schedules it daily, and one command restores it. | You. Daily backups go to your own S3 bucket, and the production template adds a Multi-AZ encrypted database with automated backups. The restore steps are documented. |
| Integrations | Set up in the app. Connector traffic originates from CMDash infrastructure. | Set up in the app the same way. Connector traffic leaves from your own network, and the install has no required outbound call. | Set up in the app the same way. Connector traffic leaves from your own AWS account. |
| Plan you need | Free, Starter, Essentials, Command or Enterprise. | Enterprise, from a signed license file. From $4,999 a month, billed annually, the same as Enterprise on CMDash Cloud. | Enterprise, from a signed license file or through your AWS Marketplace subscription. From $4,999 a month, billed annually, the same as Enterprise on CMDash Cloud. |
| Time to start | Sign up and use it the same day. | As soon as you have a Linux host and your license file. The installer checks the host, the settings and the license before it changes anything. | As soon as the CloudFormation stack reaches CREATE_COMPLETE, which it does only once the application answers its health check. |
| Typical fit | Most teams: a security or compliance lead who wants posture, frameworks and evidence working without running any infrastructure. | A regulated environment, or any team whose data must stay on its own servers and whose network egress is tightly controlled. | An AWS-committed buyer who procures through AWS Marketplace, or a team that wants the data in its own AWS account. |
Enterprise costs the same wherever it runs. See plans and pricing, the AWS Marketplace page and the responsibility matrix for sensitive data.
Not sure which fits?
Tell us where your data has to live and who will run it, and we will work through the options with you.