Run Baz in your own environment
Bring agentic code review and coding agents to your team without your source code ever leaving your infrastructure. Run Baz as SaaS with optional Private Mode to keep your codebase in your VPC, or self-host the entire Baz cluster.
A read-only connector pod runs in your cluster behind your ingress. The Baz control plane reviews plans and pull requests over a hardened REST channel, so code stays put.
What changes on an Enterprise plan
Three things: where your source code is allowed to live, who can act on it, and how much of the stack you operate yourself.
Secure and compliant
Baz is SOC 2 certified and runs in isolated AWS environments. In Private Mode, source code is fetched transiently, only the objects a review touches, and wiped the moment the review ends, never persisted on Baz servers.
Governed access and control
Agents inherit your repo permissions, branch protection, and policy rules, and never act outside the scope you grant. Enterprise adds SAML/OIDC SSO, centralized admin, and repository owners.
Deploy your way
Two deployment models: SaaS, with optional Private Mode to keep your codebase in your VPC, or self-hosted, with the entire Baz control plane and agent runtime in your own cloud. Full feature parity either way.
Your code, your infrastructure, your audit trail
Two deployment models, both built on the same controls. See the deployment models and security & compliance docs for the full picture.
SaaS
Baz runs the platform for you. Add the optional Private Mode to keep repositories in your VPC: one File System Service pod gives Baz scoped, temporary read access per review, limited to the objects that review reads, and the code is wiped the moment it finishes.
Read the deployment guideSelf-hosted
Run the entire Baz control plane and agent runtime in your own cloud, for full control over isolation and data residency.
Book a demoScoped, transient access
Baz reads only the repos you onboard, contents: read and nothing more. Code is held for analysis and wiped when the review ends, never persisted on Baz servers.
Authenticated, isolated connectivity
The FSS pod sits behind your ingress and talks to Baz over a hardened REST channel: IP allowlisting, TLS, and API-key auth. Only Baz's published IPs can reach it.
Least-privilege agents
Agents inherit your repo permissions, branch protection, and policy rules. They never act outside the scope you grant.
Selective write
Auto-fix, auto-approve, and auto-merge are gated by labels, allowlists, and protected branches, so automation acts only where you allow it.
Tamper-evident audit logs
Every FSS operation is logged inside your environment with cryptographically traceable records, so every automated action stays reviewable.
Reversible by default
Automated actions are reversible, with global kill switches. If the FSS goes offline, reviews pause and resume automatically.
Choosing SaaS or Self-hosted
Both models run the full Baz platform. The difference is where your code lives and how much of the stack you operate. Private Mode is an optional add-on to SaaS.
| Feature | SaaSManaged by Baz | SaaS + Private ModeOptional: code in your VPC | Self-hostedYour cloud |
|---|---|---|---|
| Where your code lives | Accessed transiently on Baz infrastructure, never persisted at rest | Stays in your VPC; an FSS pod grants scoped, temporary read access | Everything runs in your own cloud |
| Data residency | Baz-managed AWS environment | Region-locked to your infrastructure | Full control over region and isolation |
| Deployment | Managed by Baz, start in minutes | One FSS pod via Helm on your AWS EKS, set up with Baz support | Full control plane and agent runtime, deployed with our team |
| Connectivity | Managed by Baz | Hardened REST: IP allowlist, TLS, and API-key auth | Runs inside your network |
| Security and compliance | SOC 2 certified, isolated AWS environments | SOC 2 controls plus your network isolation and policies | Adheres to your organizational policies |
| Audit logging | Standard platform logs | Every FSS operation logged inside your environment | Logged inside your environment |
| SAML / OIDC SSO | Enterprise | Enterprise | Enterprise |
| Feature parity | Full | Full | Full |
| Best for | The fastest way to get started | Strict data residency requirements | Maximum isolation and control |
| Get started | Try for free | Read the Private Mode guide | Book a demo |
For your security review
Our infrastructure is code, version-controlled, and deployed through authenticated CI/CD, so every change to it leaves an auditable trail. The SOC 2 report, subprocessor list, and security questionnaires live in the Trust Center.