Can Flagsmith Be Self-Hosted?

Key takeaways

• Flagsmith self-hosting splits into two different products: a free open-source build capped at one project, and an Enterprise self-hosted tier that starts at 20 or more seats behind a sales conversation.
• Two of Flagsmith’s headline differentiators, the Edge API and real-time flag updates, are either unavailable or not free once you move to a self-hosted deployment.
• Flagsmith’s main architectural argument against Unleash, storing identities and traits server-side, stops holding once you self-host for low latency, because both the Edge Proxy and Local Evaluation mode need you to supply full trait context yourself.
• A self-hosted Unleash database holds no end-user data, since server-side SDKs never send end-user data to the server, which is a smaller compliance surface than a self-hosted Flagsmith database built to store identities and traits.
• Unleash supports more self-hosting models, documents its upgrade paths by major version, and holds SOC 2 Type II certification and provides control-mapping documentation for FedRAMP and ISO 27001.

The short answer is yes, but the long answer matters more if you’re the one signing the contract. Flagsmith’s open-source core can run on your own infrastructure today, free, with no sales conversation required. The parts of Flagsmith that most platform teams want when they ask about self-hosting (unlimited projects, real-time updates, a low-latency edge layer) sit behind a different product with a different price floor. Understanding the line between the two tiers, and the effect on Flagsmith’s own architectural argument once you cross that line, is the real evaluation question for teams weighing self-hosted or hybrid feature-flag deployment.

The short answer: yes, but in two very different tiers

Open source self-hosting vs. Enterprise self-hosting

Flagsmith ships an open-source build that anyone can deploy on their own servers, no cost, no seat count, no license key. It’s a legitimate way to run feature flags entirely inside your own network. The catch is scope: the free, self-hosted build is capped at a single project. Teams running more than one product, environment family, or business unit on feature flags outgrow it quickly, and the only path forward is Flagsmith’s Enterprise plan, a separate product with separate terms. Unleash’s open-source edition has a ceiling too: Unleash’s pricing page lists a limit of 1 project, 2 environments, and 5,000 feature flags per instance. Flagsmith’s open-source build, by contrast, has no environment cap, so the real comparison is what each vendor charges once you outgrow the free tier.

The 20-seat floor and "Contact Sales" on the pricing page

Flagsmith’s own self-hosting page confirms that on-premises installation beyond the single-project limit is an Enterprise feature, starting at 20 or more seats. The pricing page reinforces this: on-premises installation appears only in the Enterprise column, gated behind "Contact Sales," with no listed price. Enterprise Edition Docker images are distributed through a private Docker Hub repository, meaning you need Flagsmith to grant you access before you can even pull the image, and a license key before the containers will run.

Compare that to a self-hosted deployment priced on a credit card. Pay-As-You-Go self-hosted pricing runs $75 per seat per month with a five-seat minimum for self-hosted, with a free, self-service 14-day Enterprise trial you can start without talking to sales. The deployment mechanics look similar on the surface (both vendors use Docker to install Open Source and Enterprise builds), but one path has a visible price and a five-seat floor, and the other has a sales call and a 20-seat floor. The getting-started documentation shows the same Docker Compose flow for Open Source and Enterprise (using the unleash-server and unleash-enterprise images respectively), including an install-your-license step, so for Unleash the jump from evaluating the free tier to running the paid one is a license key, not a renegotiated contract. For Flagsmith, moving from open source to Enterprise starts with a sales conversation.

What doesn’t come with a self-hosted Flagsmith instance

Flagsmith markets a global, low-latency Edge API built on AWS Lambda and DynamoDB Global Tables across multiple AWS regions. It’s real infrastructure built for low-latency delivery, but a self-hoster doesn’t get it. The Edge API runs only on Flagsmith’s own SaaS platform and sits outside the open-source project entirely, per Flagsmith’s own Edge API documentation. If the reason you’re evaluating Flagsmith is its edge-distributed performance story, that story stops at the SaaS boundary.

The same pattern holds for real-time flag updates. Getting flag changes to propagate to connected clients without polling needs an Enterprise subscription, plus additional infrastructure you have to deploy and operate yourself: server-sent-events service containers running the flagsmith/sse image. In the open-source build it isn’t a toggle; it’s a paid Enterprise feature that also carries an operational cost once you’re responsible for running it. This comparison is specific to Flagsmith. Unleash SDKs poll for changes by default, and its streaming option runs through Enterprise Edge, which Unleash’s pricing page lists as Early Access.

The architecture problem: self-hosting undercuts Flagsmith’s own pitch

Edge Proxy needs the full trait payload on every request

Flagsmith’s comparison materials make a specific architectural case against context-per-request models like Unleash’s, arguing that storing identities and traits server-side means your application doesn’t have to send full user context on every flag evaluation. That argument depends on Flagsmith’s hosted Core API holding that state. Once you self-host for low latency using the Edge Proxy, the premise inverts. The Edge Proxy is stateless by design: it needs the full complement of traits on every identity request, and it does not send trait data back to the Core API. You end up providing the same context on every call that the stored-traits model was supposed to let you avoid.

Local evaluation mode doesn’t sync traits back either

Local Evaluation mode has a parallel shortcoming. SDKs running in Local Evaluation mode don’t update traits on the platform; any trait relevant to a flag decision has to be supplied by your own code at evaluation time. That mode also used to ignore identity overrides entirely, a gap Flagsmith closed in 2024; overrides now flow through when the "Use identity overrides in local evaluation" setting is on, which is the default for new environments. Put together, a Flagsmith deployment optimized for the latency most production systems need ends up running on the same "bring your own context" model Flagsmith uses to differentiate itself from Unleash, without the design built around that model from the start. A self-hosted Core API running in remote evaluation mode does still persist traits; the trade-off appears when you add the proxy or local evaluation for speed.

What stays in your infrastructure

Even when you self-host Flagsmith end to end, the database underneath it is built to hold identities and traits, the user-level data the stored-context architecture depends on. That’s a deliberate design choice, and it’s not a problem if your compliance posture accounts for it. But it means the self-hosting decision doesn’t remove end-user data from your data-handling surface; it relocates that data’s storage location.

A self-hosted Unleash database, by contrast, holds no end-user data: it stores flag configuration, admin accounts, and audit events, not the identities and traits of your application’s users. Server-side SDKs evaluate flags locally inside your application’s own process, and flag evaluation happens locally within the client SDKs, so no user data is shared with the instance. If the server is temporarily unreachable, the SDK keeps evaluating against cached configuration instead of failing open or blocking on a round trip. For teams scoping a compliance boundary, that’s a materially smaller surface: there’s no identity or trait data in the self-hosted database to protect, back up, or produce under audit in the first place. Unleash does send anonymous usage counts and a version check by default, and both can be disabled with the CHECK_VERSION and SEND_TELEMETRY environment variables.

Operational realities of running it yourself

Self-hosting shifts operational burden onto your team, and upgrade paths are the first place that burden shows up. Flagsmith’s Kubernetes and OpenShift hosting page contains a single upgrade note, and an issue filed on the Flagsmith repository asks for a fuller self-hosted upgrade runbook, calling the gap a recurring source of customer support load.

Flagsmith does publish a separate page on rolling back database migrations. A published, versioned upgrade guide removes that guesswork once you’re the one running the database migration. Unleash documents a per-major-version upgrade guide with a database backup recommendation, including PostgreSQL version guidance for each step. Since v8, the open-source server code is licensed under AGPLv3 while the official Docker images remain Apache 2.0, which matters if you build from source.

Flagsmith also uses Flagsmith to control features on its own dashboard, which creates a smaller, odder wrinkle for self-hosters. Self-hosters will sometimes see dashboard features greyed out. The dashboard ships with defaults, but to override what shows up on your own instance you create a project and point the dashboard at it.

Where Unleash’s self-hosting model differs

Flagsmith’s self-hosting options are effectively binary: open source with a one-project ceiling, or Enterprise with a 20-seat floor. Unleash offers more options between those two extremes, including a hybrid model where Unleash hosts the API and Admin UI while you run Enterprise Edge yourself (a paid component), alongside a fully self-hosted model where client-side context never leaves your own infrastructure. Scaling that out is a known pattern rather than a bespoke exercise: the Helm chart repo also includes a chart for Unleash Edge, and the server itself is stateless, with all state held in PostgreSQL.

For regulated teams, the compliance story needs documentation, not just a claim. Unleash’s SOC 2 Type II certification, backed by recurring audits, supports that story, with control-mapping documentation available for frameworks like FedRAMP and ISO 27001. Per Unleash, that documentation is the basis that lets banking, government, and defense organizations self-host within a FedRAMP Moderate or High authorization boundary, rather than treating self-hosting as a workaround for a compliance deficiency. Flagsmith also states that self-hosted deployments support HIPAA, FedRAMP, and ISO 27001 requirements, so the difference is what data sits inside that boundary, not whether compliance is possible.

Flagsmith can be self-hosted, but the features that make its platform pitch distinctive mostly sit behind a 20-seat Enterprise contract, or stop applying once a deployment is tuned for production-level latency. Unleash takes a different starting position: evaluation happens in your own application process, no end-user data crosses into the server by design, and you can self-host it on your own infrastructure in whichever form (open source, hybrid with Enterprise Edge, or fully self-hosted) matches how your environment is built.

See how Unleash fits your self-hosting requirements

If you’re weighing a self-hosted or hybrid deployment and want a compliance surface that doesn’t include end-user data by design, we’re happy to walk through how Unleash’s deployment options and SDKs apply to your environment. Start a free trial or book a demo to see the setup firsthand.

FAQs

Can you self-host Flagsmith for free?

Flagsmith’s open-source build runs self-hosted for free, but only up to a point: it runs on your own infrastructure with no license key and no seat count, though it’s capped at a single project. Once you need more than one project, the only path forward is Flagsmith’s Enterprise plan, which needs at least 20 seats and a sales conversation rather than a self-service signup.

Does self-hosted Flagsmith include the Edge API?

Flagsmith’s Edge API, a global low-latency layer built on AWS Lambda and DynamoDB Global Tables, runs only on Flagsmith’s own SaaS platform, so the answer is no. It’s documented as outside the open-source codebase entirely, so a self-hosted deployment never gets that edge-distributed performance layer, regardless of plan.

What happens to Flagsmith’s stored-traits argument once you self-host for performance?

That argument stops holding once you self-host for low latency. Flagsmith’s pitch against context-per-request models rests on storing identities and traits server-side so you don’t resend context on every evaluation. But the Edge Proxy is stateless and needs the full set of traits on every identity request without sending any of it back to the Core API, and Local Evaluation mode has the same shortcoming, since your own code has to supply any trait a flag decision depends on.

What data does a self-hosted Unleash deployment store?

No end-user data: it stores flag configuration, admin accounts, and audit events. Server-side SDKs mean flag evaluation happens locally within the client SDKs, so no user data is shared with the instance, and the SDK keeps evaluating against cached configuration if the server becomes temporarily unreachable. A self-hosted Flagsmith database, by comparison, is built to hold identities and traits.

What self-hosting options does Unleash support?

More than a binary choice. Beyond fully self-hosted, Unleash offers a hybrid model where Unleash hosts the API and Admin UI while you run Enterprise Edge yourself (a paid component), and the server is stateless with state held in PostgreSQL, which makes horizontal scaling straightforward for either model.

Is self-hosted Unleash suitable for regulated industries?

Yes. Unleash holds SOC 2 Type II certification with recurring audits and provides control-mapping documentation for frameworks like FedRAMP and ISO 27001. Per Unleash, that documentation is what lets banking, government, and defense organizations self-host within a FedRAMP Moderate or High authorization boundary. Unleash does not itself hold a FedRAMP authorization.