Definite On-Prem

Stop choosing between modern and secure.

Lakehouse, semantic layer, automations, and an AI data agent, all running in your environment.

Your cloud · Your data · No lock-in

Schedule a deployment call with Mike →See what's included

Your Kubernetes cluster● Single-tenant

API servicesingle-tenant, isolated to you

Lakehousescalable storage, blazing-fast queries

Job runnerschedule anything, on any cadence

Fi, the AI data agentqueries, builds, and automates

§ 01 — What it is

A complete analytics platform, single-tenant, in your environment.

Definite On-Prem is the complete platform: ingestion, lakehouse, semantic layer, automations, data apps, and a real AI data agent, running single-tenant inside infrastructure you own and your security team already trusts.

Under the hood: one Helm chart onto a Kubernetes cluster you control, a Postgres database you provision, and analytical data in your own object store. It is a purpose-built single-tenant distribution, dedicated entirely to your organization. Definite ships the software; you run it.

Regulated and security-conscious teams

You cannot send sensitive data to a third-party SaaS. With On-Prem, you do not have to.

Data-residency requirements

Deploy in the EU, a specific US region, or anywhere else. You provision the cloud resources, so the region is entirely your choice.

Teams replacing a fragmented stack

Consolidate warehouse, ingestion, BI, semantic layer, and AI tooling into one platform you run yourself.

§ 02 — Deployment

If your team runs Kubernetes, you can run Definite.

There is a standard Helm chart underneath, so nothing about this deployment is a black box: your team can audit it, script it, and fold it into existing IaC, with no lock-in. A Rust CLI (definite) drives it for convenience, but every action is also expressible as raw helm and kubectl, and definite export-helm dumps the chart for your own pipeline. Definite runs on any conformant cluster. Tell us your cloud and we will have you live on it fast.

Google Cloud

GKE · Cloud SQL · Cloud Storage

Supported

AWS

EKS · RDS · S3

Supported

Azure

AKS · Azure Database · Blob Storage

Supported

Vanilla K8s

Kubernetes 1.28+

Supported · any conformant cluster

Deploy flow · the same CLI handles status, logs, and upgrades

$ definite doctor

Preflight: probes Postgres, Kubernetes, object store, OIDC, LLM

$ definite bootstrap

Ingress, cert-manager, sandbox CRDs

$ definite init

Stand up the platform

$ definite upgrade

Pull the new chart, migrate, rolling restart, on your timeline

Or have an agent install it for you

agent prompt

Help me set up Definite. Look at https://docs.definite.app/on-prem/agent-setup.md

§ 03 — Security & data control

No standing access. No copy of your data. No phone home.

Everything that touches your data runs inside your environment. Definite ships release artifacts, not a service that reaches into your cluster. Here is exactly what runs where.

Runs in your cloud

your Kubernetes cluster

API service (single-tenant FastAPI)
Frontend web UI
Lakehouse compute: DuckDB + Quack + DuckLake
Job runner (Postgres-backed scheduler)
Fi, the AI data agent, one Kubernetes sandbox per thread

Yours, never held by Definite

referenced by the software

PostgreSQL 15+ (application metadata: users, models, job state)
Object store: S3, GCS, or MinIO (lakehouse data, open Parquet)
Your identity provider (SSO via Okta or Microsoft Entra)
An LLM endpoint you choose at install (Anthropic API, Bedrock, Vertex, or Azure OpenAI)

Definite manages

release artifacts, not runtime

Versioned container images and the Helm chart
The definite CLI: preflight, deploy, upgrade, diagnostics
New releases on a published cadence; you apply them when you choose
Deployment guidance and upgrade support
Ed25519-signed license keys, offline-verifiable

Built so your security review is short

Your secrets stay yours. Database, object store, LLM keys, and license are referenced via Kubernetes Secrets, mounted files, env vars, or workload identity / IRSA, never inlined and never sent to Definite. Integration secrets are encrypted at rest with rotatable Fernet keys.

Off by default. Definite support access does not exist until you grant it: customer-toggled, time-bounded, and validated by a signed token.

Fully auditable. Every mutation is written to a filterable audit log your team owns.

Disable it entirely. Telemetry is a daily anonymized snapshot that fails soft when offline, and you can switch it off completely.

§ 04 — What's included

The full platform. Not a stripped-down edition.

On-Prem is the same product as Definite Cloud, not a degraded version of it. Every capability below is built, deployed, and running in the product today. None of it is roadmap.

Lakehouse & query

✓DuckDB + Quack + DuckLake lakehouse. Parquet data on your object store.
✓SQL query API and editor, with data-access enforced and every run logged.
✓Saved queries and recent runs, per user.
✓Data catalog: tables, schema, row preview, activity history.
✓Table freshness and SLA tracking, with per-table targets and freshness badges.
✓Lakehouse maintenance: compaction, snapshot expiry, orphaned-file cleanup.
✓Vector search and embeddings (bge-small-en-v1.5, 384-dim).

Data ingestion

✓Postgres-to-lakehouse sync (pg_sync), incremental and full-refresh.
✓Python ingestion steps (Polars in and out).
✓File upload: CSV, Parquet, JSON, NDJSON.
✓Integrations framework with an OAuth bring-your-own-app flow for connecting sources.
✓SSH tunnel to Postgres sources behind a bastion.

Semantic layer

✓DuckDB-native semantic models in Cube-format YAML, with a CRUD API.
✓Dimension and measure search.
✓Model-reference resolution: SQL can reference semantic models directly.

Automations

✓Linear automation pipelines with seven step types: sql, python, pg_sync, slack_webhook, agent, maintenance, llm_decision.
✓Timezone-aware cron scheduling and event triggers.
✓Conditional step guards: skip on rows_empty, succeeded, output_truthy, and more.
✓Stored, reusable Python scripts.

Autonomous monitoring agents

✓Probe-to-decision-to-action monitors: a SQL or Python probe, an LLM decision, an action.
✓Action modes: simple (Slack, webhook, SQL) or a full Fi agent run.
✓Cooldown suppression and cross-run memory.

Fi, the AI data agent

✓Conversational agent with one isolated Kubernetes sandbox per thread.
✓Around 21 built-in tools: SQL, catalog, integrations, docs search, memory, panels, web.
✓Two-layer memory: episodic run logs plus durable workspace facts.
✓Rich panels (tables, charts, images, HTML, credential forms) and live SSE streaming.
✓Reachable from the web UI, the CLI, automation agent steps, and an MCP server.
✓Optional kernel-level sandbox isolation via gVisor or Kata.
✓A concurrency guardrail caps simultaneous agent threads.

Data apps & embedding

✓React data apps: scaffold, build, and upload via the CLI.
✓External embedding via iframe with signed durable and short-lived tokens.
✓Per-embed row and column scoping.

Auth, permissions, operations

✓App roles (viewer, editor, admin) plus custom roles.
✓Per-item content ACLs across apps, threads, queries, automations, agents, integrations.
✓Table-level data-access roles with schema and table grants.
✓Long-lived, admin-issued API tokens.
✓Full audit log, inbox alerts (pipeline failure, SLA breach, schema change, Fi proposal).
✓SSO via Okta and Microsoft Entra; local Postgres auth as the fallback.

Web UI

✓Full web UI: Home, Query, Catalog, Fi, Automations, Agents, Integrations, Data Apps, Projects, Inbox, Docs, Settings.
✓In-app product docs and a global command palette.

§ 05 — Sources

Connect every source you already use.

The job runner connects to any source you can reach over an API, so the data you already pull into Definite comes in the same way on-prem. It runs inside your environment, with an integrations framework, Python ingestion steps, and a generic webhook to land anything else.

On-Prem ships a growing integration catalog covering the sources below and more. They are examples of what the job runner connects to, not a fixed list.

Salesforce

PostgreSQL

Stripe

HubSpot

Shopify

Snowflake

MySQL

MongoDB

Google Analytics

Segment

NetSuite

and any other API

If you can reach it over an API, the job runner can pull it. Postgres syncs incrementally, Python steps handle anything bespoke, and the generic webhook lands event streams, all without your data leaving your network.

§ 06 — Bring your own agent

The governed data layer for every agent in your company.

Fi is built in, but you are not locked into it. Definite On-Prem ships a read-only MCP server, so any MCP-compatible client connects and queries your governed data, all inside your environment: Claude, Cursor, an internal copilot, or a custom agent your team is building. Every one of them reads through the same data-access roles and audit log that govern your users.

Any MCP client

Claude, Cursor, internal and custom agents connect over the open Model Context Protocol.

In your environment

Agents reason over your data without it leaving your network.

Read-only by design

Agents query and analyze; they do not mutate your data or configuration.

Governed and audited

The same data-access roles and audit log that govern your users govern every agent query.

As your team adopts more agents, Definite is the one place they all reach data safely, no new copy, no new credential, no new path out of your network.

§ 07 — Pricing

One number a year. No metering, no surprises.

On-Prem Standard

From $48,000/ year

✓Single-tenant deployment in your cloud
✓One Helm chart, the definite CLI, versioned releases
✓The complete Definite analytics platform
✓Hands-on deployment support and an operations runbook

Schedule a deployment call with Mike →

Enterprise

Contact sales

✓Higher support tier and SLAs
✓We complete your security review and vendor questionnaires
✓Scoping tailored to your environment and data volume

Schedule a deployment call with Mike →

Design Partner program

First wave

✓Discounted first-wave pricing
✓Deploy alongside Definite's team, with direct founder access
✓Direct input into what we build next

Schedule a deployment call with Mike →

On-Prem buyers typically prefer a flat annual contract over metered usage. We'll scope the right plan with you on the deployment call.

§ 08 — FAQ

Questions from security teams, answered.

Definite is SOC 2 Type II certified, with passed audits and penetration tests. Review the full posture at trust.definite.app.

No. All ingestion, storage, query execution, and dashboard rendering happen inside your environment. Analytical data lives in your object store in open Parquet format; application metadata lives in your Postgres. Definite has no copy and no access path.

Yes. One deployment equals one organization. No shared infrastructure, no shared database, no multi-tenant partitioning. You are the only tenant.

Nothing in your environment by default. No standing access, no hidden network path out, no phone-home that transmits your data. For support, you can optionally grant time-boxed, audited access. The deployment requires no inbound connection from Definite.

Yes. On-Prem supports SSO via Okta and Microsoft Entra (OIDC). Local Postgres-backed auth is available for initial setup and as a fallback. We will scope coverage to your provider during onboarding.

Secrets (database passwords, object store credentials, LLM API keys, license key) are referenced, never inlined. The config supports Kubernetes Secrets, mounted files, environment variables, or workload identity / IRSA so you can avoid static long-lived keys entirely. Definite never receives any of these secrets.

Fi reasons over your data using an LLM you provide credentials for. The data Fi sees stays in your environment; only the prompt context Fi constructs reaches the LLM endpoint you chose. Point Fi at a Bedrock or Vertex endpoint inside your VPC and nothing leaves your network.

Customer-initiated. definite upgrade pulls the new chart version, runs database migrations, and performs a rolling restart. You choose when; upgrades are never forced. The deployment is a standard Helm chart, so SREs can manage it with their own tooling.

Yes. We complete standard security questionnaires and join calls with your InfoSec or vendor-risk team. The On-Prem model usually shortens these reviews: the highest-risk questions (where does our data go, who can access it) have a simple answer: it stays with you.

Keep your data in your cloud.

In 30 minutes with Mike Ritchie, founder of Definite, you will have answers for your security team, a deployment scoped to your environment, and a clear path to live. He will walk your team through the architecture and answer your security questionnaire on the call.

Schedule a deployment call with Mike →