Skip to main content
A self-hosted deployment runs the Vidoc application and scan workloads in your Kubernetes infrastructure. Supporting data services and connections to your source code platform, identity provider, and LLM service complete the deployment. The diagram shows the reference arrangement. Services outside the Kubernetes box can still be inside your internal network; their placement in the diagram does not require an internet connection. Vidoc reviews service placement and the network boundary with your team before installation. Refer to Private network access.

​
Application workloads

Workers and scan sandboxes need capacity in addition to the web and API services. Concurrent scans can create additional sandbox workloads and storage use.

​
Supporting services

The reference deployment uses these services: The deployment review determines which services are included in the cluster and which can use an existing service. Vidoc confirms the compatible versions and configuration in the supplied runbook. Refer to Preparing your infrastructure.

​
Connections to your services

  • Source code platform: Vidoc reads repository content, receives webhook events, and posts PR results. Available integrations are listed in Supported platforms.
  • Identity provider: users sign in with your company account through OIDC.
  • LLM service: Vidoc sends model requests to the configured provider. The reference self-hosted configuration uses AWS Bedrock in your AWS account, including an embedding model for code context.
The deployment review covers the provider account, model access, region, quotas, and permitted connections. Any alternate configuration must be reviewed with Vidoc.

​
How data moves during a scan

  1. A webhook, a user action, or a CLI request starts work for a repository.
  2. Vidoc obtains source content from the source code platform or a CLI upload and prepares code context in its data services.
  3. Workers coordinate the scan. Agents inspect source content in workspaces and make requests to the configured LLM service. Model requests can include source code, findings, and prompts.
  4. Vidoc stores findings and scan state. Users see results in the web app, and enabled integrations post results to the source code platform.
The configured LLM service is part of the data flow even when Vidoc runs on premises. Review processing locations and provider terms for your deployment. Refer to Data handling and security review. For connection planning, refer to Networking and access.