Self-hosted

Self-hosted gateway.

Deploy the Mnemom gateway on your own infrastructure. Your data, prompts, and tool arguments never leave your network. Only heartbeat, telemetry, and signed verdict metadata flow to the Mnemom control plane.

Architecture

The self-hosted gateway runs in your network. It proxies LLM calls, runs integrity checks locally, and streams telemetry back to the Mnemom control plane. Nothing sensitive leaves your perimeter.

  Your Infrastructure                          Mnemom Cloud
 +---------------------------+                +------------------+
 |                           |                |                  |
 |  +--------+   +--------+ |  heartbeat     |  Control Plane   |
 |  |  App   |-->|Gateway |--+--------------->|  (api.mnemom.ai) |
 |  +--------+   +--------+ |  telemetry     |                  |
 |               |   |       |                |  Dashboard       |
 |               v   v       |                |  Alerts          |
 |          +------+ +-----+ |                |  Fleet Mgmt      |
 |          | AIP  | | LLM | |                +------------------+
 |          |Check | |Proxy | |
 |          +------+ +-----+ |
 |                   |       |
 +---------------------------+
                     |
                     v
              LLM Providers
          (OpenAI, Anthropic, etc.)

Stays inside your network

  • - Prompts, tool arguments, and LLM responses.
  • - Customer data, PII, and regulated payloads.
  • - Alignment Cards, card hashes, and proof chains.
  • - LLM provider credentials (OpenAI, Anthropic, etc.).

Sent to the control plane

  • - Heartbeat and version metadata (every 30s).
  • - Signed verdict summaries — labels, not content.
  • - Telemetry counters and anomaly statistics.
  • - Trust Rating calibration data (scores, not traces).

Quickstart — Docker Compose

The fastest way to try the gateway. Spin it up, point your agent at it, and verify a signed integrity check in under five minutes.

1. Create your .env file

Drop the license JWT and org ID we sent you into a .env file alongside the compose file. Everything else is optional.

2. Create docker-compose.yml

version: "3.8"

services:
  gateway:
    image: ghcr.io/mnemom/gateway:latest
    container_name: mnemom-gateway
    restart: unless-stopped
    ports:
      - "${GATEWAY_PORT:-8080}:8080"
    env_file:
      - .env
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    volumes:
      - gateway-data:/data

volumes:
  gateway-data:

3. Start the gateway

docker compose up -d
docker compose logs -f gateway

4. Verify it's healthy

curl http://localhost:8080/health
# Expected: {"status":"ok","version":"1.x.x"}

Production — Helm

For Kubernetes production deployments, the Helm chart is the supported path. TLS, ingress, autoscaling, and resource limits are first-class.

1. Add the Helm repo

helm repo add mnemom https://charts.mnemom.ai
helm repo update

2. Author your values.yaml

# values.yaml
replicaCount: 2

gateway:
  licenseJwt: "<YOUR_LICENSE_JWT>"
  orgId: "<YOUR_ORG_ID>"
  region: "us-east-1"

resources:
  requests:
    memory: "512Mi"
    cpu: "250m"
  limits:
    memory: "2Gi"
    cpu: "1000m"

ingress:
  enabled: true
  className: nginx
  hosts:
    - host: gateway.internal.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: gateway-tls
      hosts:
        - gateway.internal.example.com

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 70

3. Install the chart

helm install mnemom-gateway mnemom/gateway \
  -f values.yaml \
  -n mnemom --create-namespace

4. Verify the rollout

kubectl get pods -n mnemom
kubectl logs -f deployment/mnemom-gateway -n mnemom

Configuration reference

Everything the gateway reads from the environment. Only license and org are required; the rest have sensible defaults.

VariableRequiredDescription
MNEMOM_LICENSE_JWT
Required
Signed JWT that authorizes this gateway to call the Mnemom control plane.
MNEMOM_ORG_ID
Required
Your Mnemom organization UUID. Binds this gateway to your tenant.
GATEWAY_PORTOptionalPort the gateway listens on. Defaults to 8080.
GATEWAY_HOSTOptionalBind address for the gateway. Defaults to 0.0.0.0.
MNEMOM_API_URLOptionalMnemom control-plane URL. Only change for air-gapped mirrors.
OPENAI_API_KEYOptionalOptional OpenAI key if the gateway proxies OpenAI calls.
ANTHROPIC_API_KEYOptionalOptional Anthropic key if the gateway proxies Claude calls.
MNEMOM_REGIONOptionalRegion label used in verdicts and telemetry (e.g. us-east-1).
LOG_LEVELOptionaldebug | info | warn | error. Defaults to info.
TLS_CERT_PATHOptionalAbsolute path to TLS cert if the gateway terminates TLS locally.
TLS_KEY_PATHOptionalAbsolute path to TLS key matching TLS_CERT_PATH.
HEARTBEAT_INTERVAL_SOptionalHeartbeat interval in seconds. Defaults to 30.
MAX_CONCURRENT_CHECKSOptionalUpper bound on concurrent integrity checks. Defaults to 256.

Managed vs self-hosted

FeatureManagedSelf-hosted
InfrastructureHosted by Mnemom on Cloudflare Workers.Docker or Kubernetes inside your perimeter.
LLM routingThrough Mnemom's egress (observable, auditable).Direct from your network to the LLM provider.
Time to installUnder 5 minutes.About 30 minutes for Docker; 1–2 hours for Helm.
ScalingAutomatic.You control the autoscaler; Helm chart ships sane defaults.
Dashboardapp.mnemom.ai.app.mnemom.ai (reads from your gateway's telemetry).
Integrity checksIncluded.Included, run locally.
Drift detectionIncluded.Included, run locally.
Data residencyUS, EU regions.Wherever you deploy — fully in your control.
Air-gapped / offlineNot supported.Supported on Enterprise.
Self-managed model routingLimited.Full — any LLM provider or on-prem model.
SLA99.9% standard; custom on Enterprise.You own the SLA; we support the gateway.
Plan requiredAll plans.Enterprise only.

FAQ

Ready to deploy?

Self-hosted is an Enterprise tier feature. Tell us about your environment and we'll ship you the license and the Helm values to match.

Featured on There's An AI For That