A contract requires it
Client agreements in defence, financial services, healthcare and government work frequently prohibit employee or project data leaving controlled infrastructure. This is the single most common reason customers arrive here.
Deployment · Self-hosted
Run employee management software on your own server
A Docker Compose stack on your infrastructure. Attendance records, work reports, documents and screenshots stay on your disk, under your retention policy and your backup schedule. The only thing that leaves your network is a licence check, or nothing at all with an offline licence file.
- Docker Compose
- Your data, your disk
- Air-gap supported
- From ₹40,000 a year
What self-hosted actually means here
The word gets used loosely. This is precisely what runs where.
| Component | Runs where | Notes |
|---|---|---|
| Web portal and API | Your server | The full application, not a cut-down edition |
| Database | Your server | MongoDB in the stack, or an instance you already run |
| Screenshots and uploads | Your disk or your S3 bucket | Never transmitted to us under any configuration |
| Desktop tracker traffic | Your server | The app is configured with your own URL |
| Email notifications | Your SMTP relay | You supply the credentials; we never see the mail |
| Licence check | Outbound to us, or offline | A single call; an offline licence file removes it entirely |
| Backups | Your schedule | Documented dump and restore, run by you |
You are the data controller. There is no sub-processor to declare in your privacy notice, no data processing agreement to negotiate with us for the employee data itself, and no third party in the chain when a client asks where their contractor hours are stored.
Why companies choose self-hosting
Screenshots are sensitive
A screenshot of a developer machine can contain client code, customer records or credentials. Some organisations will not put that on a vendor platform at any price, and that is a reasonable position.
Cost at scale
Per-user billing keeps climbing with headcount. A flat annual band stops. Somewhere between 60 and 100 employees the self-hosted licence becomes the cheaper line item.
No sub-processor to declare
If your own privacy notice or ISO scope would need updating to add a vendor, self-hosting avoids the paperwork entirely.
Restricted networks
Air-gapped sites, sites behind a strict proxy, and sites where outbound HTTPS to a new domain needs a change request. An offline licence file covers all three.
Control over upgrades
You decide when a new version goes in, and you can test it on a staging host first. Nobody pushes a change into your environment on their own schedule.
Who needs it, and who does not
Self-hosting fits when
- You already run Linux servers and one more container stack is not a new capability.
- A contract, an auditor or an internal policy makes data location non-negotiable.
- Headcount is above roughly sixty and the per-user maths has stopped working.
- You want screenshots on your own disk with a retention policy you set.
It does not fit when
- Nobody on the team is responsible for patching a server. That is a real cost and it does not go away.
- You want to be live this week — procurement and provisioning usually take longer than the install does.
- You have fewer than about twenty-five employees and no compliance driver. Take cloud.
- You want data separation but not server operations. Take private cloud instead.
What runs on the server
Attendance, leave, projects, work reports and time tracking are the same code as the cloud. Self-hosting removes nothing.
Attendance, leave and holidays
The complete module set: shifts, grace windows, late policy, regularisation, every leave type, accrual and the shared holiday calendar.
Attendance →Projects, tasks and work reports
Projects with members and codes, tasks with completion, and daily work reports written against a project.
Workforce →Desktop time tracking
The tracker for Windows · macOS · Ubuntu, pointed at your own URL, with screenshots stored on your disk if you enable them.
Desktop tracker →Deployment architecture
One host, one compose file, one inbound port. There is no message broker to run and no separate worker fleet to size.
System requirements
- Host: any Linux distribution with Docker Engine 24 or later and the compose plugin.
- Size: 4 vCPU · 8 GB RAM · 200 GB disk for up to about 100 employees.
- Network: 443 inbound only. Outbound only for the licence check, unless you use an offline licence.
- TLS: your own certificate, or Let’s Encrypt through the bundled reverse proxy.
- Storage growth: roughly 1.5–3 GB per employee per month with screenshots on at the default interval.
Docker installation
The whole install, from an empty VM to a working portal.
# 1. unpack the stack supplied with your licence
tar xzf employeedesk-selfhosted.tar.gz
cd employeedesk
# 2. set your domain, database password and licence key
nano .env
# 3. bring it up
docker compose up -d
# 4. confirm it is healthy
curl -fsS https://hr.yourcompany.com/api/healthThe bundle contains a docker-compose.yml, a .env template and the container images. Nothing else on the host is touched. We run this install with you as part of the ₹25,000 setup and handover, so the first run is a call rather than a support ticket — after that the same commands are yours to re-run whenever you rebuild the host. Step-by-step detail, including reverse-proxy and TLS configuration, is in the installation documentation.
Data storage, retention and backup
Where data sits
- Structured data — employees, attendance, leave, projects, tasks, work reports and tracked time — in MongoDB on your host.
- Files — documents, chat attachments and screenshots — on a mounted volume, or in an S3 bucket you own.
- Nothing in our infrastructure. There is no telemetry upload and no analytics beacon in the self-hosted build.
Retention
Screenshot retention is a number of days you set; captures older than that are deleted by a scheduled job. Attendance and leave records are kept until you delete them, because they are usually the records you are legally required to hold. See data retention.
Backup and restore
A complete backup is a database dump plus the uploads volume:
# nightly
docker compose exec -T db \
mongodump --archive --gzip --db=employeedesk \
> /backup/edc-$(date +%F).archive.gz
tar czf /backup/uploads-$(date +%F).tar.gz ./uploadsThe backup and restore guide covers the restore side, which is the half that matters. Test it before you need it.
Air-gapped and restricted networks
Some installations cannot make an outbound connection at all. For those, the licence is issued as a signed file rather than checked over the network, and the container images are supplied as a tarball you load with docker load.
- No outbound connectivity required, at install time or at runtime.
- Desktop trackers point at the internal hostname and never resolve an external domain.
- Updates are delivered as a new image tarball on the same schedule as the public images.
- The licence file carries an expiry, so renewal is a file replacement rather than a network call.
Tell us at the point of quoting if the environment is air-gapped, because the handover runbook is different.
Security on a self-hosted installation
Self-hosting moves most of the security surface to you, which is the trade. Here is what the product brings and what remains your responsibility.
| Area | Product provides | You provide |
|---|---|---|
| Authentication | Password policy, session control, SAML 2.0, OIDC and AD/LDAP directory sync | Your identity provider configuration |
| Authorisation | Employee, manager, HR and admin roles plus an access audit log | Who gets which role |
| Transport security | HTTPS enforcement and a bundled reverse proxy | The certificate and its renewal |
| Data at rest | Application-level controls and retention jobs | Disk encryption and host hardening |
| Backups | Documented dump and restore procedure | Running it, storing it off-host and testing it |
| Patching | Updated images on a published cadence | Applying them, and patching the host OS |
Our full posture, including the cloud side, is on the security page.
Self-hosted pricing
A flat annual licence by headcount band. The price stops climbing every time you hire.
| Employees | What's included | Per year |
|---|---|---|
| Up to 25 | Full product, updates, email support | ₹40,000 |
| Up to 50 | Full product, updates, email support | ₹70,000 |
| Up to 100 | Adds SSO, directory sync, access audit log | ₹1,20,000 |
| Up to 250 | Adds priority support and upgrade assistance | ₹2,25,000 |
| 250+ | Adds source-code escrow and a named contact | ₹3,50,000+ |
One-time setup and handover: ₹25,000, which covers the install on your host, configuration, an admin walkthrough and the backup runbook. A perpetual licence is available at 2.5× the annual price including one year of updates, then 18% annual maintenance. Compare against per-user cloud billing on the pricing page.
~60employees, roughly where self-hosted becomes cheaper than cloud
< 1 hrtypical install time once the VM exists
1inbound port
0sub-processors to declare
Frequently asked questions about self-hosting
What does self-hosted Employee Desk mean?
It means the entire application runs on a server you control. The web portal, the database, the uploaded documents and the screenshots all live on your disk. The desktop tracker is pointed at your own URL, so employee activity data never reaches us at all.
How is it installed?
It ships as a Docker Compose, single host stack. You provide a Linux host with Docker, a domain and a TLS certificate; the compose file brings up the Node.js application + MongoDB. A typical install takes under an hour once the VM exists.
What server do we need?
4 vCPU · 8 GB RAM · 200 GB disk is the practical minimum for up to about 100 employees. Screenshot storage is the variable that grows: budget roughly 1.5 to 3 GB per employee per month if screenshots are enabled at the default interval, and less if you shorten retention.
Does anything leave our network?
Only a licence check, or nothing at all with an offline licence file. For air-gapped or restricted networks an offline licence file removes even that, and the installation then makes no outbound connection at all.
How do upgrades work?
You pull the new image tag and run the compose up command again; database migrations run automatically on start. Upgrades are yours to schedule, which is the point of self-hosting, so there is no forced update window.
How do backups work?
A database dump plus the uploads directory is the complete backup. The documentation includes a scripted nightly dump and a tested restore procedure, because an untested backup is not a backup.
Can we run it air-gapped?
Yes. Load the images from a tarball, apply an offline licence file, and the installation runs with no outbound connectivity. Desktop trackers on the same network point at the internal URL.
What does the self-hosted licence cost?
A flat annual licence by headcount band, starting at ₹40,000 per year for up to 25 employees, with ₹25,000 one-time setup and handover. A perpetual licence is available at 2.5 times the annual price with a year of updates, then 18% annual maintenance.
Do we get the source code?
Not by default. Source-code escrow is included in the 250+ band, which covers the risk most procurement teams are actually asking about when they ask for source.
What support comes with it?
Email support and product updates are included in every band. Priority support and upgrade assistance start at the 250-employee band, and a named contact comes with 250+.
Looking for a self-hosted replacement for something specific? See the self-hosted Hubstaff alternative and self-hosted Time Doctor alternative pages.
Tell us your headcount and where the server has to live
We will price the licence on the call, and if self-hosting turns out to be the wrong shape for you we will say so.
- 7-day trial
- No credit card
- Cancel anytime