Rangehead
Deployment

Enough detail that your infra team can decide without a call

Three modes, one product. The agent-side daemon is identical in all three — what differs is where the data comes to rest and who operates the dashboard.

Choose a mode

The decision usually makes itself

Cloud

Choose when you want zero infrastructure and your policy permits encrypted telemetry leaving the network.

We operate the dashboard. Your daemon encrypts before sending; your browser decrypts on arrival. We hold ciphertext.

Self-hosted

Choose when data must not leave your perimeter, or you need your own identity provider and TLS in front of it.

You run the dashboard container. Nothing egresses except your own update checks, which you can disable.

Air-gapped

Choose when there is no route out at all — classified, regulated, or physically isolated networks.

Licences verify locally against a signed key. No callback, no phone-home, no exception required.

Requirements

What it needs from you

Agent-side daemonPython 3.9 or newer. Installs from PyPI, or from an internal mirror or wheel for isolated networks. Runs as the same user as the agent.
FootprintOne background process per machine. Storage grows with retained history and is bounded by your retention setting.
PlatformsmacOS, Linux, and Windows. Container images are published for Linux.
Inbound portsNone. The daemon initiates every connection it makes.
Local dashboardListens on localhost:8900 by default; the port is configurable and binding is local unless you deliberately expose it.
Outbound (cloud mode)HTTPS on 443 to the ingest endpoint. Nothing else is required for the product to function.
Outbound (self-hosted)None required. Update checks are the only optional egress and can be turned off.
Self-hosted dashboardA container host and a database volume. It sits behind your own reverse proxy, TLS, and identity layer.
Rollout

How the first ninety days usually go

Weeks 1–2 — observe

Deploy the daemon to one team in read-only mode. No behaviour changes for the engineers; you get a baseline of what your agents actually cost and touch. This is where most organisations find their first surprise.

Weeks 3–6 — widen

Extend to the rest of engineering. Set budget alerts — alerts, not limits — and let them fire for a couple of weeks so the thresholds are grounded in your data rather than guessed.

Weeks 7–12 — govern

Turn on the controls you now have evidence for: spend ceilings, tool policy for the actions that worried you, an approval queue for the rest. Wire the audit stream to your SIEM and generate the first evidence bundle.

We resist reversing this order. Enforcement configured before you have a baseline is enforcement configured on a guess, and the first false block costs more trust than the control was worth.

Migration

Moving between modes

Cloud to self-hosted is a supported path and does not require reinstalling agents — the daemon is the same binary and is repointed by configuration. Historical data held in the cloud is exportable.

Self-hosted to air-gapped is a licensing change rather than an architectural one, since neither mode egresses telemetry.

We will not pretend there is zero switching cost, but the deployment mode is not a lock-in point, and we will put that in the contract.

Talk through your environment Get the deployment guide