Self-hosted open source AI marketing agents: what still leaves your server

What the install puts on your server, and what stays off it

One command prepares a Linux box, and kortix self-host start brings up a single Docker Compose project named kortix-<instance>. Inside it: frontend for the web app, kortix-api for the REST API at /v1, llm-gateway, kortix-migrate as a one-shot job that migrates the database before the API starts, kortix-updater pulling new images once a day, the supabase-* services with every image pinned by digest, and caddy in domain mode or cloudflared in tunnel mode (Read the docs).

Read that list as a marketing team and it is mostly the things you already guard. The customer list and its segments sit in the Postgres instance on your server, brand files sit in storage, and the provider keys sit in the project settings, with API_KEY_SECRET in .env encrypting every stored secret and connector credential.

Four things stay off the box.

• Sandboxes. "Sessions run on Platinum sandboxes, not on the server. The instance must be reachable from the internet so those sandboxes can call back."
• Images. kortix/kortix-frontend, kortix/kortix-api and kortix/kortix-gateway come from Docker Hub, and the pulls need no credentials.
• Model providers. The gateway calls the providers each project connects, and "A self-hosted instance has no Kortix-managed models."
• DNS. Caddy gets its certificate for your domain and api.<domain> over ACME, so both names are public records before the first session runs.

That list is the honest reading of "self-hosted". The control plane and the data are yours, the machine the agent works on is created per session with a Platinum key, and every model call goes to whichever provider you connected. A team that told a client nothing leaves its own network has four lines here to correct before the campaign starts.

Where it runs is the buyer's choice. Run it on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free.

Three ways to reach it, and one that starts no session

Domain mode is the production setup: https://<domain> and https://api.<domain>, with two replicas each of the API, the gateway and the frontend behind Caddy. Tunnel mode keeps the web app on http://localhost:13737 and publishes only the API through a Cloudflare tunnel, which makes it the way to evaluate the product on a laptop. Sessions run in both.

Local mode is the one that catches people out. Every port binds 127.0.0.1, so the sandbox cannot reach the API and no session starts. It is a way to read the interface, not a way to run a campaign.

The mode also decides how much of the work reaches your tools. An agent that drafts and sends calls HubSpot, the ad account or the inbox from its sandbox, and the sandbox calls back to your instance to do it. A quick tunnel URL changes every time cloudflared restarts and breaks the OAuth callbacks you registered there, which is the reason to plan a team around domain mode and treat the tunnel as a trial.

One campaign, followed across the split

A launch note is a good test case, because it touches every part of the stack in an hour. A marketer opens a session and writes the brief. The session gets its own sandbox, a branch of the repo, and the brand voice file the repo already holds. The agent reads the last three launch notes for register, calls the CRM connector for the segment count, and drafts an email, a blog paragraph and four social variants.

Follow the data on that run. The brief, the drafts and the voice rules are in your git repo, on your server. The segment count came back through the API from a connector credential the instance held. The writing happened inside a sandbox that stops once the session goes idle. The model call went to the provider whose key the project holds, carrying the prompt the agent built from your brief and your files. Nothing in that list is hidden, and three of the four touch a machine you do not own.

The review is where self-hosting earns its keep. The drafts land as a change request, a person reads the lines that changed, and the merge is a decision with a name attached. A brand lead who wants to know why a sentence sounds off can open the same files the agent read, on the same server, and see the versions from the week the register changed.

Two kinds of credential, and only one of them stays outside

Connector credentials are brokered server-side and never enter the machine. The OAuth token behind your HubSpot, Slack or Google connection stays with the API, and the session asks for the call rather than for the value.

A runtime secret is a different object. Environment is the default exposure, so the value arrives in the session as an environment variable, and any command the agent runs can read it. If a value may have been read, rotate it. Self-hosting moves where the control plane sits. It does not change what a runtime secret is.

What does travel with a self-hosted instance is the rulebook. "Your voice, your claims and your banned words live in the repo as a skill file every session reads," and a change to them lands as a diff (the voice file). Back up the instance directory, clone the repo on another machine, and the voice your team argued about last quarter is still there.

What a marketing month costs against a hosted plan

Hosted shapes publish a platform fee. Deskferry's plans are $49, $99 and $299 a month for 5,000, 12,000 and 40,000 credits, with unlimited agents on each (Deskferry). Blueshift's plans "start at $1,250/month (billed annually)" (Blueshift). Both include the channels and apps the agent works in, and both prices were read in October 2026.

Self-hosted, that line disappears. Three costs remain, and each one is yours to check: a Linux server with a public IP, model calls billed by whichever provider each project connects, and sandbox minutes billed by Platinum, whose key you hand the instance at configure time. A sandbox stops 15 idle minutes after its last turn ends, so a month of short sessions is not the same bill as a month of sessions left open.

None of that makes the self-hosted month cheaper by default. It makes it legible: a small fixed server bill, two variable bills, and the hours one person spends on updates. Before a client asks for a number, the arithmetic on the cost page is the place to work it out.

Four checks before you commit

Write the answers down, because each one is hard to change later.

1. Where sessions run. Ask which sandbox provider is set and whether the key is in place. Without a Platinum key, sessions do not start.
2. Who can sign up. A new instance confirms every sign-up without an email. Until you set EMAIL_URL or DISABLE_SIGNUP=true, anyone who reaches the instance can create a confirmed account for any address, an admin address included. Sign up as the admin first, then close it and re-run doctor.
3. What you back up. The instance directory holds .env with every secret and signing key, volumes/db/data and volumes/storage. Stop the stack so the database files are consistent, copy the directory, then start again.
4. What the month costs. The server, the model calls, the sandbox minutes, and the person who runs kortix self-host update and reads what changed.

The fourth question is the one a comparison of hosted platforms answers from a pricing page. The first three decide whether the agent can work at all, and they are also the ones a sales deck is least likely to cover. The jobs an agent can take on once it runs are what the home page covers.