Your architecture map shouldn't live in someone else's cloud.

An architecture model lists every system, every database and every weak spot you have. Keystone runs on your servers, so that list stays with you.

Request access See every feature

$ docker compose up -d
 ✔ postgres  Healthy
 ✔ api       Started  migrations applied
 ✔ web       Started  :8080
$ curl -s localhost:3000/ready
{"status":"ready"}

Three containers, one database

Nothing exotic. Postgres holds everything; use the bundled container or your own. The API applies database migrations when it starts, so an upgrade is "pull the new image and restart". The web app is static files behind nginx.

Put your usual TLS proxy in front and set KEYSTONE_SECURE_COOKIES so sessions only travel over HTTPS. Health and readiness checks are there for your load balancer, logs come out as JSON, and backup and restore scripts are included.

Keystone Landscape Map showing the whole landscape as an isometric board — The same Keystone, running on your own hardware.

Security your team will sign off on

SAML and OIDC: Connect any SAML 2.0 or OIDC identity provider. Accounts are created on first sign-in, and IdP groups map to Keystone roles.
Roles and access: Admin, editor and viewer roles, access limited to chosen landscapes, and objects only their owning team can edit.
Hashed secrets: Passwords, session tokens and API keys are stored as hashes. A database dump holds no live logins.
Locked-down sign-in: Login, sign-up and password reset are rate-limited. Close public sign-up if you only want invited users.
Sharing off by default: Share links only work once an admin turns them on. Each can have a password and can be revoked.
Signed webhooks: Every delivery carries an HMAC-SHA256 signature and timestamp, so receivers can reject fakes and replays.
Audit log: Every create, change, delete, import and export in a landscape, with who did it, person or API key.

Your data stays portable

Self-hosting only helps if you can leave. Export the whole model as JSON, CSV, Markdown or HTML at any time, and diagrams as PNG, SVG or PDF. Import YAML or JSON, or drive Keystone from your own scripts through the REST API.

Data-residency rules: Finance, health, government, or anywhere the data has to stay put.
No third-party SaaS: When you can't send an inventory of internal systems to someone else.
Already on Docker and Postgres: No new vendor contract, no new kind of infrastructure.
SSO without the upgrade: SAML and OIDC come with every install.

Your architecture map shouldn't live in someone else's cloud.

Three containers, one database

Security your team will sign off on

Your data stays portable

Run Keystone on your own servers.