Blackfyre is open source under Apache-2.0 — the entire platform, all 55 auditors, 9 frameworks and 678 controls. Evaluate it locally on Docker Compose with no cloud account or keys, or deploy it to your own AWS. No seats, no feature gates, no expiry.
What self-hosting gets you
$0
To run
55
Auditors
9
Frameworks
678
Controls
No cloud account
The whole stack runs locally on Docker Compose — Postgres, Redis and LocalStack.
No API keys
AI features degrade to deterministic heuristics when no key is set.
No seats or gates
Every one of 55 auditors, 9 frameworks and 678 controls — unlocked.
Your infrastructure
Deploy the backend into your own AWS account via SST when you're ready.
Runs on
The full local stack — no cloud account or API keys. Clone, start the services, run the migrations, and log in as the seeded dev user. Roughly fifteen minutes.
# Full local stack — no cloud account or API keys needed.
$ git clone https://github.com/blackfyre-security/blackfyre.git
$ cd blackfyre/platform
$ docker compose up -d postgres redis localstack
$ npm install && npm run build
$ cp packages/api/.env.example packages/api/.env # edit per the local-dev guide
$ npm run db:migrate && npm run dev # API on :4000
# Then in two more terminals:
$ NEXT_PUBLIC_API_URL=http://localhost:4000 npm run dev --workspace=packages/portal # :3001
$ NEXT_PUBLIC_API_URL=http://localhost:4000 npm run dev --workspace=packages/admin # :3003
# Log in at http://localhost:3001 — seeded dev user admin@acme.com / password123
No cloud account or API keys needed · prerequisites: Node 20, Docker + Compose, Git.
Both tiers run the exact same open-source codebase. Start on your laptop for free, move to your own cloud when you're ready.
$0
to run
A · Local / evaluation
Bring the whole stack up locally — Postgres, Redis and LocalStack — with no AWS account and no API keys. Seeded dev login admin@acme.com / password123. Ideal for evaluating, developing, or contributing.
Setup
~15 min
Cost
$0
Cloud
None
SST
your aws
B · Production · your AWS
Provision the backend into an account you own — Lambda, RDS (Postgres 16), SQS (4 + 4 DLQ), S3 Object Lock, KMS, Secrets Manager and ECR — with static portal & admin on Cloudflare Pages. 11 SST-managed secrets per stage. Self-provisioned: the project doesn't run a managed cloud with SLAs.
Staging
~$56/mo
Prod idle
~$80/mo
Secrets
11/stage
You provision production into your own AWS + Cloudflare accounts — rough idle costs, not a managed service. See the deployment guide
Verified ~15-minute local setup (Docker Compose Postgres/Redis/LocalStack + API/portal/admin via npm), seeded dev logins, worker pollers, reset flow, and real troubleshooting. No cloud account or API keys needed.
The two deployment tiers side by side: local/evaluation via Docker Compose (free) vs production on your AWS account via SST (what gets provisioned, secret setup, deploy + migrate steps, stage semantics, and rough monthly costs).
Single-page deployment topology: three sized-alike stacks (demo/staging/prod), static frontends on Cloudflare Pages, backend on AWS Lambda + RDS + SQS + S3 via SST, why the shape, and the key infra invariants (e.g. frontends stay static exports).
Every environment variable and the 11 SST secrets: what each is for, whether it's required/optional, safe ways to generate local values, and which features gracefully no-op when a secret is left blank.
How code reaches each environment for a self-hoster: the CI/CD pipeline shape (preferred) and manual laptop deploys (fallback) to your own AWS + Cloudflare accounts.
Apache-2.0 and free forever to self-host — up and evaluating locally in about fifteen minutes, then deploy to your own AWS when you're ready.