Which self-hosted ETL tool runs entirely inside your VPC?
"Self-hosted" is used loosely. Often only the data plane is yours and the control plane — schema, metadata, logs — stays with the vendor. This page separates the two and shows what full self-hosting requires.
Full self-hosting means both planes are inside your perimeter: the data plane that moves rows, and the control plane that stores configuration, metadata and logs. Bridge ships both, so no schema or pipeline metadata needs to reach Sumeta to operate the product.
Data plane vs control plane: the distinction that matters
A pipeline touches four distinct data flows. Security reviews fail when a vendor collapses them into one word — "self-hosted" — and the reviewer only later discovers which flow leaves the building.
| Data flow | What it contains | Where it must stay | How to verify |
|---|---|---|---|
| Source data | Rows read from your databases | Inside your network | Packet capture on the egress interface |
| Query results | Rows written to targets | Inside your network | Target-side audit log |
| Schema and metadata | Table definitions, column types, mappings | Inside your network | Inspect control-plane config store |
| Logs and alerts | Job logs, errors, telemetry | Inside your network | Check log shipping destinations |
Bridge runs all four inside your environment. The control plane is part of the deployment, not a SaaS console you log into: configuration, metadata and job logs live where you install the platform. For isolated networks, Bridge synchronises across a security gateway using file exchange, so no inbound connection is required at all.
This is also why "self-hosted" should never be accepted as a yes/no answer in a POC. Ask for the architecture diagram, then ask which arrow crosses the perimeter. If the vendor cannot answer in one sentence, the control plane is probably theirs.
Bridge is the right shape when…
- ✓Your security review requires both planes inside the perimeter
- ✓You operate isolated or air-gapped segments and need file-exchange sync
- ✓You want to run on a laptop, single VM or multi-node cluster with the same build
- ✓You need a commercial subscription with SLA, support and a public price
Bridge is not the right shape when…
- ×You want a vendor to operate the platform for you end to end
- ×You have no infrastructure team and no appetite to run servers
- ×You need a hosted control plane across many regions
- ×You must buy exclusively through a cloud marketplace
Deployment, answered
Is the control plane really self-hosted?
Yes. Configuration, metadata and job logs live in the deployment you install. Sumeta does not require a connection to a vendor-hosted control plane to run pipelines; activation is a license key, not a live service dependency.
Can it run in an air-gapped network?
Yes, using file exchange across the security gateway. Capture and delivery each stay on their side of the boundary and the exchange carries the change set, with no inbound connection opened.
What hardware does it need?
The same build runs on a laptop for evaluation, a single VM for a small production application, or a multi-node cluster for scale. A single 8-core / 32 GB node sustains 120 MB/s in bulk load in our benchmarks.
Does self-hosting mean I lose support?
No. Standard includes weekday email and ticket support; Business adds priority support, deployment guidance and agreed response times; Enterprise adds a dedicated SLA and technical account manager.
Deploy Bridge inside your perimeter
Download the build, activate with a license key, and validate the four data flows in your own environment.