Actahost

Acta · Credentialing and Service Station with AI, self-hosted

Run services and audit AI agents inside your own infrastructure.

Talk to us See pricing

  • Offline licence
  • Verifiable signature
  • Your own AI keys
  • Transmits nothing to us

Acta · Agent runtime · Your data · Your AI keys

  • Credential issuance

    Generates and prints credentials with QR codes for internal access control. You configure the layout, fields and rules, and the identity records stay on your network.

    documentsQR code

  • AI video call session

    Video between two browsers, with the signalling server inside your own deployment. Audio and video go straight from one participant to the other, with no third-party relay.

    videoP2P

  • AI audio transcription

    Turns session or file audio into text with the AI transcription model built into the binary (Whisper-class), running in your environment. No external provider and no outbound call.

    audiotext

  • Literature research agent

    Searches open-access scientific databases and the documents you index in your own environment, ranks by relevance and shows the terms behind each match.

    referencessearchlocal documents

  • Model connectors

    We implement the connector to your model provider inside your own deployment: OpenAI, Anthropic, Google Gemini, others — or a model running in your own environment, with no external provider at all. The credentials stay yours, and switching provider does not change the rest of the installation.

    modelsAPI

Your environment

Your licence key enables the modules you contracted. Adding one later does not require a new installation.

Everything runs inside your environment. Content, records and metadata stay on your side.

Why run it in your own environment?

The audit is yours

Your logs and the content you process stay in your environment. We do not meter usage at all: the price is the modules you enable, times the production environments you install into. There is no counter for us to read.

Your own AI keys

You contract the model providers directly and keep their pricing, their rate limits and their terms. Switching provider is a configuration change, not a migration.

The agents run on your servers

You install it yourself, on what you already have: a laptop, a server in the office, or your own cloud account. The model is called from there, with your key.

Offline licensing

A cryptographically signed licence file, validated locally. The software never has to call us in order to run.

How it works

  1. Licence

    You choose the modules and how many production environments you will install into. We issue one signed licence file per environment.

  2. Install

    You pull the signed container image and the application package from an authenticated channel, verify the signature against what is published at /.well-known/releases.txt, and deploy them on your infrastructure.

  3. Connect

    You add your own model provider credentials (OpenAI, Anthropic, Google Gemini or another) and connect the modules to your existing platform.

  4. Run

    The agents execute in your environment, and every model call leaves your servers straight for your provider. We invoice the flat monthly fee.

Install

Pull, verify, run. Three commands, and the licence file stays on your disk.

shell 
# pull the signed imagedocker pull registry.actahost.com/acta:2.4.1# verify signature and hash before runningcosign verify \  --certificate-identity <releases.txt: Signing-Identity> \  --certificate-oidc-issuer <releases.txt: Issuer> \  registry.actahost.com/acta:2.4.1sha256sum acta-2.4.1.tar# run with your licence and your AI keysdocker run -d \  -v ./licence.key:/etc/licence.key:ro \  -e MODEL_PROVIDER_KEY=$YOUR_KEY \  registry.actahost.com/acta:2.4.1

Scroll sideways to see the full commands.

What you receive

  • Signed container image
  • Desktop application package
  • Signed licence file (offline)
  • SHA-256 of every release
  • SBOM per version
  • Deployment documentation

The registry is authenticated, and its address comes with your licence. The digest and the signing identity do not: they are published at /.well-known/releases.txt, so that the values you check against never travel in the same envelope as the artifact.

Pricing

Licensing has two factors and no others: the modules you enable, and the number of production environments you install into. There is no usage metering and no charge by volume.

Module Per environment, monthly
Credential issuance US$ 300/month
AI video call session US$ 400/month
AI audio transcription US$ 500/month
Literature research agent US$ 400/month
Above five production environments On request

The monthly total is the sum of the modules you enable, multiplied by the number of production environments.

Model connectors come with any module, at no additional charge: you connect to whichever provider you prefer, including a model running in your own environment.

What counts as an environment

A production environment is any installation serving real operation. Development, test and staging are not charged, up to three, as long as they do not process production data.

We issue one licence file per production environment, and it is not tied to hardware: you can replace, rebuild or migrate machines inside the same environment without a reissue.

We do not meter usage. The software transmits nothing to us, so there is no counter to audit — what you contract is what the contract says.

Prices in US dollars. You pay in your local currency, at the processor rate on the payment date.

Model providers and third-party services are contracted and paid by you, directly with them.

Instant transfer and international card are accepted.

Request a quote

Security

The delivery model determines the security model. Because the software runs in your environment, most controls are yours, and we state plainly which ones are ours.

Artifact integrity

Container images are digitally signed, and the signing identity with each release digest is published at /.well-known/releases.txt, outside the package you receive, so the check never depends on the same channel that delivered the artifact.

Vulnerability handling

We monitor the third-party components we ship and notify you of confirmed high or critical findings affecting your version, with mitigation and a remediation timeline. Report a vulnerability: contact@actahost.com

No production access

We hold no credentials to your environment and none to your AI providers. Support works from what you choose to export and send us, and from nothing else.

Documentation on request

A shared responsibility matrix and a full security annex are available to customers under evaluation. Request these documents.

Frequently asked questions

Does any of our data reach you?

No. The content you process, the outputs and the logs stay in your environment. Billing does not depend on usage — it is the modules you enable, times the production environments — so nothing about your usage has to reach us, and there is no counter for the software to transmit.

What leaves our network?

What leaves is the request you fire at the model provider you contracted: it goes from your servers straight to them, with your key, and does not pass through us. If that provider is a model running on your own network, nothing leaves at all. And modules that do not depend on an external provider make no outbound call either.

Is the image really the one you published?

The signing identity and the digest of each release live at /.well-known/releases.txt, served by this domain and outside the package you receive. Verify with cosign against what is published there, never against what arrived with your licence: if the trust anchor travels in the same envelope as the artifact, checking it proves nothing. No release has been signed yet, so that list is still empty.

How do we audit what the software does with our data?

The source code is not delivered, so verification is by observation, and it is yours to run. The SBOM lists every third-party component we ship. The container runs behind whatever network policy you set, and an egress allowlist permitting only your model provider shows exactly who it talks to — with a local model, that list is empty. Execution records stay in your environment.

Does it work on an isolated network?

The licence is a signed file validated locally, so the software does not need to connect in order to run. Modules that call a model provider need a route to that provider — and that provider can be a model running on your own network, in which case there is no egress at all. The remaining modules operate with no egress either way.

Do you have access to our environment?

We hold no credentials to your environment and none to your AI providers. There is no remote access. If log analysis is needed, you export the logs, review their content, and send them.

What if we need another module or another environment?

You ask, and we issue the licence file for it. Adding a module does not require a new installation; adding an environment does not touch the existing ones. Reductions take effect at the next renewal. If you signed the MSA, the change is formalised as an addendum to Annex II. The software is never interrupted over this, and there is no volume limit to exceed in the first place.

Does this run on what you have?

Tell us where you intend to deploy and which modules matter. We answer with the modules and environments that match and with the installation prerequisites on your side.

Talk to us