Can you run AI code review without sending code to the cloud?

Q: Why do so many vendors put self-hosting behind an enterprise tier?

Self-hosted deployment costs vendors more to support and is usually bundled with enterprise contracts and seat minimums. The practical effect is that a small team in a regulated industry often cannot buy the deployment model it is required to use. Gatekeep prices self-hosting as a flat product instead.

Yes. Several AI code review tools run entirely inside your own infrastructure, and a few can run fully air-gapped with no outbound internet at all. The catch is that "self-hosted" means at least three different things depending on the vendor, and only one of them actually keeps your source code off third-party servers.

That distinction is the whole article. If you are buying for a regulated environment, it is the only thing that matters.

Key takeaways

Self-hosted AI code review is real and available today, from open-source projects and commercial vendors alike.
The phrase is used loosely. Some tools self-host the interface but still send your code to a vendor API to do the actual review.
The question that separates them: where does model inference happen, and who operates that endpoint?
Bring-your-own-LLM is what makes air-gap possible. A tool that bundles a model you cannot swap is a tool you cannot run offline.
Self-hosting solves data residency. It does not, on its own, produce audit evidence. Those are different problems.

What does self-hosted actually mean?

Vendors use one word for three different architectures. Before any demo, work out which one you are being sold.

What runs where	Code leaves your network	Air-gap possible
Self-hosted app, vendor's model API. You run the container, but every review calls the vendor's cloud endpoint.	Yes, on every review	No
Self-hosted app, your model API key. You run the container and point it at a provider you contract with directly.	Yes, to your chosen provider	No
Self-hosted app, local model. You run the container and the inference, typically via vLLM or Ollama.	No	Yes

Only the third row survives an air gap. The first row is the one that surprises people, because the deployment diagram looks on-premise while the data flow is not.

Ask a vendor one question and the ambiguity collapses: if I block all outbound traffic from this container, does a review still complete?

Which AI code review tools can be self-hosted?

As of July 2026 the practical options fall into three groups.

Open source, self-host free

Several open-source reviewers can be deployed via Docker or CI and pointed at a local model runtime, which means code never has to leave your network. This is the most common starting point for teams whose only constraint is data isolation. What you take on is operational load: you own the deployment, the upgrades, and any policy and evidence logic you build on top.

Commercial, self-hosting behind an enterprise tier

Most established vendors do offer self-hosted deployment, but gate it behind Enterprise plans with custom pricing and, in some cases, substantial seat minimums. If you are a twenty-person team in a regulated industry, this is where the search usually stalls. The deployment model you are required to use is bundled with a contract sized for someone else. We went through the options tier by tier in CodeRabbit alternatives for teams that cannot send code to the cloud.

Purpose-built for the constraint

A smaller group treats self-hosting as the default rather than the enterprise upsell. Gatekeep is in this group. It runs in your VPC or on bare metal, brings your own LLM including fully local inference, does not phone home, and is priced as a flat product rather than a negotiation.

Why bring-your-own-LLM is the load-bearing feature

Self-hosting the application is the easy half. The review itself is a model call, and that call is where your code actually travels.

A tool that bundles one specific model, or supports only one hosted provider, has already made the air-gap decision for you. A tool that treats the model as configuration lets you decide. You can point it at a commercial API while you evaluate, then move to a local model on your own hardware when compliance asks, without changing tools.

In practice that configuration is a few lines. Here is the shape of it in Gatekeep:

llm:
  # OpenAI-compatible endpoint. Works with vLLM, Ollama (/v1),
  # Azure OpenAI, Bedrock/LiteLLM gateways. No provider-specific code.
  base_url: http://vllm.internal:8000/v1
  api_key_env: LLM_API_KEY     # optional; blank for keyless gateways
  model: qwen2.5-coder-32b-instruct
  temperature: 0.1
  max_tokens: 2000
  timeout_s: 90

Point base_url at vLLM or Ollama on your own hardware and nothing leaves the building. Point it at a commercial endpoint and it behaves like any other hosted reviewer. Same tool, different trust boundary, one config change.

On sizing, our guidance is that a code-tuned model in roughly the 30B parameter range is a reasonable starting point for review quality. That is directional guidance from our own testing, not a benchmark claim.

Is self-hosted the same as compliant?

No, and this is the part teams discover late, usually during an audit.

Running the reviewer inside your network solves data residency. It does not produce evidence. Most AI review tools post findings as pull request comments. Comments are advisory, they can be resolved and forgotten, and the record of who decided what lives in a git host's activity log that was never designed to be an audit artifact.

An auditor asking "show me that AI-generated code in this release was reviewed" is really asking for three things a comment thread cannot provide:

That a check actually ran on that specific change.
That a failing check blocked the merge rather than merely commenting.
That any override was authorized, justified in writing, and recorded somewhere tamper-evident.

That gap is why Gatekeep's merge gate blocks rather than advises, and why every decision and override lands in an append-only, hash-chained log rather than a comment thread. The chain's validity is exposed as an X-Audit-Chain-Valid response header, which doubles as a restore-integrity check after a backup.

You can watch the whole sequence in our published demo transcript: context injection, five findings, the gate returning BLOCKED, two overrides denied, one granted with a written justification, then a hash-chain verification. It is the verbatim output of a real offline run, and the page is explicit about which parts are mocked.

An honest caveat

Self-hosting and an audit trail are necessary, not sufficient. No tool makes you SOC 2 or HIPAA compliant, and Gatekeep is not SOC 2 certified. Coverage completeness also depends on you requiring the check in branch protection on every protected branch. The tool provides the control; proving it ran everywhere is a configuration you own. For more on what a trail has to contain, see what an AI code review audit trail must prove.

What should I ask before buying?

Six questions, in the order that eliminates options fastest.

If I block outbound traffic from the container, does a review still complete?
Can I swap the model, including to one running on my own hardware?
Is the review advisory, or can it block a merge?
When someone overrides a block, what is recorded, and where?
Can I export that record in a form an auditor will accept?
What is the smallest team size you will sell this deployment to?

Question six ends more evaluations than the other five combined. If you want the comparison in detail, we maintain sourced write-ups of Gatekeep versus CodeRabbit, versus Qodo and versus Greptile, each with an honest section on when the other tool is the better choice.

Going deeper: once you have decided self-hosting is the right call, what it actually takes to self-host AI code review covers the implementation side, compliance perimeters, the BYO-LLM landscape, and what to demand from a vendor before you deploy.

Frequently asked questions

Is self-hosted AI code review actually private, or just marketing?

It depends entirely on where model inference happens. A self-hosted application that calls a vendor's model API still transmits your code off your network on every review. The privacy property comes from running the model yourself, which requires a tool that lets you configure the model endpoint.

Can AI code review run fully air-gapped?

Yes, if the tool supports a local model runtime such as vLLM or Ollama and does not require outbound calls for licensing or telemetry. Gatekeep runs air-gapped and does not phone home. Verify licensing behaviour specifically, since that is a common hidden outbound dependency.

What model should I run locally for code review?

A code-tuned model in roughly the 30B parameter range is a reasonable starting point on typical hardware. Smaller models tend to produce more false positives on nuanced findings. This is directional guidance from our own testing, not a published benchmark.

Does self-hosting satisfy SOC 2 or HIPAA on its own?

No. Self-hosting addresses data residency and transmission. Audit frameworks additionally ask for evidence that a control operated, which means a blocking gate and a durable, tamper-evident record. Those are separate capabilities from the deployment model.

Is open-source AI code review good enough?

For data isolation alone, often yes. An open-source reviewer self-hosted with a local model keeps code inside your network at no software cost. What you take on is operating it and building the policy and evidence layer yourself, which is the work teams tend to underestimate.

Why do so many vendors put self-hosting behind an enterprise tier?

Self-hosted deployment costs more to support and is usually bundled with enterprise contracts and seat minimums. The practical effect is that a small team in a regulated industry often cannot buy the deployment model it is required to use. Gatekeep prices self-hosting as a flat product instead.

The short version

You can absolutely run AI code review without sending code to the cloud. Just be precise about which version of self-hosted you are being sold, because the deployment diagram and the data flow are not the same picture. Insist on configurable model inference, then check whether the tool produces evidence or only opinions. Those two properties, together, are what a regulated team actually needs.