Self-hosted governance for infrastructure as code

The sovereign, AI control plane for infrastructure as code

Every change is validated, planned, policy-checked and priced, then stops at a gate until a named human approves it. AI can propose anything and apply nothing, and every run is recorded.

The sovereign, self-hosted control plane for Terraform, OpenTofu, Pulumi, Bicep and CloudFormation: policy gates, live cost estimates and a named human approval on every change, with a full audit trail.

Get started · Read the docs

See InfraOrcinus in action

A walkthrough of a governed run, from plan to approval to the audit record.

Watch on YouTube

Most teams are running one of two broken setups.

Either anyone with cloud keys can apply from a laptop, or infrastructure got bolted onto generic CI and every team’s pipeline became a different, unaudited snowflake. InfraOrcinus replaces both with one path.

~~Anyone with a laptop and cloud keys can run apply~~ → One governed execution path for every run, wherever it starts
~~Compliance checked after the fact, in a quarterly audit~~ → Policies block non-compliant plans before anything is provisioned
~~"Who changed this, and why?" means spelunking CI logs~~ → Every state change lands in an append-only audit trail
~~Cloud spend discovered on next month’s invoice~~ → Cost impact priced from live retail rates, on the plan, before apply
~~Cloud credentials pasted into chat and CI variables~~ → Secrets encrypted at rest with AES-256-GCM, scoped per stack
~~Every team’s pipeline is a different, unaudited snowflake~~ → UI, GitOps pull request or API token - all one pipeline

AI proposes. Policy checks. A named human approves. Every run is recorded.

Each engine keeps its native lifecycle. InfraOrcinus adds the same governed path around all of them: the run stops at the approval gate, and nothing applies until a second person says yes.

Validate - Check the change Syntax and configuration are validated in a throwaway runner container before anything is planned.
Plan - Diff, policy and cost The plan is computed, checked against your policies and priced from live retail rates. Mandatory rules block it here.
Approve - A named human decides The run stops and waits. A person with the right role reviews the exact plan and approves it; the server re-checks that role at the click.
Apply - Apply what was approved Only the approved plan is applied, and the run, the approver and the outcome land in the audit trail.

Pick the engine. Keep the governance.

Policy, cost, drift and audit sit above the engine, not inside it. Switching engines does not mean rebuilding your guardrails, or running a second platform beside the first.

Terraform - Stable The default. Full lifecycle, managed or bring-your-own state.
OpenTofu - Stable Drop-in: same HCL, same modules, same managed state backend.
Pulumi - Beta TypeScript, Python, Go, .NET or Java against your own backend.
Bicep - Beta Azure's native infrastructure as code language.
CloudFormation - Beta AWS's native infrastructure as code language.

Platform layers

Governance - Runs on every plan, on every path in Policy as code, Cost estimation, Approvals, Drift detection, Audit trail
Control plane - One path, whether a run starts from a person, a pull request or a token Blueprints, Stacks, Runs & approvals, AI agent, RBAC & tenancy
Engines - Chosen per stack - the layers above do not change Terraform, OpenTofu, Pulumi, Bicep, CloudFormation
Your infrastructure - Your accounts, your state, your network AWS, Azure, Google Cloud, Your state backend

Governance that runs before the damage, not after

Guardrails only work when they are automatic. Every run takes these in order, on every path into the platform - UI, pull request or API token.

On plan - Policy as code Built-in rules need no Rego at all. When you need more, bring full OPA policies. Advisory rules warn; mandatory rules block. A non-compliant plan never reaches apply
On plan - Cost before commit Every plan is priced from live Azure retail rates rather than a stale table, so spend is visible while the change can still be rejected. A five-figure surprise is caught in review
Before apply - Human approval gate Destructive applies stop and wait for a person. The approval, the approver and the exact plan it applied to are recorded together. Nothing destructive proceeds unattended
After apply - Drift detection Scheduled scans compare real infrastructure against declared state, so you hear it from InfraOrcinus rather than from an outage. Reality and state cannot quietly diverge

The AI is inside the control plane, not bolted on the side

Most tools add a chat box. InfraOrcinus gives the agent real tools, scoped to the caller’s own permissions, and one hard rule that never bends.

The agent may

Diagnose a failed run - Reads the run, the step logs and the plan, then names the root cause and the specific fix - instead of handing you a stack trace to interpret.
Write a blueprint from a sentence - Describe what you want and it authors the Terraform - resources, typed variables, outputs and a README - validated before it reaches you.
Propose a fix - Every suggestion arrives as a confirmation card. It stays a proposal until a person accepts it.
Run on a model you host - Azure OpenAI, OpenAI, Anthropic or a self-hosted Ollama model, switched from the admin UI without a restart.

The agent may never

Apply a change by itself - Nothing mutates until a human with the right role clicks it, and the server re-checks that role at the moment of the click - not when the page was rendered.
Exceed the permissions of whoever asked - The agent runs with the caller’s own scope. It cannot reach a stack, secret or organization that the person driving it could not reach alone.
Cross a tenant boundary - Organizations scope every resource. There is no query the agent can construct that returns another tenant’s stacks, modules or secrets.
Send your prompts off your network - Point it at a local model and the whole loop - prompt, plan and response - stays inside infrastructure you operate.

Your infrastructure, your data, your model.

InfraOrcinus is self-hosted. There is no vendor-operated datastore: you choose where it runs, where its data lives and which model it talks to.

Runs where you run it - Docker Compose, a single binary with a setup wizard, or replicas behind a load balancer. Console, API, runners and PostgreSQL stay inside your network.
Residency you control - All application data lives in the PostgreSQL 15 instance you configure, so you pin it to the region your obligations require, for example EU-only.
Bring your own model - Azure OpenAI, OpenAI, Anthropic, or a self-hosted Ollama or OpenAI-compatible runtime. With a local model, prompts and plans never leave your network.
State and secrets stay yours - Use the built-in encrypted state backend or your own S3, Azure Storage or GCS bucket. Credentials are encrypted with AES-256-GCM, or kept in Vault.

Built for the security review you have not had yet

Tenancy, secret handling and the audit trail were designed in at the start. Retrofitting any of the three is the expensive kind of rework.

Encryption at rest - Cloud credentials and Terraform state are encrypted with AES-256-GCM. If encryption cannot be performed the operation fails rather than falling back to plaintext.
Audit trail - Every state-changing action is recorded permanently and queryably: who, what, when, and which run it belonged to. Append-only.
Identity - SAML single sign-on with SCIM provisioning keeps platform access in step with your identity provider. Roles are enforced server-side on every request.
Tenant isolation - Organizations scope every resource. A tenant cannot see, reference or run another tenant’s stacks, modules or secrets.
Execution - Each step runs in a throwaway container destroyed afterwards, so nothing leaks between runs. Injected values are shell-quoted and JSON-encoded, never interpolated.
Data rights - Export, erasure, retention windows and data-residency controls are part of the platform rather than a bolt-on request queue.

The parts a platform team would otherwise build twice

Everything here is configured in the UI. No config file edits, and no restart to turn a feature on.

Managed or bring-your-own state - State Engine Use the built-in versioned, locking state backend, or point a stack at your own Azure Storage, S3 or GCS bucket.
GitOps from pull requests - Git Automation A pull request gets a speculative plan; a merge triggers a gated run. Same policies, same approvals, same audit trail as the UI.
Observability & AI Tracing - Telemetry & Traces Prometheus metrics, OpenTelemetry traces, structured logs, and a Grafana dashboard. Native OTLP GenAI semantic conventions stream agent reasoning directly to Langfuse.
Notifications that reach people - Event Dispatch Slack, Microsoft Teams, email and signed webhooks for job and drift events.
Scoped API tokens - Zero Trust Tokens for CI and automation, scoped and revocable, funnelling into the same governed pipeline as every other path in.
HA and disaster recovery - Resilience Health probes, multiple replicas, PostgreSQL backup and restore, and a documented DR runbook.

Rolling it out across an organisation?

Talk to the team about a pilot, your identity provider, high availability or the evidence your auditors need. We will scope it with you, on your infrastructure.

SAML single sign-on and SCIM provisioning
Tenant isolation with organisations and roles
HA replicas, PostgreSQL backup and a DR runbook
Signed evidence bundles for change plans

Talk to the team

Four people have to say yes. This is their answer.

Platform engineering - A self-service path that scales Publish approved blueprints once. Product teams provision from them without raising a ticket or copying a .tf file from someone who has left.
Security and compliance - Evidence instead of assurances Policies enforced at plan time, secrets encrypted and scoped, and a permanent audit trail that answers "who changed this?" without a log hunt.
Engineering leadership - Speed that does not trade against risk Guardrails are automatic rather than a manual gate teams route around, so infrastructure changes get faster to make safely.
Finance and FinOps - Cost visible before it is spent Plans priced from live retail rates, so a change with a five-figure monthly impact is caught in review rather than on an invoice.

Frequently asked questions

Technical and architectural questions answered live by AI. Click any question to expand and generate an authoritative answer derived directly from our official platform documentation.

IaC Engines - Which Infrastructure as Code engines does InfraOrcinus support, and how does governance stay unified? Stacks & Engines InfraOrcinus provides first-class support for **Terraform**, **OpenTofu** (the community-driven, MPL-licensed drop-in replacement), **Pulumi** (supporting TypeScript, Python, Go, C#/.NET, and Java), **Bicep**, and **CloudFormation**. Governance - including OPA policy guardrails, live cloud cost estimation, human approval gates, and append-only audit logging - sits **above** the engine in the control plane. Switching or mixing engines across stacks never requires rewriting compliance policies or managing siloed delivery pipelines.
Workflow & Safety - How does the Plan and Approve workflow work, and can an AI agent bypass the human approval gate? Jobs & Approvals Every infrastructure change follows a strict 4-stage pipeline: 1. **Validate**: Verifies IaC syntax and structural configuration. 2. **Plan**: Calculates resource diffs (create, update, delete), evaluates OPA Rego policy guardrails, and queries live retail cloud pricing APIs for monthly cost deltas. 3. **Approve**: A named human reviewer inspects the plan diff and clicks **Approve** in the console. Nothing can be provisioned until this gate is passed. 4. **Apply**: Executes the approved plan inside a disposable, isolated Docker runner. **Architectural Guarantee**: An AI agent may propose changes and trigger plans, but it has **no permission or mechanism** to approve or apply changes. The human approval gate is enforced by the control plane.
Comparison - How does InfraOrcinus compare to Terraform Cloud, Spacelift, or Atlantis? Getting Started InfraOrcinus is a **sovereign, self-hosted enterprise infrastructure delivery platform** built with key distinctions: - **True Engine Freedom**: First-class support for Terraform, OpenTofu, Pulumi, Bicep, and CloudFormation without vendor lock-in. - **Built-in Governance**: Native OPA policy guardrails, live retail cloud pricing estimation, and an append-only audit log are core platform features rather than expensive enterprise add-ons. - **Sovereignty & Privacy**: Completely self-hosted on your own infrastructure or private VPC. State files, cloud credentials, and local AI prompts (powered by Hanuvan Local AI) never exit your network boundary.
Security & Secrets - How are cloud credentials (AWS, Azure, GCP) encrypted and injected into runs? Credentials & Secrets Cloud credentials (AWS IAM role ARNs/keys, Azure Service Principal credentials, GCP Service Account JSON keys) are encrypted at rest with **AES-256-GCM** using encryption keys stored outside the database. Credentials are: - Strictly scoped per stack or project. - Injected ephemerally into disposable Docker runner containers only at run time in memory. - Never written to runner disk, never committed to Git, and masked from all console logs and API outputs.
State Management - How does state management work? Do we have to migrate our existing Terraform state? State Backends No migration is required. InfraOrcinus offers flexible state backend options: - **Built-in Managed PostgreSQL Backend**: Encrypted state storage with automated distributed state locking and versioned snapshots on every run. - **Bring Your Own Remote State**: Native support for external remote backends including AWS S3 with DynamoDB locking, Azure Blob Storage, and Google Cloud Storage (GCS). You can keep your existing state buckets intact while adopting InfraOrcinus for orchestration and policy governance.
Deployment & Sovereignty - Can InfraOrcinus run fully self-hosted in air-gapped or private VPC environments? Security & Sovereignty Yes. InfraOrcinus is designed sovereign-first for on-premises datacenters, sovereign clouds, and private VPCs. The entire stack - web console, API control plane, PostgreSQL database, and Docker runner agents - runs entirely within your private perimeter. For AI assistance, InfraOrcinus connects to local on-premise inference engines powered by **Hanuvan Local AI**, guaranteeing that zero prompts, infrastructure blueprints, or configuration state leave your network.
Guardrails & FinOps - How do OPA policy guardrails and live cloud cost estimation work together? Policies & Guardrails During the **Plan** step of every run, two automated checks execute concurrently before human approval: - **Open Policy Agent (OPA) Guardrails**: Evaluates the plan JSON against Rego rules (e.g. enforcing required tags, disallowing unapproved regions, blocking unencrypted disks). Violations immediately block the run. - **Live Cost Estimation**: Queries cloud retail pricing APIs (such as Azure Retail API and Infracost) to compute exact monthly cost deltas (e.g. +$128.40/month). Both the policy verdict and expected cost impact appear side-by-side on the diff summary before a human signs off.
GitOps & Identity - Does InfraOrcinus support GitOps workflows and enterprise SSO (SAML / SCIM)? GitOps & Webhooks Yes. InfraOrcinus integrates directly with enterprise development and identity tooling: - **GitOps Webhooks**: Integrates with GitHub, GitLab, and Bitbucket. Opening or updating a pull request triggers automated speculative plans and posts diff summaries directly as PR comments. Merging applies the change through the governed lifecycle. - **Enterprise SSO**: SAML 2.0 and OIDC support for Okta, Microsoft Entra ID (Azure AD), Google Workspace, and Keycloak. - **SCIM 2.0**: Automated user provisioning, deprovisioning, and team group synchronization.

Two channels in. Same person on the other end.

Pick one below. It opens your own mail client with the message already addressed and filled in - nothing is collected on this page.

Inquiry - inquiries@hanuvan.com
Feedback - feedback@hanuvan.com

Run it yourself. Nothing leaves your network.

InfraOrcinus is self-hosted. Your state, your credentials and, if you point it at a local model, your prompts all stay inside your own infrastructure.