Launch Cloud App
Self-Hosted & Air-Gapped Deployment Portal

Host Bowtie RISK on Your Own Network

Run the standalone, App-Only Bowtie RISK server on your corporate intranet, private cloud VPC, or air-gapped industrial network. Generate your cryptographic license file below and manage automatic or offline system updates.

1. Download Your On-Premise License File / Key

Every self-hosted instance verifies a cryptographically signed license locally (zero outbound "phone-home" traffic required).

🔒 Required to Create or Edit Bowties: Without a valid license file (.btlic) or key activated in the Admin Console, a self-hosted instance operates in Read-Only Mode—users can view existing diagrams, but creating new Bowtie diagrams or editing existing ones is disabled.
✓ Cryptographic On-Premise License Issued!

Your .btlic file download has started. You can either upload the .btlic file or paste the single-line key below in your server's Admin Console → License & System Updates:

2. App-Only Self-Hosting Instructions

Self-hosted instances run in App-Only Mode (BOWTIE_MODE=onprem)—serving the Bowtie RISK workspace directly at / without the promotional website.

1 Deploy with Docker Compose (App-Only)

Download docker-compose.onprem.yml or run the container with a persistent volume:

docker run -d --name bowtierisk-onprem \
  -p 8080:8080 \
  -e BOWTIE_MODE=onprem \
  -e DATA_DIR=/app/data \
  -v /srv/bowtierisk/data:/app/data \
  --restart unless-stopped \
  ghcr.io/frogsmack/bowtierisk:latest

2 Register the Initial Instance Administrator

Open http://your-server-ip:8080 in your browser. The first user account to sign up on a fresh installation is automatically promoted to Instance Administrator.

3 Activate Your License File or Key

Click the Admin tab in the top bar, scroll to On-Premise License & System Updates, and upload your bowtie-license.btlic file (or paste the BTRISK-v1... key). Full diagram creation and editing unlock immediately.

3. System Updates: Automatic Online & Air-Gapped Offline Packages

Keep your self-hosted Bowtie RISK instance up to date whether your server has outbound internet access or operates on a strictly isolated industrial network.

âš¡ Connected Servers: Automatic Online Updates

In your instance's Admin Console → License & System Updates, toggle Automatic Online Updates to ON. Your server will verify cryptographic SHA-256 signatures from our release feed and apply updates automatically (with an automatic pre-update backup of bowtie.db and workspace.json).

Release Feed Endpoint: https://bowtierisk.com/api/releases/latest

📦 Offline / Air-Gapped Servers: Import Update File

For air-gapped networks without internet access, download the signed .btupdate bundle below on an internet-connected workstation, transfer it via USB/bastion, and upload it in Admin Console → Import Offline Update File.