Where it runs, and what that asks of you.

Our cloud

We run it. The database is in the European Union (Finland), and secure connections end at our gateway in France, also in the EU; if yours must be held somewhere else, a dedicated instance (option 02) runs in the region you need. Updates, backups and monitoring are ours; the only thing your IT function has to do is decide who gets an account.

You provide

Nothing beyond your users.

Suits

Most operators, and every evaluation — start here and move later if you need to.

A dedicated instance

We still run it, for you alone: your own stack, database, backups and upgrade window, in the region your data must be held. Operating it is ours, as in option 01; what changes is that the application stack and its database serve no other customer. Dedicated pricing.

You provide

Nothing beyond your users, and the region the data must stay in.

Suits

Residency or contractual requirements, without running servers yourself.

Inside your estate

Cargovate runs on your own servers under license, as a small set of containers alongside a PostgreSQL database. It is delivered as a signed release bundle: your team verifies the signature, loads it, and starts it. Upgrades are the same bundle. A failed upgrade can return to the previous version of the application, but database changes it had already made stay, so the backup you take before upgrading is the way back.

You provide

A Linux host with a container runtime, and somewhere to keep backups.

Suits

Organizations whose data cannot sit with a third party.

No network path at all

The same bundle, transferred on removable media. Once running it needs no network path out: the license verifies offline, nothing reports to us, and our source makes no outbound calls except to destinations an operator configures, enforced at build time. That check covers our own code, not the open-source libraries beneath it, so the isolation itself is something your security team verifies from outside rather than takes on trust, which is the point of it.

The functional cost is small and worth stating: features that inherently reach outside — carrier tracking feeds and email notification — are unavailable because there is nowhere for them to reach. The browser reaches nothing outside the site once the installation is set to offline (CARGOVATE_OFFLINE=1): fonts are part of the bundle, and maps draw a world outline served locally (countries and coastlines, not streets), or your own tile server if you run one.

You provide

A host, and a person to carry the media.

Suits

Regulated supply chains, such as aerospace and pharmaceutical manufacturing, and sites where outbound network access is prohibited outright.

What does not change

The license is the same whichever way you run it: the core, plus the modules you hold. An air-gapped installation is not a different product on different terms — it runs the same code from a signed bundle you copy in. No deployment requires a blockchain. Anchoring, which will let a third party verify a record independently, is not yet available on any deployment; without it every record, audit entry and custody handover is still kept.

Nor does any deployment phone home to stay alive. Software that stops working when it cannot reach its vendor is not something a regulated site can accept, and we do not ship it.