Activepieces Air Gapped: Cost, Requirements and Setup
Oct 23, 202616 min read
On the free Community Edition, air-gapped Activepieces costs nothing in licence fees; anything else is quoted by sales. The self-serve plans from $20 to $200 a month are priced for the managed cloud, so managed cloud is non-negotiable for self-serve at these rates.
Prices checked 23 October 2026.
Air-gapped Activepieces costs $0 for the Community Edition, or a quote
What air-gapped means here
Air-gapped means a self-hosted Activepieces deployment with no network path to the internet, the posture that FedRAMP, FISMA and many PIPEDA-driven data residency policies push you toward. The core you deploy is MIT-licensed, so the free Community Edition carries no licence fee.
You import the container images, supply the connectors and apply updates by hand.
You are not giving up features by going offline. The enterprise feature set (SSO, SCIM, custom RBAC, audit logs, release management, secret managers) comes with a paid enterprise licence, so the cost is the licence plus operational labour.
What each plan includes for an offline install
Only the sales-quoted tiers and the free Community Edition can sit behind an air gap; the Free, Plus ($20 a month) and Team ($200 a month) plans run in Activepieces' cloud, so anyone choosing one of those paid plans loses air-gap capability.
The table shows what each plan costs and includes, and whether it gives you a self-hosted route.
| Plan | Price | Included credits | Users / SSO | Extra-credit rate | Suits an air gap? |
|---|---|---|---|---|---|
| Free | $0 a month | 1,000 a month | No SSO | None listed | No, managed cloud |
| Plus | $20 a month | 10,000 a month | No SSO | $0.007 a credit | No, managed cloud |
| Team | $200 a month | 50,000 a month | 25 users, SSO | $0.007 a credit | No, managed cloud |
| Ultimate | By quote | Set in the quote | Set in the quote | Set in the quote | Yes, via sales |
| Embed | From $36k a year | Set in the quote | Set in the quote | Set in the quote | Ask sales; deployment shapes the quote |
If a Team workload outgrows its allowance, the extra cost at $0.007 a credit rises roughly in proportion to volume, so a busy cloud account is a budgeting question. For an air-gapped buyer it's mostly irrelevant, because the decision lands on a quote.
I won't guess a figure for the sales quote, which is driven by user count, credit volume, deployment model and support level.
When the Community Edition is enough
When your team needs to build and run flows inside the boundary, the free Community Edition is enough. That holds only if the team can live without SSO, SCIM, custom RBAC, audit logs, release management and secret managers.
The moment an auditor asks who changed which flow, or your identity provider must gate access, the Community Edition stops being enough. Those controls are what the paid self-hosted licence adds.
Don't cite Activepieces' SOC 2 as a certification in your own assessment; the programme is in progress.
For self-serve cloud plans, see the pricing page. For a self-hosted enterprise licence, SSO beyond Team, Ultimate or Embed, use the sales form.
Everything below works on Activepieces' free plan. Start without code or a credit card.
How an air-gapped Activepieces install works offline
Once licensed, an air-gapped install runs entirely inside your boundary, and only three things normally reach outward: image pulls, connector package downloads and calls from flows to outside services. You supply the first two yourself and the third simply stops.
Inside the boundary below sit the app, the workers, Postgres, Redis, a private image registry and your internal systems.
Docker Hub (the public container image registry), the integration registry (the public source of connector packages) and third-party cloud APIs sit outside it, each with a crossed-out arrow. Take from it that after the images and packages are loaded, nothing inside depends on anything outside.
Everything past that point is a question of which parts need feeding by hand.
Offline, the app, workers, Postgres and Redis run happily. The app serves the interface and API, workers execute flows, Postgres holds flows and run history, and Redis carries the job queue.
None of them calls out on its own. What expects the internet is the supply chain around them:
- Container images, which a default deployment pulls from Docker Hub and which you must mirror into your private registry.
- Connector packages, which are normally fetched from the integration registry and which you must supply from an internal source.
- Outbound calls from flows to cloud APIs, which have nowhere to go.
What workflows can and cannot reach
If your network lets the workers see a system, a flow can reach it: internal databases, HTTP services, file shares, ticketing and messaging tools you host yourself.
It can't reach a SaaS product or a public API, so any connector that wraps one will install fine and fail at run time.
Plan your connector list around what exists inside the gap, not what the catalogue advertises.
Where air-gapped installs are used
Wherever policy, not preference, rules out a cloud path, this pattern shows up. That means government enclaves working to FedRAMP or FISMA controls, defence and intelligence networks, and regulated healthcare and finance where data residency under rules such as PIPEDA limits what may leave.
Industrial control networks that are physically disconnected belong here too.
In each case the reader has already decided "just use the cloud API" is off the table. The question is whether automation can live inside the same boundary as the data it touches, and it can, provided someone owns the offline import work.
Activepieces doesn't give the buyers who need the most isolation a cut-down build: SSO, SCIM, custom RBAC, audit logs, release management and secret managers all come in the air-gapped edition just as they do in the managed cloud.
MoneyGram, Moneypenny, Alan and FundingSocieties run Activepieces in production, on a core that is MIT-licensed. Lay the self-hosted air-gapped docs beside the cloud feature list and the two match; what you confirm with sales is the enterprise terms, which aren't published.
Setting up Activepieces without internet, stage by stage
Expect nine steps and about half a day of offline import work, ending with a running instance and one flow that writes one row.
The list below gives the order, and each step leaves something working, so a failure points at the step that caused it:
- Pull and pin images on a connected machine.
- Save them to an archive.
- Carry the archive across the gap.
- Load the images into the internal registry.
- Start Postgres and Redis.
- Set the encryption key and environment variables.
- Start the app and the workers.
- Create the admin account.
- Build a flow that writes one row.
The five stages below group these steps.
Stage 1: export the images on a connected machine
Pull the application, Postgres and Redis images by explicit version tag, never latest, then save them into one archive. Pinning means the image you tested is the image you load, and an update later is a deliberate act rather than an accident.
Record each digest, because it's what you'll compare against on the other side.
Inside the gap, stage 2 loads the images. Carry the archive across on approved media, verify the digests, and load the images into your internal registry.
Check the digests before anything starts; a mismatch here is cheap to fix, and the same mismatch inside a running stack isn't.
Stage 3: start the stack and create the admin account
Size the host first. The hardware guidance gives the app server 4 GB of RAM and the worker 4 GB, so an 8 GB machine has no room left for anything else.
Per Activepieces, PostgreSQL and Redis need 1 GB each, which brings the total to 10 GB, so a 16 GB host leaves headroom for the operating system.
Start Postgres and Redis, then set the encryption key (AP_ENCRYPTION_KEY) and the JWT secret (AP_JWT_SECRET) before the first launch. The encryption key protects stored credentials, so losing it makes those credentials unreadable; back it up outside the host.
Then start the app and workers and create the admin account at the sign-up screen.
Stage 4: run a first workflow that writes one row
Build the smallest useful flow: a manual trigger and one action that inserts a row into the internal Postgres database. It touches the trigger, a worker, the database and the run log, and nothing in it needs an outside service.
When the run shows green and the row appears, the instance is working end to end.
Without a registry, stage 5 adds connectors, meaning you're dependent on stage 5 for connectors without a registry. Normally they arrive from a public registry, which the gap forbids.
Fetch each connector package on the connected machine, carry it across with the same digest discipline, and install it locally. Every connector becomes a small import job, which is the recurring cost the earlier sections warned about.
Easier to see it running than to read about it: set it up free, no card.
Mistakes that break air-gapped Activepieces deployments
Most failed air-gapped installs come down to five mistakes, and each one is cheap to avoid before go-live and expensive to discover afterwards. The list below gives each failure with the consequence it produces, and the subsections that follow explain the mechanism.
- A VPC treated as an air gap leaves an outbound path open, which fails a FedRAMP or FISMA isolation review.
- Unpinned image tags mean a rebuild can pull different code than the one you tested.
- No update routine leaves the install drifting behind, with security fixes arriving late or never.
- A lost encryption key or missing backup makes stored credentials and flow data unrecoverable.
- Expecting cloud connectors and credits offline produces flows that fail the first time they run.
Treating a VPC install as an air gap
A private subnet isn't an air gap. A VPC with a NAT gateway, a proxy or a peering link still has a route out, and an auditor assessing against FedRAMP, FISMA or PIPEDA-driven residency rules will find it.
The consequence is a failed assessment on a system you believed was isolated.
Test the network from inside: if a container can resolve and reach a public address, you have a restricted network, not an air gap. Remove the route, then prove it with a failed outbound request.
Unpinned images and no update routine
If you use a latest tag, or any floating tag, it resolves at pull time. In a connected environment that's a convenience.
In an air-gapped one, the image you imported by hand is whatever the tag pointed to that day, and a later re-import can silently change the version. Pin every image to an explicit version and record it in your change log.
Pinning only helps if someone moves the pin. With no update routine, nothing reminds you that fixes exist, because nothing reaches you. Set a schedule for fetching releases on a connected machine, scanning them, carrying them across, and rolling them out in staging first.
Losing the encryption key or database backups
Because connection credentials are stored encrypted, the database alone isn't enough to restore a working install. If the encryption key is lost, every saved connection becomes unreadable and each must be re-entered by hand.
If the database is lost with no backup, you lose the flows themselves.
Store the key separately from the database, back up both on a schedule, and restore into a test environment to confirm the backup works.
Expecting cloud connectors to work offline
With no internet path, many connectors, which exist to call an external SaaS API, can't reach it. Credits, which meter usage on the managed cloud, are a cloud billing concept and don't govern a self-hosted install.
The consequence is flows that import cleanly and then fail at the first external call. Audit each flow's dependencies before migration, keep only connectors that reach services inside your boundary, and treat anything else as a build or import task.
How Activepieces fits an air-gapped environment
Provided you settle licence checks, updates and connector supply with sales before you commit, the self-hosted edition fits an air-gapped network. That holds once you have kept only the connectors that reach services inside your boundary.
The platform runs wholly inside your enclave, so the open questions are operational, not architectural.
What the Community Edition gives you
If you need to build and run flows on your own hardware, with connectors you import or write yourself, the free Community Edition is enough. It also requires that your team can live without centralised identity.
It carries no licence cost, so a pilot inside the enclave needs no procurement cycle.
It stops being enough when an assessor expects the controls your framework names: single sign-on, SCIM provisioning, custom role-based access, audit logs, release management or an external secret manager. Those belong to the paid self-hosted enterprise tier, and its price is quoted by sales.
No list price exists for you to budget against, because the quote depends on user count, credit volume, deployment shape and the support you want.
What to ask sales before you commit
Take four questions into the first call; the table below sets them out, what a usable answer sounds like, and where to raise each one. They decide whether an offline install stays maintainable. Treat a vague answer as a finding in your risk register.
| Row | Question to ask sales | What a good answer looks like | Where to ask |
|---|---|---|---|
| Offline licence validation | How is the enterprise licence verified when the host has no outbound path? | A key or file you load by hand, with no call home and a clear renewal procedure | Sales form |
| Update delivery | How do new releases reach a network with no registry access? | Versioned image archives with checksums and release notes you can carry across your transfer process | Sales form |
| Connector packaging | How do I supply and update connectors without a package registry? | Connectors distributed as bundles you can scan, import and pin to a version | Sales form |
| Support | How do you support an environment you cannot reach? | A defined process for logs and diagnostics you export yourself, and a stated answer on compliance attestations | Sales form |
On attestations, note that the vendor's SOC 2 programme is in progress, so don't write it into your documentation as a certification. The pricing page lists only self-serve plans, so none of these four questions belong there.
Send them through the sales form. The pricing page covers only the self-serve plans, which your enclave won't use.
Frequently asked questions
Can Activepieces run with no internet at all?
Yes, once you have carried into the enclave everything it would normally fetch: container images, the connectors (called pieces) your flows use, and any updates. The labour is yours, since nothing arrives on its own.
Any flow step that calls an outside service still needs a route to that service, so the flows you build must target systems inside the enclave.
Does an air-gapped install need a paid licence?
Only if you want the enterprise feature set. The free Community Edition runs without one and is enough when you need workflow automation and none of SSO, SCIM, custom RBAC, audit logs, release management or secret manager integration.
If any of those is a compliance requirement, you need the self-hosted enterprise licence.
Expect the enterprise licence to be quoted by sales, with the quote depending on users, usage, deployment shape and support. Ask sales how the licence key is delivered and verified in a network with no outbound path, and settle that before you commit.
Can I use AI features inside an air gap?
Only if the model sits inside the same enclave. Anything that calls a hosted model provider needs an outbound connection, which an air gap by definition lacks.
Run a model on your own infrastructure and point your flows at its internal endpoint; that is the workable pattern.
Your hardware and model choice then set the quality, and the cost shifts from usage fees to running that infrastructure. Check with sales whether the credit metering that applies to the managed cloud applies to your deployment.
How do I update an air-gapped Activepieces install?
Update it by hand, in the same order each time:
- Pull the new container images on a connected staging machine.
- Scan and approve them under your own change process.
- Transfer them across the boundary and load them into your internal registry.
- Bring in updated integrations the same way.
- Roll the deployment forward in a test environment before production.
You own the cadence, so you also own the patching. Nobody pushes a fix to you, so someone on your team must watch for releases and security notices from the connected side.
Is Activepieces SOC 2 certified?
No. The SOC 2 programme is in progress, so don't cite a certification to your auditors.
For a self-hosted install the question matters less than it first appears, because the software runs inside your controls and your own audit scope covers it. If your procurement process demands a vendor attestation anyway, raise it with sales when you request the quote.
