Self-hostable, your keys, your data: what ownership actually means

Three questions decide whether you own your AI stack: where does the logic live, whose key calls the model, where does the data sleep?

"Ownership" is having a moment in AI tooling marketing, which means it's about to mean nothing.

So let me try to make it mean something specific. When your company adopts an agent platform, three questions decide whether you own the result or rent it:

1. Where does the agent logic live? In files you control, or in a vendor's web UI?
2. Whose key calls the model? Yours, or theirs-billed-back-to-you?
3. Where does the data sleep? On your disk, or in their cloud?

Here's how rysh answers all three, why the answers compound, and — because dev.to deserves better than a brochure — the honest boundary of each claim.

1. Logic: your agents are markdown files in git

In rysh, an agent is a .md skill file: optional YAML frontmatter (name, description, config), then a system prompt as the body. Spawn it with ##agent spawn, or point ##agent spawn-all at a directory and stand up your whole roster.

This sounds mundane. It is quietly the most important ownership property on the list, because files in a repo inherit twenty years of infrastructure you already trust:

• Code review. Changing an agent's behavior is a pull request, with a diff and a reviewer — not an unlogged edit in a vendor dashboard.
• History. git log on your agents. Who loosened the support bot's tone last quarter? There's a commit for that.
• Portability. Your agent definitions aren't hostage to an export button. They're text. They come with you.
• Reproducibility. Clone the repo, spawn-all, and your agent team exists on a new machine.

The alternative — logic configured through a SaaS UI — means your company's accumulated judgment about how its agents should behave is stored in someone else's database, in someone else's schema, behind someone else's roadmap.

2. Keys: BYO Anthropic key

rysh runs on Claude — I want to be plain about that: we're not claiming a secret better model, and the intelligence isn't ours. What's ours is everything around the model: the surfaces, the governance, the tooling. You bring your own Anthropic API key.

Why that's an ownership property and not a config detail:

• Direct relationship with the model provider. Your usage, your rate limits, your data-handling terms with Anthropic — negotiated by you, not intermediated through a reseller who sees your traffic.
• No middleman on the wire. Model calls go from your machine to the provider. There's no vendor proxy in the path collecting your prompts as a side effect of billing you.
• Leverage. A platform that holds your model relationship holds your exit costs. One that doesn't, doesn't.

And because the prompts leave your machine, the protections at that boundary run on your machine too: client-side secret redaction and SecretNAT tokenization happen where the request is assembled — the provider never receives the credential values, and we've grepped the wire to check.

3. Data: sessions on your disk

Every rysh session — pane output, conversation history, workspace layout — persists locally through an embedded message bus (NATS JetStream) with per-session data directories in your own state directory. Detach on Friday, attach on Monday, everything's there. Decide a project is done, rysh delete-session, and the data directory is actually gone — not "deletion requested," gone, because it was never anywhere but your disk.

Your agents' working memory is a shadow copy of your codebase, your incidents, your internal reasoning. That copy existing only where you decide is the difference between "our data is retained per the vendor's policy" and "our data is retained per ls."

For team features — shared panes, remote collaboration — there's a server component, and you can host that yourself too. Your infra end to end, if that's your posture.

Why the three compound

Any one of these is nice. Together they change what kind of dependency the platform is.

Consider the conversations that go badly with rented AI stacks: the security review ("where exactly do prompts go?"), the compliance audit ("enumerate data locations"), the vendor's pricing change, the offboarding ("export everything"), the acquisition of your vendor by someone you'd never have chosen. With logic-in-git, your-key, data-on-disk, each of those conversations gets a boring answer. Boring answers are what ownership feels like from the inside.

There's also a subtler effect: you can invest safely. Teams hesitate to build deep agent workflows on platforms they rent, because depth becomes lock-in. When the agents are your files, the histories are your disk, and the model relationship is your contract, building deeper doesn't dig your hole deeper.

The honest boundaries

Words on this page I chose carefully, and what they do not mean:

• Self-hostable is not open source. You can run rysh on your own infrastructure with your own key. The source code is not public. If your procurement requires OSS, we are not that, and I'd rather say so here than have you discover it on a call.
• "Your keys" still means Anthropic sees model traffic. That hop is inherent to using a hosted frontier model — minimized by redaction and SecretNAT, but real. If your threat model excludes any external model calls, no Claude-backed tool fits it, ours included.
• Ownership isn't a security guarantee. It's a control guarantee. You still have to do the controlling — approvals, key hygiene, access to the machines rysh runs on. (The checklist is the companion piece.)

The question under the question

When a vendor says "you own your data," ask the three questions from the top — logic, keys, data — and watch which ones get a crisp answer.

Renting intelligence is fine. Everyone building on frontier models rents intelligence, us included. The thing you should refuse to rent is the shape of your own company — the accumulated logic of how your agents work, the history of what they've done, the relationship with the model they run on. That part should be yours, in formats you can cat.

rysh is in private beta — self-hostable, your keys, your data, built on Claude. If your team wants agents it can own on these terms, the design-partner program is open: free access, direct line to the founder, roadmap shaped by your constraints. Apply here.

Related: Is it safe to let an agent loose on your systems? · ##snat list and ##snat get: you keep the keys