TaskCrew on your own servers.
One Docker Compose file. Your database, your files, your AI key, your region. Everything in TaskCrew, AI teammates included, running where you decide.
For teams that need to know where their work lives.
Regulated teams
Finance, health and government suppliers keep records, files and audit logs on servers they control, in the region they choose.
Teams leaving Jira Data Center
Keep running your own servers, and bring your projects over from a Jira CSV export with a dry run and Undo.
Full control of AI
Your own provider key and account, monthly limits for each workspace and the whole server, and one setting that stops every AI call.
Try it on your laptop. Run it on a server.
All settings live in one file, deploy.env, copied from deploy.env.example, which holds working defaults for a try-out.
- 1
Set three secrets
Long random values for signing, encryption and the runner. A server refuses to start with the examples.
- 2
Point two host names at it
One for the app and one for the API. Open ports 80 and 443, and nothing else.
- 3
Start it with HTTPS
Caddy gets and renews the certificates. The app and the API listen only behind it.
$ docker compose up -d --build # first build: a few minutes
$ open http://localhost:3000 # sign up, make a workspace
# try-out only: deletes the database and uploads too.
# Never run this on a server.
$ docker compose down -v# deploy.env (copied from deploy.env.example, never committed)
TASKCREW_WEB_HOST=app.example.com
TASKCREW_API_HOST=api.example.com
TASKCREW_ACME_EMAIL=ops@example.com
WEB_ORIGIN=https://app.example.com
PUBLIC_API_URL=https://api.example.com
COOKIE_SECURE=true
COOKIE_DOMAIN=example.com
JWT_SECRET=… # each one: openssl rand -base64 48
ENCRYPTION_KEY=…
INTERNAL_API_TOKEN=…
OPENROUTER_API_KEY=… # for AI
# point both names at the server, open ports 80 and 443, then:
$ docker compose --profile https up -d --build# deploy.env: a bucket of its own, not the uploads bucket
BACKUP_S3_BUCKET=acme-taskcrew-backups
BACKUP_S3_PREFIX=taskcrew-db/
BACKUP_KEEP_DAYS=30
$ docker compose logs backup # "saved s3://…" once a day
$ docker compose run --rm backup now # one backup now, e.g. before an upgrade
$ docker compose run --rm backup list # what the bucket holds$ git pull
$ docker compose run --rm backup now # a fresh dump first
$ docker compose --profile https up -d --build
# the migrate service applies new migrations before the API and the runner startCommands run from a copy of the TaskCrew code. Talk to us about licensing
Your stack, your choices.
Every outside service TaskCrew uses is one you pick, and most can be swapped or switched off.
| Database | Postgres runs where you run it: every record, the encrypted secrets and the audit logs. |
|---|---|
| File storage | A Docker volume on the server, or any S3-compatible bucket: AWS S3, Cloudflare R2, Backblaze B2, MinIO. The bucket stays private and files stream through the API. |
Your own SMTP server for invites, password resets and notifications (SMTP_URL). Without one, nothing is sent and invite links are copied instead. | |
| AI provider and key | Your OpenRouter key (OPENROUTER_API_KEY). All AI uses deepseek/deepseek-v4-flash, and by default only providers that don’t keep or train on prompts (AI_PROVIDER_DATA_COLLECTION=deny). |
| AI spending | A monthly limit per workspace and one for the whole server, in US dollars, and AI_DISABLED to stop every AI call at once. |
| Connectors | Some built-in connectors sign in through an OAuth app you register: GitHub, Slack, HubSpot, Asana, Xero, and one Google client for Gmail, Drive, Calendar and Chat. AI teammates reach only https connectors on public hosts unless you change CONNECTOR_URL_POLICY. |
| Backups | A daily database dump to your own S3 bucket, kept 30 days (BACKUP_S3_BUCKET, BACKUP_KEEP_DAYS). Without a bucket there are no backups, and the server warns you. |
| Map tiles | OpenStreetMap by default, your own tile server, or maps turned off (TASKCREW_MAP_TILE_URL). |
| Sandbox isolation | A hardened container per AI run with memory and CPU limits, and gVisor if you want it (SANDBOX_RUNTIME=runsc). |
| Alerts | Server errors, failed backups and crashed runs posted to a Slack, Microsoft Teams or Google Chat webhook (ALERT_WEBHOOK_URL). |
Safe settings by default, and a guide for the rest.
Automatic HTTPS
Caddy gets and renews Let’s Encrypt certificates and adds HSTS. You only set the host names and an email address.
Nothing exposed by accident
The web app and the API listen on 127.0.0.1 only, behind the proxy. The database is reachable only inside the Docker network.
Refuses unsafe settings
Once it’s reachable beyond localhost, the API won’t start with an example, short or reused secret, or insecure cookies over HTTPS.
Daily backups, tested restores
A database dump every 24 hours to your bucket. A restore drill on 13 Oct 2026 restored a dump and compared row counts: they matched.
Alerts and health checks
Errors, failed backups and crashed runs go to your chat. A health endpoint checks the database for your uptime monitor.
Upgrades in three commands
Back up, pull and start again. Migrations run before the API and the runner come back.
Same product. You choose who runs it.
Both have the same features, AI teammates and approvals included. The difference is who looks after the server.
| TaskCrew Cloud | Self-hosted | |
|---|---|---|
| Who runs it | We do | You do, on your own servers |
| Where data lives | With our hosting provider, named on the subprocessors page | Where you put it: your region for the database, files, email and AI provider |
| Getting started | Sign up and invite your team today | One Docker Compose file, a server and two host names |
| Updates | Shipped for you; see the changelog | git pull and up, when you choose. Migrations apply themselves |
| Backups | Daily, done for you | Daily to your S3 bucket, with a restore guide |
| AI | AI credits included in every plan; AI pauses at your limit | Your OpenRouter key and account. You pay your provider directly |
| Plans and limits | Free, Team, Business and Enterprise | No plan limits: billing is off unless you turn it on |
| Support | Email support@taskcrew.com; the Enterprise plan includes an SLA | Talk to us about support and licensing |
Questions about self-hosting
How is self-hosting licensed?
Licensing for self-hosted TaskCrew isn’t published yet. Tell us about your team and where you want to run it, and we’ll talk it through. Talk to us about licensing.
What do I need to run it?
Docker Engine with Compose v2, or Docker Desktop for a local try-out. For a real install: a server you can point two host names at (one for the app, one for the API), with ports 80 and 443 open. Add an S3-compatible bucket for backups, SMTP for email and an OpenRouter key for AI.
Which AI model does it use?
All AI, from AI teammates to the agent builder, uses deepseek/deepseek-v4-flash through OpenRouter, with your own key. You set the monthly limits, and AI_DISABLED=true stops every AI call. Without a key, everything else works and AI features say AI isn’t set up.
What leaves my server?
Only what you set up: AI requests to OpenRouter, calls to the connectors you turn on, email through your SMTP server, map tiles from the tile server you choose (or none), and push notifications through the browsers’ push services, encrypted end to end.
How do upgrades work?
Take a fresh backup, pull the new version and start the stack again. The migrate service applies new database migrations before the API and the runner start. AI runs in progress when the runner restarts fail as “interrupted” and can be retried, so upgrade when few are running.
What happens if I lose the encryption key?
Stored credentials (vault entries, connector tokens, public links) can’t be read without ENCRYPTION_KEY, so keep it safe and never change it. JWT_SECRET can be rotated at any time; it signs everyone out.
Run TaskCrew where your data lives.
Tell us about your setup and we’ll help you get it running.