Self-hosting

StackTakt is customer-managed software, not a SaaS that holds your infrastructure. The line that matters runs between two things:

• Your infrastructure and data live in your own AWS account, always. Blueprints deploy there through a scoped cross-account role; evidence and state stores are buckets in your account; discovery reads through a read-only role you can revoke by deleting a stack. Nothing StackTakt produces executes inside your account beyond the resources you approved.
• The platform (the application, its database, and the deployment workers) runs as a managed installation operated with you. Most teams start with an implementation engagement from StackTakt and keep a light service relationship after that; consulting partners can run the rollout end to end.

What the platform needs

An installation runs the application and worker containers against a PostgreSQL database, with the OpenTofu binary available to the worker and outbound access to AWS APIs. It holds platform metadata: organizations, tenants, identities, deployment records, and audit events. It stores no long-lived AWS credentials; access to each connected account goes through short-lived role assumptions with a per-connection external ID.

Running it in your environment

If your posture requires the platform itself inside your boundary, that is arranged as part of an implementation engagement rather than a download. Talk to us at hello@stacktakt.com about requirements and operations.

Either way, revoking StackTakt’s access to an AWS account is always the same one step: delete the StackTaktConnect-* stack in that account.