Self-Hosted Responsibility Matrix

1. Introduction

This document applies to Self-Hosted Deployments: deployments in which the Customer installs and operates Vexaro components on the Customer’s own infrastructure (whether on-premises or in the Customer’s own cloud or hosting environment), rather than using the Vexaro-hosted Service.

In a Self-Hosted Deployment the operating model is fundamentally different from the hosted Service: Vexaro supplies the software and the means to keep it current, but the Customer runs it. The Customer therefore controls, and is responsible for, the infrastructure, the surrounding security and network, availability, backups, key and secret management, access control, monitoring, and the data held within the deployment. This document states that division of responsibility so that both parties have a clear, shared understanding of it.

The matrix in Section 2 is the operative allocation. Sections 3 to 5 explain how updates and support work, how data and privacy apply in this mode, and the limits of Vexaro’s responsibility. The licence for a Self-Hosted Deployment, and any commercial terms specific to it, are set in the Order Form; there is no Vexaro-processed payment for the deployment itself (Section 2).

2. Responsibility Matrix

The following table allocates responsibility between Vexaro and the Customer for a Self-Hosted Deployment. “Vexaro provides” describes what Vexaro makes available or supplies; “Customer operates” describes what the Customer is responsible for running, securing, and maintaining on its own infrastructure.

Area	Vexaro provides	Customer operates
Software & updates	The Vexaro software for the deployment and released updates, new versions, and Documentation.	Installing, configuring, upgrading, and applying updates and new versions on its own schedule and infrastructure.
Security patches	Security fixes and patches for the Vexaro software, with guidance on severity and applicability.	Promptly applying security patches and updates to the Vexaro software and to all underlying components the Customer runs.
Underlying infrastructure (servers, OS, containers)	Documented requirements, supported configurations, and container or package artefacts as applicable.	Provisioning, hardening, patching, and maintaining the servers, operating systems, container runtimes, and orchestration on which the deployment runs.
Network & firewall	Documentation of required ports, protocols, and connectivity (including signaling and relay/failover behaviour).	Designing, configuring, and securing its network, firewalls, segmentation, ingress/egress rules, and any relay or gateway it operates.
Availability & uptime	Software designed for reliable operation, plus resilience and failover documentation.	The availability and uptime of the deployment, including capacity, redundancy, scaling, and operational continuity. Not covered by the hosted Service Availability Policy (Section 5).
Backups & disaster recovery	Documentation and, where applicable, tooling to support backup and restore of the Vexaro components.	Designing, performing, testing, and restoring backups, and planning and executing disaster recovery for its data and infrastructure.
Encryption key/secret management	Software that uses encryption in transit and encrypts sensitive account fields at rest under a key the Customer supplies; media channels are protected using the protocols supported by the applicable Product and deployment model. The software supports secret storage and configuration appropriate to the deployment.	Generating, storing, rotating, protecting, and revoking its own keys, secrets, and credentials (for example, using its own secrets manager), and the lifecycle of those secrets.
Access control & user provisioning	RBAC, multi-factor authentication (MFA), and SCIM/directory-provisioning capabilities within the software.	Defining roles and permissions, provisioning and de-provisioning Authorized Users, enforcing MFA, and managing identity, sessions, and offboarding.
Audit-log storage & retention	Audit-logging functionality that records relevant events within the software.	Storing, protecting, retaining, and disposing of audit logs according to the Customer’s own policy and obligations; setting and enforcing its own retention.
Monitoring & incident response	Software logging, health signals, and a vulnerability-disclosure channel (see the Vulnerability Disclosure Policy).	Monitoring the deployment, detecting and responding to operational and security incidents, and meeting its own notification obligations.
Data residency & location	Software that can be deployed in the location the Customer chooses; documentation of data flows.	Choosing and controlling where the deployment and its data physically reside, and meeting any residency or localisation requirements applicable to it.
Compliance of the deployment	An information-security program for the Vexaro software designed and operated to align with the principles of recognised information-security-management, service-organisation-control, and application-security-verification frameworks (see the Security Overview).	The compliance of the deployment as operated (including how it is configured, secured, and used), and obtaining any authorisations, lawful basis, and End-User notices it requires.
Payment processing	A licence for the Self-Hosted Deployment under the Order Form.	Note: there is no Vexaro-processed payment for the deployment itself; on-premises and self-hosted licences are contracted and invoiced via the Order Form rather than through a checkout.

Where a row is not addressed by the table, the general principle applies: Vexaro is responsible for the Vexaro software it supplies, and the Customer is responsible for the infrastructure, configuration, operation, security, and data of the deployment it runs.

3. Security Updates & Support

Vexaro releases updates and security patches for the Vexaro software and makes them available to Customers running a Self-Hosted Deployment, together with guidance on severity, applicability, and any action required. Updates are delivered through the distribution mechanism described in the Documentation for the relevant Product (for example, updated packages, container images, or installers).

Vexaro maintains a defined set of supported versions. Running a supported version is a condition of receiving security fixes and support for the deployment; versions outside the supported set may not receive fixes. The Customer is responsible for applying updates and security patches promptly after they are released, and for keeping the deployment, and the underlying components the Customer operates, current. Failure to apply a released security patch is within the Customer’s responsibility, and Vexaro is not responsible for issues arising from a Customer’s failure to apply available updates.

Support for a Self-Hosted Deployment is provided as set out in the Customer’s plan and Order Form. Vexaro supports the Vexaro software it supplies; it does not assume operational responsibility for the Customer’s infrastructure (Section 5).

4. Data & Privacy in Self-Hosted Mode

In a Self-Hosted Deployment, the Customer installs and operates the Vexaro components on its own infrastructure, and is the operator and controller of its instance. Customer Content, session metadata, audit logs, and Recordings generated through the deployment remain on the Customer’s infrastructure and under the Customer’s control; Vexaro does not receive them in the ordinary course of operating such a deployment.

Personal Data may reach Vexaro from a Self-Hosted Deployment only where the Customer enables a feature that sends it, such as licensing validation, update checks, or optional telemetry or error reporting. Where that occurs, the data so received is handled as described in the Privacy Notice, and the Customer remains responsible for the data that stays on its own infrastructure. The platform Subprocessors used for the hosted Service may not apply to a Self-Hosted Deployment, and the processor obligations under the Data Processing Addendum apply to Vexaro only in respect of Personal Data that Vexaro actually Processes. They do not transfer to Vexaro responsibility for infrastructure or data under the Customer’s control. The allocation in this document operates alongside the Data Processing Addendum, which governs Personal Data that Vexaro Processes on the Customer’s behalf.

5. Limits of Vexaro’s Responsibility

The hosted Service Availability Policy does not cover a Self-Hosted Deployment or the Customer’s own infrastructure on which it runs. The uptime commitment and service credits in that policy apply to the Vexaro-operated Service components; they do not apply to a deployment the Customer operates itself.

Accordingly, and to the extent permitted by the Terms of Service and applicable rules, Vexaro is not responsible for the Customer’s infrastructure, for the availability or uptime of a Self-Hosted Deployment, or for the Customer’s backups, disaster recovery, network, access control, key and secret management, monitoring, or incident response. Vexaro’s responsibility in this mode is for the Vexaro software it supplies and for delivering updates and security patches for it, as described in Section 3. Each party is responsible for the areas allocated to it in Section 2, and the Customer is primarily responsible for the security, availability, and configuration of the infrastructure it controls.

Nothing in this document reduces any non-waivable right the Customer may have under applicable mandatory rules.

6. Contact

For help with a Self-Hosted Deployment, or to report a security matter:

• Support (deployment, updates, configuration): [email protected]
• Security reports / vulnerability disclosure: [email protected]

For other matters, write to:

• Legal and contracting: [email protected]
• Privacy / data-protection contact: [email protected]

Contracting and notice details are provided on invoices and Order Forms.

This document is part of the Vexaro Legal Center.