The whole admin plane, on hardware you control. Here’s what running Pia yourself looks like day to day.
The Community Edition is the real server, not a demo: open source, local authentication built in, and a documented walkthrough from zero to first login. If you can run a standard .NET service and a database, you can run Pia.
Every Pia server runs on a signed licence file, including this one — mail us and you get the Community licence for free. On first start the server prints a setup token; paste it together with the licence on the setup page and it activates without a restart.
Read the walkthroughCommunity and Enterprise are the same container image. The signed licence decides what it unlocks, so moving up later means replacing one file — same server, same data.
| Capability | Community | Enterprise |
|---|---|---|
| Local login with MFA and passkeys | Included | Included |
| AI proxy with your own provider keys | Included | Included |
| Sync and chat history across devices | Included | Included |
| Admin dashboard, token board, runtime policies | Included | Included |
| Audit log and login-anomaly detection | Included | Included |
| Encryption at rest | Included | Included |
| End-to-end encryption, recovery, device revocation | Included | Included |
| Plugins, MCP and the public REST API | Included | Included |
| Groups as the unit of policy | One fixed group | Groups you define |
| Guardrails with a decision log | Not included | Included |
| Microsoft Entra ID single sign-on | Not included | Included |
| Managed personas and client policies | Not included | Included |
| Knowledge bases with cited answers | Not included | Included |
| Users / admins | 5 / 1 | Per contract |
Guardrails, quotas, provider routing and plugin allowlists are settings on a group — that is why they sit on the Enterprise side, not because the feature itself is switched off. Everything above the group row works on a Community licence.
The Enterprise Edition is not on sale yet. The Community licence is free: mail us and we send you the file.
Set it once on the group, and every member inherits it: token limits and per-user quotas, knowledge-base quotas, AI provider routing — overall and per mode — guardrail configuration, and the plugin allowlist. Policy stops being tribal knowledge.
Roles, identity sources, disabling, session revocation, soft delete with recovery. Offboarding is a checklist the server already knows.
Usage over time, broken down by user, group, and model. The heaviest requests, per-user request logs, and which templates drive the spend — before the invoice tells you.
Rate limits, quotas, identity and lockout policy, AI payload caps, provider retry behaviour — all editable from the admin UI while the server runs. No config-file archaeology, no restart window. Test a provider connection live from the settings page — before your users find out the hard way.
Registered devices with pairing status and sync cursors. Revoke a lost machine to cut it off from sync, or delete it outright — the difference is deliberate, and documented.
Edition, expiry, and seat counts at a glance; licence events on a timeline; install or replace a licence from the UI, with an automatic rollback if the new file fails to validate. Expiry is a hard stop, not a slow fade: the server returns to setup mode and waits for a valid licence. Your data is untouched, but nothing else runs — so watch the warnings, which start 30 days out.
Plugins come in three kinds — server-delivered tool packs, MCP servers you bring, and REST APIs wired in as tools. Which of them a group may use is an Enterprise setting; the catalogue itself works on every edition. Third-party plugins are covered by signing certificates, with the trust list managed by you.
Connectors put pods on the tool plane: register a pod, issue its token, pick a transport, grant it to a group, and watch its presence. Operators put them on the task plane: serve skills, supervise running assignments, control retention. Nothing participates until an admin turns it on.
Auth, sync, AI proxy, assignments, and the E2EE endpoints are a documented contract — build your own integrations against the same API the client uses.