TotalHeal on your own infrastructure
The whole TotalHeal control plane can run on your own Linux server — console, sign-in with Active Directory / LDAP, SAML or OpenID Connect, database and agent channel — with no call to TotalHeal cloud at run time. Built and tested; available on request. Hybrid parts (app connector and edge nodes, your own DNS resolver) also work with the cloud control plane.
Product by product, as each datasheet states it
| Product | Profile | Status | Note |
|---|---|---|---|
| DeviceSphere UEM | On-premises | Available | Delivered with our team from the on-premises kit. |
| PatchPilot Patch Management | On-premises | Available | Delivered with our team from the on-premises kit. |
| RemoteLink Remote Access | On-premises | Available | Delivered with our team from the on-premises kit. |
| VulnSight Vulnerability Management | On-premises | Available | Delivered with our team from the on-premises kit. |
| ThreatGuard NGAV / Endpoint Protection | On-premises | Available | Delivered with our team from the on-premises kit. |
| ZeroGate ZTNA | Hybrid (your Linux node as router, connector or exit node) | Partial | Available as a binary; no package or appliance image yet. |
| ZeroGate ZTNA | On-premises controller | Available | Delivered with our team from the on-premises kit. |
| PrivilegeVault PAM | Hybrid (private targets) | Partial | Through a Secure Access connector node on your network (a binary today); a dedicated on-site gateway is on the roadmap. |
| PrivilegeVault PAM | On-premises / air-gapped | Available | On-premises or fully offline, delivered with our team from one kit. |
| WebShield WAF | Hybrid (self-hosted Linux edge node) | Available | The installer stays locked until the release key is published. |
| WebShield WAF | On-premises control plane | Available | Delivered with our team from the on-premises kit. |
| TrafficShield Bot management & L7 DDoS | Hybrid (self-hosted Linux edge node) | Available | The installer stays locked until the release key is published. |
| TrafficShield Bot management & L7 DDoS | On-premises control plane | Available | Delivered with our team from the on-premises kit. |
| DNSGuard DNS Firewall | Hybrid (your resolver, TotalHeal console) | Available | The installer stays locked until the release key is published. |
| DNSGuard DNS Firewall | On-premises control plane | Available | Delivered with our team from the on-premises kit. |
| LogIntelligence SIEM | On-premises control plane | Available | Delivered with our team from the on-premises kit. |
| ThreatFusion XDR | On-premises control plane | Available | Delivered with our team from the on-premises kit. |
| ResponseFlow SOAR | On-premises control plane | Available | Delivered with our team from the on-premises kit. |
| CyberAware | On-premises / air-gapped | Available | With your own mail and DNS servers. |
- Installed with our team from one kit, tested on Rocky Linux 8, Ubuntu 20.04 and Debian 12.
- Each product row below is exactly as its datasheet states it.
What the kit installs
The whole control plane on one Linux server, under systemd with no container runtime: the console, a gateway for HTTPS, sign-in and the agent channel, the TotalHeal control plane, a bundled PostgreSQL database and offline threat data (vulnerability advisories, NVD, CISA KEV, GeoIP). At run time it makes no call to TotalHeal or Sttiz cloud.
Sign-in with your directory
Active Directory / LDAP (LDAPS or StartTLS, groups to roles), SAML 2.0 (Entra ID, ADFS, Keycloak, Okta, Shibboleth) or OpenID Connect, plus local accounts with two-step sign-in. The setup administrator is a break-glass account, and at least one always remains.
Air-gapped operation
Licences arrive as signed offline files and updates as signed offline bundles, with upgrade, rollback, nightly backups and threat-data refresh without internet. The Admin Console app (coming) connects only to your gateway.
Measured, not estimated
Tested on Rocky Linux 8, Ubuntu 20.04 and Debian 12 in containers limited to 4 vCPU and 6 GiB RAM: the kit is 213 MiB, install and first-run setup take about a minute, and the control plane used about 4.4 GB of memory holding the offline threat data. Sizing for larger fleets has not been measured yet.
Products in development (ThreatTrace desktop EDR, ThreatFusion XDR, LogIntelligence SIEM and others) list their planned deployment profiles on their own pages when they are ready. See the roadmap.
Talk to us about on-premises & hybrid.
Tell us what you need to protect and how many devices or users. We reply with a quote and the procurement documents you ask for.
Or email business@totalhealsecurity.com.