AutoST Hosted vs On-Premises: Where the Dashboard Runs and Where the Data Stays

What is the difference?

This is not a comparison between two products but between two ways of running the same one. AutoST has three parts: a web dashboard, a backend that orchestrates jobs and stores findings, and Carbyne, the test agent that sits next to the ECU on your bench and does the actual bus and IP communication. The agent is always yours and always on your bench. The choice is where the other two parts live.

Hosted: Zyberum runs the backend and dashboard as a managed instance in the EU. You install the agent on a Windows or Linux machine on the bench, pair it with a token and start testing the same day. Zyberum handles updates, backups and availability; your data is stored in the EU and belongs to you.

On-premises: the backend runs as a single container on your own infrastructure, behind your own identity and network controls, operated by your IT. ODX and CDD files, scan results, fuzzing payloads and reports never leave your network. You handle updates and backups, and you can run it in a segment with no internet access at all.

Side by side

	Hosted by Zyberum (EU)	On-premises
What it finds	Identical: the same engines, the same test content, the same reports	Identical
What it misses	Nothing the on-premises version finds; the test runs on the same agent	Nothing the hosted version finds
Who does it	Your test engineers run tests; Zyberum operates the server	Your test engineers run tests; your IT operates the container
Bench time	Same per run; outbound HTTPS from the bench is needed	Same per run; works in a network segment without internet
Cost	Licence per tested component, hosting included, price on request	Licence per tested component, price on request; your server and IT time
Fits a release cycle	Yes; API tokens and the Bamboo plugin reach the EU instance over HTTPS	Yes; the pipeline and the backend sit on the same network
Required by	Nothing in the standards; fine where internal policy allows EU-hosted engineering data	Customer or OEM contracts that forbid supplier data leaving the premises; air-gapped benches; corporate policy on pre-series firmware and diagnostic descriptions
Output	PDF, SARIF, CSV and JSON, downloaded from the instance	The same, stored on your servers

Choose hosted when

• You want to start this month. A hosted instance needs an agent install and a token, not a server request, a firewall ticket and a change window.
• The team is small and nobody wants to operate another container. Updates, backups and availability are Zyberum’s job.
• The data is engineering data you are allowed to store with an EU processor: scan results of your own ECUs, your own diagnostic descriptions. Many Tier-1 and OEM teams are, and a pilot is the typical case.
• You test from several sites or with an external partner and want one dashboard everybody reaches without a VPN.

Choose on-premises when

• A customer contract or OEM requirement says supplier data stays on the premises. Pre-series firmware, ODX and CDD files and seed/key related findings often fall under this, and the on-premises container is the answer.
• The bench network has no internet access and is meant to stay that way. The agent then needs a backend it can reach on the same segment.
• You already run containers and want AutoST behind your own identity provider, logging and backup regime.
• Your security policy treats test results as evidence that must be under your retention control for the UN R155 CSMS and ISO/SAE 21434 verification files. That is possible with hosted data too, but on-premises makes the question disappear.

Both together

Most organisations end up with one of the two, but the two are not exclusive. A common path is a hosted pilot on one ECU to see whether the product fits, then an on-premises instance when the programme grows and the contracts get stricter. Some groups run a hosted instance for an external lab or an engineering service provider and an on-premises instance for their own series ECUs. Components, scan history and the Fix Plan move between them, because it is the same software with the same licence.

Whichever you choose, the part that matters for the ECU does not change: a Carbyne agent on your bench, your CAN or Ethernet interface, your ECU. AutoST does not become a service that tests your hardware remotely; nobody at Zyberum touches your ECU unless you book a penetration test. If your only requirement is a few scans on one ECU and you have a spare machine, on-premises is a one-container install and we will not talk you into hosting.