Skip to content

ConfigHub Enterprise Product Description

Edition: 2026-10-06
Permanent URL: https://docs.confighub.com/enterprise/product-description/2026-10-06/
Current edition: https://docs.confighub.com/enterprise/product-description/
Release status: pre-GA (see section 6)

This document describes what ConfigHub Enterprise is, how it is delivered, and what a subscription includes. When it is attached to a customer agreement, the edition dated in the agreement governs.

1. What ConfigHub Enterprise is

ConfigHub Enterprise is a customer-hosted software service that acts as the operational source of truth for software deployment configuration. It stores configuration as structured data, validates and governs changes to it, and delivers the result to Kubernetes clusters and cloud platforms through GitOps controllers and other agents. Customers run it inside their own environment. ConfigHub, Inc. does not host it and therefore does not host any customer data.

Core capabilities:

  • A centralized configuration-as-data store with a queryable graph of versioned configuration data units organized in spaces and targeted at specific infrastructure such as kubernetes clusters and cloud services.
  • Rich manipulation of configuration data via data flow graph edges, inheritance relationships and bulk operations using both low level primitives and high level function mutators.
  • Full inspection of the final configuration data that will actually be applied, including drift detection, blast-radius calculation, policy enforcement and approval workflows.
  • Detailed control of changes via change workflows that govern permissions, sequencing and prerequisites when rolling out changes.
  • Integration with GitOps deployment controllers, including Argo CD and Flux, and with source platforms such as GitHub.
  • Identity integration with the customer's identity provider over OpenID Connect or SAML, with role-based access control.

2. The Software

ConfigHub Enterprise (the "Software") consists of the Commercial Software and the Open Source Software. Both are part of the product and a subscription covers both. The distinction matters for licensing, source availability, contributions, and versioning as detailed in section 2.4.

2.1 Commercial Software

The Commercial Software is ConfigHub Enterprise itself: the ConfigHub server and every other component distributed as part of the ConfigHub Enterprise container image, published at ghcr.io/confighubai/confighub. It is licensed under a commercial agreement. It is not open source. The web user interface is not part of the image; it is Open Source Software, listed in section 2.2.

The Commercial Software includes every update, fix, enhancement, and new version of these components released during a subscription, whoever requested or funded the work. Functionality that ConfigHub adds to the server or the image is part of the Commercial Software from the moment it is released.

2.2 Open Source Software

ConfigHub publishes the client-side and extension parts of the software as open source under the MIT License at github.com/confighub. The Open Source Software included in ConfigHub Enterprise is:

  • github.com/confighub/sdk: the cub command-line interface, the Go client library, the OpenAPI specification, and the SDK for extending ConfigHub with functions and integrations.
  • github.com/confighub/js-sdk: the JavaScript SDK, published on npm as @confighub/api, @confighub/react-auth, and @confighub/rtk-query: browser sign-in to a ConfigHub instance and typed clients for its API.
  • github.com/confighub/ui: the ConfigHub web user interface, a browser application built on the JavaScript SDK that signs in to a ConfigHub instance as an OAuth client. It is delivered as the container image ghcr.io/confighub/ui.

Anyone may use, modify, and redistribute the Open Source Software under the MIT License, with or without a ConfigHub subscription. ConfigHub develops them, and fixes and enhancements to them are released publicly under the MIT License. A ConfigHub Enterprise subscription adds maintenance and support for it. It does not change its license.

The Open Source Software is the official releases that ConfigHub publishes from these repositories, unmodified. A modified copy, a build from source, or a fork is not part of ConfigHub Enterprise and is not covered by support.

Other repositories under github.com/confighub are open source but are not part of ConfigHub Enterprise and are not covered by support unless listed above or added by the customer's agreement.

2.3 Required third-party software, not included

ConfigHub Enterprise runs on infrastructure and third-party software that the customer provides and operates. These are required for the Software to function but are not part of the Software, are not licensed by ConfigHub, and are not covered by ConfigHub maintenance or support:

  • A Kubernetes cluster to run the Commercial Software and the web user interface.
  • A PostgreSQL database. ConfigHub Enterprise stores all of its data in a customer-managed PostgreSQL instance, for example Amazon RDS. The customer owns the data, the backups, and the encryption at rest.
  • Keycloak, for identity provider integration. ConfigHub Enterprise brokers single sign-on through a Keycloak instance, which federates to the customer's own identity provider over OpenID Connect or SAML. Keycloak is open source software from a third party (Apache License 2.0) and the customer operates it. An evaluation install can run without it, using a local administrator account.
  • An ingress controller and TLS certificates for the ConfigHub server and web user interface endpoints.
  • Network access to ConfigHub's distribution channels, or to mirrors the customer maintains: the container registry ghcr.io, to pull the Commercial Software image ghcr.io/confighubai/confighub and the web user interface image ghcr.io/confighub/ui; GitHub releases at github.com/confighub/sdk, to download the cub command-line interface and the worker binaries; and the npm registry, only if the customer builds on the JavaScript SDK or builds the web user interface from source.

For convenience, ConfigHub's installation tooling can deploy PostgreSQL and Keycloak into the cluster from their upstream images, or connect to instances the customer already runs. Customers run the upstream Keycloak image; ConfigHub does not distribute its own Keycloak build. Either way they remain third-party software under their own licenses. Each Commercial Software release states the versions of these components it is tested against.

2.4 Commercial and Open Source Software Distinctions

  • License. The Commercial Software is licensed under the customer's commercial agreement. The Open Source Software is licensed to everyone under the MIT License. A commercial agreement adds maintenance, support, and warranties for it; it does not narrow any right the MIT License grants, including the rights to modify and redistribute, and those rights continue after the agreement ends.
  • Source code. The source code of the Open Source Software is public, so there is nothing to place in escrow. Source code for the Commercial Software is available only as the customer's agreement provides.
  • Contributions. Fixes and enhancements to the Open Source Software, whoever requests or funds them, are released publicly under the MIT License, and no customer receives exclusive rights in them. Functionality added to the Commercial Software is part of the Commercial Software, as section 2.1 states.
  • Versioning. The Open Source Software is released together with the Commercial Software and carries the same version number, and a version starting with 0 makes no compatibility commitment, as section 6 states.
  • Third-party content. Each kind ships its own inventory of third-party components, as section 7 states.

3. Delivery and deployment

  • The Commercial Software is delivered as a container image. The customer pulls the image from ghcr.io/confighubai/confighub. The image is publicly downloadable; no registry credentials are required. The image carries its own license terms: absent a commercial agreement, use is governed by the ConfigHub Evaluation License included in the image and reprinted at https://docs.confighub.com/enterprise/evaluation-license/. A signed commercial agreement controls over the Evaluation License.
  • The Open Source Software is delivered through its public GitHub releases, public container images hosted on ghcr.io, and packages on the npm registry.
  • The web user interface runs as its own container next to the server, is served at its own address, and is registered with the server as an OAuth client.
  • The customer deploys ConfigHub Enterprise in its own environment, for example a private AWS VPC, together with the required components in section 2.3. The customer operates the deployment, holds the data, and controls network access and encryption.
  • ConfigHub also operates a multi-tenant SaaS service at confighub.com. That service is a separate product under its own terms and is not part of ConfigHub Enterprise.

4. What a ConfigHub Enterprise subscription is

A ConfigHub Enterprise subscription is a term license to the Commercial Software, together with maintenance and support for the Commercial Software and for the Open Source Software listed in section 2.2. The scope of maintenance, the support level, and any response commitments are set out in the customer's agreement. Fixes and enhancements to the Open Source Software are released publicly under the MIT License; a subscription does not create private versions of them.

5. What a subscription does not include

  • Professional services, custom software development, or bespoke integrations. These are delivered under a separate statement of work.
  • Separately packaged ConfigHub products, meaning software that ConfigHub releases as its own product rather than as part of the ConfigHub Enterprise image or the listed Open Source Software.
  • The ConfigHub SaaS service.
  • The required components listed in section 2.3: the Kubernetes cluster, PostgreSQL, Keycloak, ingress and TLS, and their operation. Hosting and infrastructure costs are the customer's.

6. Versioning

  • The Commercial Software and the Open Source Software follow semantic versioning and share one version number: each release of the Commercial Software is accompanied by releases of the Open Source Software at the same version.
  • An Open Source Software release is tested against, and intended for use with, the Commercial Software release of the same version.
  • Any version starting with 0, (for example v0.1.1) makes no commitments to backwards compatibility or interface stability of any kind.

Release status: as of this edition, ConfigHub Enterprise is pre-GA. Current releases of the Commercial Software and the Open Source Software are at version 0.x. Features and interfaces may change between releases, and breaking changes are announced in the release notes rather than avoided. General availability will be clearly marked in a later edition of this document.

7. Third-party and open source content of the Commercial Software

The Commercial Software incorporates third-party open source components. The notices and full license texts ship inside the container image, so an inventory is available to anyone who has pulled it:

  • /srv/app/THIRD_PARTY_LICENSES.txt: the Go modules linked into the server binary, with license type and source location for each.
  • /srv/app/OS_LICENSE_NOTICE.txt: the operating-system packages in the Alpine base image, including a written offer of corresponding source for GPL-licensed packages.

Application-level dependencies, meaning the Go modules, are under permissive licenses such as MIT, BSD, Apache 2.0, and ISC, with the exception of a small number of Go modules under the Mozilla Public License 2.0, which are used unmodified. The operating-system layer consists of standard Alpine packages, some under the GNU General Public License, distributed unmodified as separate programs alongside the ConfigHub software. ConfigHub's own code does not incorporate copyleft-licensed code.

The Open Source Software carries its own inventories. Each release of github.com/confighub/sdk publishes, next to the cub and cub-worker-run binaries, a THIRD_PARTY_LICENSES-<binary>.txt file listing the Go modules linked into that binary with their license texts, and an SPDX software bill of materials (<binary>-<os>-<arch>.spdx.json) generated from each published binary. The release fails if a dependency under a copyleft license is linked in. The web user interface image carries its license and the notices for the npm packages bundled into it at /licenses/LICENSE and /licenses/THIRD_PARTY_LICENSES.txt. The JavaScript SDK packages ship their license text and declare their dependencies in their package metadata on npm.