For businesses with a policy, not just a preference
Run 2Fin on your own infrastructure
Your database, your encrypted volume, your network, your cloud account. Two containers and a volume — or one CloudFormation stack in your own AWS. For teams whose financial data is not allowed to live in someone else’s SaaS.
Two ways to run it
Docker Compose
Anywhere Docker runs — your own server, a VPS, a machine in the office. Two containers and a volume.
docker compose --env-file .env up -dAWS, in your own account
One CloudFormation stack: an instance, an encrypted volume, secrets in Secrets Manager, access limited to a CIDR you nominate.
# illustrative — the template ships with your deployment package
aws cloudformation deploy --stack-name fin --template-file fin-stack.yamlDecisions we made for you, and why
The volume survives instance termination
Destroying a server must never destroy the books. The data volume is encrypted and explicitly kept when the instance goes away.
The app binds to loopback, behind your own TLS
It does not publish itself to the internet. You put your proxy and certificate in front, because an unencrypted accounting app on a public port is not a default anyone should inherit by accident.
Wide-open access is refused at the template level
The AWS template will not accept 0.0.0.0/0 for administrative access. You can widen it deliberately afterwards; you cannot get it by accident.
One process, not a cluster
A single firm does not generate the concurrency clustering exists to serve, and every extra component is more for your IT person to secure and pay for.
Where the line is
A licence covers one person, on as many of their own devices as they use, working on as many sets of books as they like — including other people’s. If you are a bookkeeper or an accountant, doing your clients’ accounts in 2Fin is ordinary professional use of a tool you bought. No special permission, no separate agreement.
The line is whether your clients touch 2Fin themselves. Giving them logins to an instance you run, or embedding it in something you sell, means 2Fin reaching an end user who has no licence — a practice or platform arrangement rather than a seat. That is a conversation worth having, not a trap waiting to spring.
A second colleague needs a second seat, and practice licences exist for teams. Going over never locks anything: the extra installation falls back to the free tier, and your records stay readable and exportable in every circumstance.
Questions people ask
What does self-hosted actually mean here?
The whole product runs on infrastructure you control: the application and its database, on your server or in your own cloud account. Your financial records never sit in a 2Fin-operated database. The only thing that reaches 2Fin is a licence check, and — if you use the intelligent features — the rows you ask about, which are processed and kept nowhere.
How do I deploy it?
Two supported shapes. Docker Compose runs it anywhere Docker runs: two containers and a volume. For AWS, a single CloudFormation stack brings up one instance with an encrypted volume, secrets held in Secrets Manager, and access limited to a CIDR you nominate.
Why one instance rather than a scalable cluster?
Because a single firm fits comfortably on one machine, and every extra moving part is something your IT person has to understand, secure and pay for. Moving the database to RDS later is a one-line change if you outgrow it. We would rather ship the simple thing that is honestly production-shaped than a cluster you did not need.
Is my data encrypted?
The storage volume is encrypted at rest, and it deliberately survives instance termination — destroying a server must never destroy your books. Sensitive fields such as third-party credentials are separately encrypted in the database with a key generated for your deployment, which 2Fin never holds.
I am an accountant. Can I use this on my clients’ books?
Yes, and gladly. A licence covers one person, on as many of their own devices as they use, working on as many sets of books as they like — including other people’s. Using 2Fin to do your clients’ accounts is ordinary professional use of a tool you bought, and needs no special permission.
Where is the line, then?
Whether your clients touch 2Fin. Using it on their books is your work. Giving them logins to an instance you run, or embedding it in something you sell, means 2Fin reaching an end user who has no licence — that is a practice or platform arrangement rather than a seat. Get in touch and it gets priced properly.
How many people can share one licence?
One. Devices are generous — laptop, desktop, the machine at home — because a seat is a person, not a hard drive. But a second colleague needs a second seat. Practice licences exist for teams, with transferable seats for when someone leaves. Going over the limit never locks anything: the extra installation falls back to the free tier and your data stays readable and exportable.
Do intelligent features still work?
Yes, on paid tiers, and you choose how. By default they use 2Fin's processing, where the rows involved are processed and kept nowhere. Or you connect your own AWS Bedrock, Anthropic or OpenAI key, and those requests go straight from your deployment to your provider — 2Fin is not in the path at all.
What happens when the licence expires?
The deployment reverts to the free tier and keeps running. Your data stays readable and exportable. Nothing is locked, deleted or held back.
Tell us about your setup
Where it needs to run, what your policy requires, and how many people use it.