Community Edition

Pia Server is available as a free Community Edition for self-hosting. You get local authentication, AI proxy with bring-your-own API keys, sync between desktop clients, end-to-end encryption and an admin dashboard — all running on your own infrastructure.

What’s Included

Feature	Community	Enterprise
Local authentication, MFA, passkeys	Yes	Yes
AI proxy (BYOK)	Yes	Yes
Sync and chat history	Yes	Yes
Admin dashboard, token board, runtime policies	Yes	Yes
Audit log and login-anomaly detection	Yes	Yes
End-to-end encryption, recovery, device management	Yes	Yes
Plugins, MCP, public REST API	Yes	Yes
Groups as the unit of policy	one default group	groups you define
Guardrails	—	Yes
OAuth / Entra ID SSO	—	Yes
Managed personas, client policies	—	Yes
Knowledge bases (RAG)	—	Yes
Max users / admins	5 / 1	per contract

Guardrails, token limits, quotas, provider routing and the plugin allowlist are fields of a group. They carry no gate of their own, but changing them means editing a group — so on a Community licence they stay read-only at their seeded defaults.

Getting a License

Mail kontakt@pia-ai.de and you get a signed .lic file back, free of charge. There is no self-service issuing page — licences are signed offline.

A licence issued without an expiry date is perpetual; otherwise the admin console warns you 30, 14, 7 and 1 day before it lapses.

Docker Setup

The fastest way to get started. A single Docker image serves all editions — the license file determines which features are enabled. The image sits in our container registry — ask for pull access at kontakt@pia-ai.de along with your licence, or for the server source if you would rather build it yourself.

Quick Start

docker run -d \
    --name pia-server \
    -p 8080:8080 \
    -v ./data:/app/data \
    -e License__Path=/app/data/license.lic \
    ghcr.io/pia-ai-dev/pia-server:latest

Drop your .lic into the mounted data directory, or activate it through the setup page below.

Your server is now running at http://localhost:8080.

Docker Compose

For production use, create a docker-compose.yml:

services:
  pia-server:
    image: ghcr.io/pia-ai-dev/pia-server:latest
    ports:
      - "8080:8080"
    volumes:
      - pia-data:/app/data
    environment:
      - JWT_SECRET_KEY=<generate-a-random-64-char-string>
      - License__Path=/app/data/license.lic
    restart: unless-stopped

volumes:
  pia-data:

docker compose up -d

Tip

The server defaults to SQLite — no external database required, data lives in the mounted volume.

Caution

Knowledge bases (RAG) need PostgreSQL with pgvector and a Knowledge:ConnectionString; they do not run on SQLite. That only matters for Enterprise licences, which are the ones that carry the Knowledge feature. For a production stack with Caddy, PostgreSQL and Temporal, use the docker-compose.prod.yml that comes with the server source rather than the minimal file above.

Manual Setup

If you prefer running without Docker:

1. Request the latest server binary at kontakt@pia-ai.de — or build it from the server source, available to customers on request
2. Place your .lic file next to the binary as license.lic
3. Run the server:

./Pia.Server

First-Time Setup

If the server starts without a license file, it enters setup mode:

1. The server writes a one-time setup token to its log on first start — copy it
2. Open http://localhost:8080 in your browser; you’ll be redirected to the setup page
3. Enter the setup token, then upload your .lic file or paste its contents
4. The server activates immediately — no restart needed

An expired, missing or unreadable licence puts the server back into this state. Only /health, sign-in and the setup page stay reachable until a valid licence is installed; your data is untouched, but nothing else runs.

Configuration

Configure the server using environment variables:

Variable	Default	Description
JWT_SECRET_KEY	—	Secret key for JWT token signing (required)
License__Path	./license.lic	Path to the signed licence file
License__Store	file	Set to database to keep the licence in the server_license table instead of on disk
Setup__TokenPath	./.setup-token	Where the one-time setup token is written
Database__Provider	sqlite	sqlite or postgres
URLS	http://+:8080	Listen address and port

Reverse Proxy

For HTTPS in production, put a reverse proxy in front of Pia Server.

Caddy

pia.example.com {
    reverse_proxy localhost:8080
}

Caddy handles TLS certificates automatically via Let’s Encrypt.

nginx

server {
    listen 443 ssl;
    server_name pia.example.com;

    ssl_certificate /etc/letsencrypt/live/pia.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/pia.example.com/privkey.pem;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Connecting Desktop Clients

Once your server is running:

1. Open Pia desktop client
2. Go to Settings → Account
3. Enter your server URL (e.g., https://pia.example.com)
4. Create an account or sign in

A Community licence covers 5 users and 1 admin. Disabling or soft-deleting an account does not free a seat — see the licensing reference.

License Management

After activation, manage your license from the Admin Dashboard:

• View current license info (edition, features, limits)
• Replace your license for version upgrades
• See which features are enabled vs. locked

Upgrading to Enterprise

Need SSO, your own groups, guardrails, knowledge bases or more seats? The upgrade is seamless — replace the licence file from the admin console and the new entitlements apply to the next request. Same server, same data.

The Enterprise Edition is not on sale yet; write to kontakt@pia-ai.de to be told when it is.