Run it yourself

Install Sengol inside your own network.

Docker Compose for a laptop, Helm or Terraform for a cluster, or pip install sengol to embed the SDK directly. Every path takes a licence file and never phones home.

laptop or single host

# the compose bundle ships in the sengol repository
git clone https://github.com/sengol-io/sengol.git
cd sengol
cp .env.example .env

# put your licence where the container expects it — the file we
# sent you is wherever you saved it, not inside this checkout
mkdir -p /etc/sengol
cp /path/to/sengol.lic /etc/sengol/sengol.lic

# edit .env: SENGOL_LICENSE_FILE, KMS signing key, Postgres DSN

docker compose up -d

# tail logs until the API reports ready
docker compose logs -f api

Brings up the API, the Console, Postgres and a connection pooler. Point SENGOL_API_URL at http://localhost:8080 from the SDK.

Kubernetes cluster

# the chart is published as an OCI artifact with each release
kubectl create namespace sengol

# mount the licence file as a Secret, not a ConfigMap
kubectl create secret generic sengol-license \
  --from-file=license=./sengol.lic -n sengol

helm install sengol oci://ghcr.io/sengol-io/charts/sengol \
  --version <release> --namespace sengol \
  --set license.existingSecret=sengol-license \
  -f values.yaml

The chart wires SENGOL_LICENSE_FILE to the mounted secret path automatically. See values.yaml for HA replica count, ingress and KMS signing options.

shell

# the stacks ship in the sengol repository: terraform/aws, /azure, /gcp
git clone https://github.com/sengol-io/sengol.git
cd sengol/terraform/aws

terraform init
terraform apply -var-file=environments/prod.tfvars

Provisions the compute, the audit store, KMS signing keys and the load balancer.

Infrastructure only — the licence handoff is not wired yet. The stacks take the signing-key and JWT secret ARNs, but they have no licence input, so a Terraform apply on its own brings up an appliance that fails its licence check at boot. Place the licence on the task yourself, or use Docker Compose or Helm, until the stacks accept one.

your agent's environment

pip install sengol

# SDK only — points at an API you already run (Compose/Helm/Terraform above),
# it does not construct a Postgres store itself
export SENGOL_API_URL=https://sengol.internal.yourbank.com
export SENGOL_LICENSE_FILE=/etc/sengol/sengol.lic

agent.py

import sengol

sengol.configure(
    agent_id="kyc-triage-agent",
    agent_version="2.4.0",
    policies=["OSFI_E23", "PIPEDA"],
)
sengol.instrument()

Use this when you already have (or are trialling) the hosted instance or a self-hosted API and just need agents talking to it.

Licence file

Where the licence goes, and what it does when it expires.

Environment variable	`SENGOL_LICENSE_FILE=/etc/sengol/sengol.lic`
Default path	`/etc/sengol/sengol.lic` — override with the variable above if your mount differs.
Renewal	The status is cached for at most a minute, and the cache is cut short at the licence's next expiry boundary. Replace the file in place and the appliance picks it up within about a minute — no restart.
Format	A signed licence (JWT, ES256) issued to your organisation and signed by a P-256 key held in Sengol's AWS KMS; verified offline against the public key baked into your build — no network call, no phone-home.
Docker Compose	Bind-mount the file and set the env var in `.env`.
Helm	Store it as a Kubernetes `Secret` and name it in `license.existingSecret`; the chart mounts it at `/etc/sengol/license/sengol.lic` and sets the variable for you.
Terraform	Not yet wired: the stacks have no licence input. Place the licence on the task yourself — the appliance reads `SENGOL_LICENSE_FILE` the same way it does under Compose and Helm.

Expiry stops evaluation. It never stops access to evidence. When a trial or annual licence lapses, agent calls stop being evaluated and gated — but the Console keeps serving reads, exports keep working, and sengol-verify keeps verifying every record you already have. Nothing you've signed becomes unreadable because a licence ran out.

15-minute quickstart

From a fresh install to a verified evidence pack.

Five steps, about fifteen minutes, no bank data required.

01

Seed the demo

Run the bundled reference agent against a sample KYC dataset so there's real evidence to look at, not an empty Console. make demo is a target in the repository, so run it from the repository root. Compose users are already there; the Helm and pip paths never clone, and the Terraform path leaves you in terraform/aws.

# only if you have no checkout yet
git clone https://github.com/sengol-io/sengol.git && cd sengol

# then, from the repository root
make demo

02

Look at a trace

Open the Console and open one interaction: the deterministic checks, the judge verdicts, and the signed record they produced.

open $SENGOL_API_URL

03

Decide a review item

Pick an item the demo routed to human review, approve or reject it, and watch your decision get written as its own signed record.

Console → Review queue

04

Export a pack

Export the agent's evidence for the period as a portable bundle — the same export format an auditor receives.

sengol export --tenant default --agent kyc-triage-agent --out pack.json

05

Verify it, offline

Install the separate verifier and check the bundle with no network call and no access to your Sengol instance at all.

pip install sengol-verify
sengol-verify pack.json

Ready when you are

Get a 14-day licence and start the quickstart today.

Get the self-hosted trial Or skip install — try it hosted