Why self-hosted cloud governance is not optional for regulated enterprises

The cloud governance market is dominated by SaaS platforms. Wiz, Prisma Cloud, Orca Security — these are capable products with strong cloud security capabilities. They are also, by design, platforms where your infrastructure data, security findings and compliance posture are processed outside your regulated environment.

For cloud-native companies without strict data residency requirements, this is an acceptable trade-off. For financial services firms, NHS organisations and government bodies, it is not.

FCA and financial services

FCA PS21/3 requires regulated firms to maintain oversight and control of their data processing arrangements. When a SaaS governance tool processes your infrastructure data, it creates a material outsourcing arrangement that requires its own documentation, oversight and exit planning.

The compliance posture of your cloud estate — including findings about misconfigurations, access control failures and data exposure — is being processed in a third-party environment. This is not a grey area under FCA PS21/3.

NHS and government

NHS organisations face the same structural challenge. The NHS Data Security and Protection Toolkit requires that all data processing tools used in NHS environments are documented and reviewed. Patient data and clinical system data should not be processed by third-party SaaS platforms without explicit DPIA and DSPT compliance review.

Government organisations face the most stringent requirements. G-Cloud Cloud Security Principles require government organisations to understand how their data is handled by cloud service providers. For OFFICIAL-SENSITIVE environments, the principle of data residency within the government's own tenancy is not negotiable.

ZAP's architecture is the answer

ZAP was built from the first line of code as a self-hosted platform. Zentej has zero access to your infrastructure data, compliance findings or ZAP AI queries — not limited access, not audited access, not access upon request. Zero.

It runs entirely within your Azure, AWS or GCP subscription. There is no telemetry, no callback and no data sharing agreement. This is not a feature that was added in response to customer requests. It is the architecture. Self-hosted is the design, not a deployment option.

Structural, not contractual

ZAP's self-hosted architecture satisfies FCA PS21/3, NHS DSPT and G-Cloud data handling requirements structurally — not through contractual assurances in a terms of service agreement, but through the architecture itself: the data cannot leave your tenancy because ZAP does not have the capability to exfiltrate it.

When evaluating cloud governance tools, the first question for any regulated enterprise should not be about feature capability. It should be: where does my infrastructure data go? For financial services, NHS and government organisations, the only acceptable answer is: it stays in my environment.

See ZAP live

Book a 30-minute session with the Zentej team. We show you ZAP live on our instance — landing zone, compliance scan, evidence generation, ZAP AI. No commitment.

Book a session