Host Open WebUI on Postgres and Redis behind TLS, connect SSO and SCIM, and turn the audit log on before staff arrive. Set retention in your own database, connect model backends deliberately, and stage every upgrade on a copy, since a v0.12.0 rollback is the recent lesson. This checklist covers hosting, identity, audit and retention, model backends, and upgrades.
When you need this
- Staff use public chat assistants for work and legal wants chats on company servers.
- A team runs Open WebUI for itself and the rest of the company wants access.
- Security asks who can sign in, what is logged, and how long chats are kept.
Evaluation criteria
Host it for production
What does the app need under it?
Look forRun Postgres for the database and Redis once there is more than one replica, since Redis coordinates sessions and real-time events across them. Put it behind a reverse proxy with TLS; one practitioner would not publish it on a raw port. Deploy on VMs, managed containers, or Kubernetes with Helm, on-premise or air-gapped if needed.
Connect identity
How do people sign in and leave?
Look forUse SSO through OIDC or OAuth 2.0, or LDAP and Active Directory, and enable SCIM 2.0 so your identity provider creates and deactivates users and groups; SCIM is included in the free edition. Define roles with RBAC and keep file uploads and knowledge off by default, granted by group.
Log requests and set retention
What is recorded, and for how long?
Look forSet AUDIT_LOG_LEVEL, which defaults to NONE, to METADATA or REQUEST, and send the log to your SIEM through stdout. Write chat retention into your database jobs, because you own the database and its retention policies. Compliance certifications apply to your deployment, so your controls are the evidence.
Connect model backends
Which models can staff reach, and on whose keys?
Look forAdd local backends such as Ollama and hosted model APIs on company keys, and set DEFAULT_MODELS for new chats. Test the features you rely on per backend: practitioners report no Anthropic prompt caching and no image generation through Ollama.
Stage every upgrade
How does a release reach production?
Look forRun each release on a staging copy with real backends, tools, and several users first. One three-replica deployment rolled v0.12.0 back to v0.11.4 after memory grew to 8 to 11 GB per container, and another user's web search stopped silently after an earlier update.
Decide on branding
Do you need your own branding?
Look forThe license keeps the Open WebUI branding on deployments above 50 users in a rolling 30-day period unless you have written permission or an enterprise license. Ask Open WebUI for a quote from your end-user count if white-labeling or enterprise-only features such as Terminals matter.
Questions to ask vendors
- Who owns hosting, the database, Redis, and upgrades, and who is on call?
- Is SCIM connected, and which groups can upload files or create knowledge bases?
- Which audit log level are we running, and where does the log go?
- How long do we keep chats, and which job deletes them?
- Which release are we on, and what does a staging run check before an upgrade?
Red flags
- The app published on a raw port without TLS or a reverse proxy.
- AUDIT_LOG_LEVEL left at NONE in a deployment security has approved.
- More than one replica with no Redis, or upgrades applied straight to production.
- Model API keys held by individuals when the company should hold them.
- Branding removed on a deployment above 50 users without an enterprise license.
Products in this piece
Sources
- Official documentation
- 8
- Public source
- 4
- Open WebUI docs: Enterprise
- Open WebUI docs: Enterprise security
- Open WebUI docs: Environment variable configuration
- Open WebUI docs: License
- Open WebUI docs: Ollama
- Open WebUI docs: Chat data privacy and encryption
- Open WebUI docs: Logging
- Open WebUI v0.12.0 release notes (Oct 10, 2026)
- open-webui/open-webui issue #32267: v0.12.0 multi-instance containers grow to 8-11 GB, v0.11.4 stable (Oct 12, 2026)
- r/selfhosted: web search stopped silently after an Open WebUI update (Jul 16, 2026)
- Steven Marks, totaldebug.uk: Self-hosted LLMs with Ollama and Open WebUI using Docker Compose (Jul 6, 2026)
- Hacker News comment on missing Anthropic prompt caching in Open WebUI (May 27, 2026)