Pick the Tabnine deployment with your security team before you sign, because it fixes which models you can run, the hardware you need, and the telemetry that reaches Tabnine. Tabnine runs as secure SaaS, in your VPC, on premises, or fully air-gapped.
When you need this
- Security has to approve an AI coding assistant before any code leaves developer machines.
- You are choosing between Tabnine's SaaS and a private installation.
- You need to tell auditors exactly what data reaches Tabnine and model providers.
Decisions
Secure SaaS
Can code context go to a vendor cloud under a no-retain policy?
What to checkUse SaaS if security allows code context in a vendor cloud. It needs no hardware and serves GPT, Claude, and Gemini through Tabnine's private endpoints. Tabnine documents TLS 1.2 encryption, deletes request context after the answer, and does not train on it.
VPC or on premises
Must the service run in your own environment?
What to checkRun Tabnine's Kubernetes cluster in your GCP, AWS, or Azure VPC or on your own servers. Tabnine has no access to the environment, and you control updates. Host open-weight models on your GPUs, or call private Bedrock, Vertex AI, Azure, or OpenAI-compatible endpoints.
Fully air-gapped
Must the cluster run with no outside connection at all?
What to checkSend metrics to your Prometheus server and logs to your aggregator. Use supported open-weight models or models Tabnine installs on premises. Budget up to 10 TB of storage for a locally hosted provenance database.
Telemetry
What leaves a self-hosted cluster?
What to checkPut telemetry in the security review. A self-hosted cluster that is not air-gapped sends operational metrics and logs to Tabnine every second, and Tabnine keeps them for one week. Tabnine says they contain no code or personal data. Clients send plugin configuration, machine details, hashed identifiers, and total suggestion counts to your own server.
Identity and access
How do engineers sign in and get removed?
What to checkConfigure SAML or OAuth 2.0 SSO and SCIM group sync to Tabnine teams. Assign admin and member roles. Check the license page for seat counts. Deactivating a user frees a seat.
Client rollout
Which plugin do engineers install?
What to checkInstall Tabnine for Enterprise in VS Code, JetBrains IDEs, Eclipse, Visual Studio, or Cursor and point it at your server URL. Keep engineers off the legacy plugin. For offline machines, host the extension and its dependencies internally. A 2024 GitHub issue shows a developer stuck on that install. A February 2025 issue reports the extension starting a Docker container it does not document, so ask Tabnine which local processes the Enterprise plugin runs.
Questions for your team
- Which models must engineers have, and can our deployment run them?
- Who operates and upgrades the cluster, and how fast must security fixes land?
- What do our auditors need to see about telemetry and logs?
- Which GPUs and how much storage do we need for the models and the provenance database?
Red flags
- Choosing an air-gapped install and then expecting frontier models that need an outside connection.
- Engineers installing the legacy Tabnine plugin, which no longer onboards users.
- No owner for cluster upgrades. Tabnine shipped seven enterprise versions between September 15 and October 8, 2026.
- A self-hosted install approved as fully private while metrics and logs still flow to Tabnine.
Products in this piece
Sources
- Official documentation
- 14
- Public source
- 2
- Tabnine docs: Deployment Options
- Tabnine docs: Deployment options and system requirements
- Tabnine docs: Architecture
- Tabnine docs: Privacy
- Tabnine docs: Security
- Tabnine docs: Models (admin settings)
- Tabnine docs: Self-Managed Models
- Tabnine docs: Provenance and Attribution
- Tabnine docs: Single Sign-On
- Tabnine docs: License
- Tabnine docs: Enterprise (private installation)
- VS Code Marketplace: Tabnine for Enterprise
- Tabnine Trust Center
- Tabnine docs: Release Notes
- lcwxz1989 on GitHub: installing the extension on an offline machine (Apr 28, 2024)
- pbower on GitHub: undocumented Docker container started by the extension (Feb 5, 2025)