Agreed, self-hosting is a must, and for most security-minded/regulated companies it needs to be source available for audits. Deploying a proprietary app at the level this will need to be is a no-go unless you have a big (and trusted) corp behind it.