Entirely yours,or run by a partner.
The software is the same either way. The question is who keeps the server running, and where the evidence lives.
Inside the EU, and portable out of it.
Hosted means a partner’s infrastructure inside the EU. Either way the fleet document lives in a repository you own, so leaving is a matter of taking that repository with you and pointing a control plane at it.
Restricted and air-gapped networks.
Devices pull; nothing reaches in from outside. That is what makes an air-gapped deployment ordinary rather than an exception, as long as you can mirror the packages your fleet installs.
Self-hosted is not on your own.
A support agreement covers the fleet, not the address it runs at. You can run the control plane in your own data centre and still have a named engineer, agreed response times and someone who picks up when an upgrade goes sideways. Nobody can operate your infrastructure while you sleep unless you ask them to, and that is the only real difference.
One document for every laptop.site.audit.
Take it, run it, help build it.
The software is yours under the EUPL 1.2 and needs nobody’s permission. What the project needs is people: a laptop model we have never imaged, a language nobody has translated, a bug found by running it for real.