docker-compose.selfhost.yml runs the craclock binary, Postgres and Caddy together:

docker compose -f docker-compose.selfhost.yml up -d
craclock migrate

Self-hosting keeps every byte of case data on your own infrastructure. The ruleset stream (regulatory updates) still fetches over the network unless you disable it. See Security for how case data is encrypted at rest either way.