# Self-hosted diagram renderer Text diagrams are normally drawn by our rendering service. If your policy says diagram source must not leave your network, point the app at your own Kroki-compatible server instead. Everything else stays the same: the same languages, the same editors, the same storage in your Confluence site. --- ## When you would change this * Regulated environments where source may not leave the network. * Organisations with an existing Kroki deployment. * Air-gapped or heavily restricted networks. --- ## What you can set | **Setting** | **What it does** | | ------------- | -------------------------------------------------------------------------- | | Requirement | A Kroki-compatible server reachable from your users' browsers. | | Configuration | The renderer URL, set in site settings. | | Egress | The renderer's domain must be approved as an egress domain. | | Scope | Text languages only. draw.io and Excalidraw already render in the browser. | --- ℹ️ **This is the answer to the hardest security question.** Combined with source stored in your own Confluence site, a self-hosted renderer means diagram content never reaches us at all. --- ## A few things that catch people out * The server must be reachable from the reader's browser, not only from your data centre. * Version differences between your Kroki and ours can render the same source slightly differently. * If the renderer is unreachable, diagrams fail to draw rather than silently falling back to ours. --- ## Related [Turn off AI featuresOne switch, three surfaces.](https://help.gocapable.com/diagrams/turn-off-ai-features.html) [Diagram settings overviewWhere the settings live, and which wins.](https://help.gocapable.com/diagrams/diagram-settings-overview.html) [ExamplesWorking diagrams you can copy.](https://help.gocapable.com/diagrams/examples.html) --- _Set it once, in the right place._