Guides
Internal tool hosting with SSO: options compared
Four ways to host an internal tool behind SSO: your own servers behind a VPN or proxy, a general hosting platform, an internal-app builder, or Inhaus.
There are four common ways to host an internal tool behind single sign-on: run it on your own servers behind a VPN or login proxy, put it on a general hosting platform and add login, rebuild it in an internal-app builder, or deploy it to a service like Inhaus that puts company login in front of every app. The right one depends on who maintains it, how many tools you have, and where the tool was built.
This page compares the approaches in general terms. Features and prices of specific products change often, so check each vendor's current docs before you decide.
The options
1. Your own servers, behind a VPN or login proxy
You run the tool on servers or a cloud account your company controls. People reach it over the company VPN, or through a proxy in front of the app that asks them to sign in with your identity provider.
- Good for: teams with IT or engineering staff, strict rules on where data lives, or an identity setup they already run.
- Watch out for: someone has to set up and keep up the servers, the proxy and updates. Each new tool needs its own setup. Checks for leaked keys and a log of who opened what are extra work.
2. A general hosting platform
You deploy the tool to a hosting platform built for developers' web apps. Login comes from the platform's own access controls, where they exist, or from login code you add to the app.
- Good for: developers who already use git and build settings, and public sites that need to scale.
- Watch out for: company login is usually set up per app, and what is available can depend on the plan. Checking for leaked keys, sharing by team and a record of who opened each app are often separate tools, or work you do yourself.
3. An internal-app builder
You rebuild the tool in a platform made for internal apps, with its own editor, sign-in and permissions.
- Good for: teams that want to build forms, dashboards and admin panels inside one product.
- Watch out for: you usually build inside that product's editor. A tool that an AI already wrote elsewhere has to be rebuilt there.
4. Inhaus
Your AI tool deploys the app it built straight to Inhaus through an MCP connector. Every app sits behind sign-in with your company's Google or Microsoft account.
- Good for: non-developers who built a tool with Claude, ChatGPT, Cursor or similar and need to share it safely, and admins who want one view of every such app.
- Watch out for: apps must be HTML, JavaScript or TypeScript (Python is planned). Server code runs on a web runtime without Node.js built-ins. There are no custom domains yet: apps live at
<app>--<workspace>.inhaus.dev. Sign-in for app viewers is with Google or Microsoft accounts. See Limits.
Side by side
| What an internal tool needs | Own servers + VPN or proxy | General hosting platform | Internal-app builder | Inhaus |
|---|---|---|---|---|
| Company login | You set it up | Set up per app, varies by platform | Usually built in | Built in on every app |
| Who maintains servers | You | The platform | The platform | Inhaus |
| Use a tool an AI already built | Yes | Yes | Usually rebuilt | Yes |
| Deploy from the AI chat | Depends on your setup | Depends on the platform | No, you build in its editor | Yes |
| Share per app with people or teams | You build it | Varies | Usually | Yes, like a doc |
| Check for keys in code before sharing | Add a separate tool | Add a separate tool | Varies | Every deploy |
| Log of who opened each app | You build it | Varies | Varies | Built in |
| Works without writing code | No | Some setup needed | Usually, in its editor | Yes |
How to choose
- You have engineers and strict data rules: your own servers behind a proxy gives you the most control.
- You are a developer shipping a public or large app: a general hosting platform fits best.
- You want to build new internal apps by dragging and dropping: look at an internal-app builder.
- People are already building tools with AI and need to share them safely: Inhaus takes the app from any MCP-capable AI tool and handles hosting, login, sharing, the security scan and the access log.
FAQ
What does SSO mean for an Inhaus app?
People sign in with their company Google or Microsoft account at the Inhaus gateway before the app loads. The app never handles passwords. See Deploy an AI-generated app behind SSO.
Where does Inhaus keep data?
Accounts, apps, permissions and the access log are in PostgreSQL on AWS in us-east-2 (Ohio). Apps run in isolated sandboxes on Cloudflare's network. See Security overview.
Can I use Inhaus and a hosting platform together?
Yes. You can keep public sites on a hosting platform and put internal tools on Inhaus. Inhaus is for apps only your company should open.
What does Inhaus cost?
Viewers are always free. Every new workspace gets 7 free days, then the Company plan is $20 per active builder a month, or $18 billed yearly. See Plans.
Can Inhaus host Python apps?
Not yet. Python is planned. Today apps are HTML, JavaScript or TypeScript.