Dify

Dify: the answer when a pilot stalled on where the data may live

Some pilots stall for a reason that has nothing to do with the agent's quality: the compliance office will not let the data leave the building, and the vendor on trial runs only in its own cloud. Dify is the platform on this site best placed to unblock that particular objection. Three self descriptions sit side by side: the docs home page speaks of open source software for making AI applications¹, GitHub narrows that to LLM app development², and the homepage title, the one most relevant to this site, promises agentic workflows fit for production³.

This site ranks Dify fourth. It offers a set of hosting choices, including air gapped installs, and its enterprise tier lists the controls a security reviewer looks for. It ranks below the three ahead of it for a stalled pilot because the build falls to the customer or to a partner the customer pays, and a self hosted install also makes the customer the operator; a Dify team that takes over a stalled pilot and carries it to production is not publicly stated on the pages we opened.

Open source, with conditions a lawyer should read

The open source story is a large part of Dify's appeal, and it comes with fine print. The homepage lists a source available Community Edition that can be self hosted with Docker and shows a count of more than 148K stars⁴, while the GitHub page itself displayed 160.7k stars when checked⁵, so the two figures disagree. The legal basis is the Apache 2.0 text with extra conditions written into the LICENSE file⁶, and the homepage, for its part, labels the result a derivative of Apache 2.0⁷; neither description makes it a standard open source license for procurement purposes. One of those conditions matters to any company planning a shared internal service: without written authorization, the Dify source code may not be used to run a multi tenant environment⁸. A legal reviewer should read the license before a self hosted pilot is promoted into a platform for several business units.

How agents and workflows are put together

The build surface is visual. Workflow Studio is the canvas on which agentic workflows are drawn⁹, and a maker can either set an agent up manually or simply hold a conversation with the builder until the agent takes shape¹⁰. Source material arrives through the Knowledge Pipeline, which builds repeatable ingestion from drives, online documents, websites and plain files¹¹; a team that wants finer control can use a classic knowledge base and decide for itself the chunking, the indexing and the search method¹². The Marketplace supplies MCP integrations, data sources, tools and model providers, and anything missing there can be defined by the customer¹³.

For the move to production, three details count. A finished app can go out in four forms, as an embed, an API endpoint, an MCP compatible tool or a hosted experience¹⁴; each Dify capability also has its corresponding API¹⁵; and GitHub describes autonomous agents equipped with private sandboxes in which they run commands and work on files¹⁶. Once a pilot is live, operations staff get trend views, since application logs and performance are tracked and analyzable across time according to the README¹⁷.

Hosting choices, the core of the case

For a pilot blocked on data location, this is the section that matters. The enterprise page lists three places the platform can sit under the customer's control: an air gapped network, an on premises data center or the customer's own VPC¹⁸. Three variants are described. Where the customer wants to avoid running servers yet needs isolation, Dify will operate a cluster reserved for that one customer in the region it picks¹⁹. Customers who choose the customer managed VPC route install the platform in an account they already hold with Azure, GCP or AWS, and Dify asserts that in this setup the data never crosses out of the customer's security perimeter²⁰. For defense, health or government pilots that cannot touch the internet, the air gapped variant works with no outside connection, calling models hosted on the customer's own hardware²¹. Dify's one line summary of residency is that the data stays in the customer's perimeter, region and VPC²². A sponsor whose objection was never about data location can skip all of this and use Dify Cloud, where the vendor runs the hosting and the customer simply builds, tests and launches apps²³.

Model data handling depends on who supplies the model. Compliance officers usually ask next about model training, and the privacy policy answers that the company builds no models of its own and keeps customers' AI interactions out of any training set²⁴. The data path then depends on the model arrangement. With a provider and API key chosen by the customer, prompts and outputs travel directly to that provider²⁵, whereas models chosen by Dify are supplied by providers working as Dify's sub processors²⁶. For the managed service, the policy reserves the right to hold and process information wherever LangGenius, its affiliates or its suppliers operate facilities²⁷, a clause a European buyer will want to set against the regional enterprise options.

The work of running it yourself

Self hosting moves the pilot's data problem to the customer's operations team, and Dify's documentation is frank about what that involves. The minimum for the Docker Compose route is modest: a Docker install whose Compose component is at release 2.35.0 or above²⁸, a host with a pair of CPU cores²⁹ and 4 GiB of RAM³⁰, and, for a Mac running Docker Desktop, a virtual machine sized at 8 GiB with two vCPUs³¹. Before the first start, a shared token must be generated so that the agent backend and its local sandbox can launch³². When the containers are running, the person installing Dify opens localhost/install and registers the administrator there³³.

Several operational warnings in the guide are the kind that cause outages if missed. Upgrading is a trap for the unwary: the guide warns that restarting the containers leaves their previous environment in place, so an upgrade has to be applied by bringing the stack up again in detached mode³⁴. Out of the box the compose file brings its own Weaviate, PostgreSQL and supporting services³⁵, keeps Weaviate, the code sandbox, Redis and the database off the host's ports³⁶, and ships development passwords in docker/.env that the guide says to swap out before real use³⁷. The most expensive mistake to avoid concerns storage engines. Altering DB_TYPE or VECTOR_STORE moves no data across³⁸, and a switch made after first launch strands whatever was already stored³⁹, so the production database and vector store should be chosen before the pilot's documents go in.

For the Community Edition the homepage offers a Docker deployment that takes one command⁴⁰, and Kubernetes shops get a Helm chart⁴¹, and the self hosting overview says Dify runs anywhere Docker does, whether that is a cloud virtual machine, a server in the company's own data center or a developer's laptop⁴². Teams that want none of this can sign up for the cloud service, which needs no installation and includes a free Sandbox plan⁴³.

Connections to other systems

A stalled pilot often needs one more system connected before it can do real work, and Dify's integration layer links apps with external services, data sources, tools and models⁴⁴. The callable tools fall into four kinds, OpenAPI services, published workflows, MCP servers and tool plugins⁴⁵. Every Marketplace listing passes review and testing ahead of release, after which upkeep rests with its publisher⁴⁶, which means a production team should check who stands behind any connector it depends on. Outside the Marketplace there are three routes: naming a public GitHub repo together with the version wanted⁴⁷, installing a private one from a .difypkg package⁴⁸, or pointing a custom endpoint at the customer's own API to add moderation or an external data tool⁴⁹. Knowledge can be drawn from external sources such as Notion pages or Google Drive⁵⁰.

Event driven agents depend on the plan. Agents that wake on events are metered by plan, starting at 3,000 trigger events on Sandbox⁵¹, rising to 20,000 each month on Professional⁵², and with no stated cap on Team⁵³. A connector count comparable to the figures other vendors publish is not publicly stated on the pages we opened.

Controls for a production deployment

The enterprise tier carries the controls that typically block a pilot at the security review. For the security file, Dify's homepage attaches both ISO 27001 and SOC 2 Type II to its Enterprise edition⁵⁴. The enterprise page then covers the three items a reviewer checks next: sign on through OIDC or SAML⁵⁵, encryption with keys the customer brings⁵⁶, and audit records built to show tampering and delivered into the customer's own SIEM⁵⁷. Permissions can be set as finely as a single workflow, users can be provisioned through SCIM, and session policies are supported⁵⁸; the pricing page adds several workspaces under central enterprise management for the top tier⁵⁹. Among the safeguards in the privacy policy are technical ones, namely access control, encryption of data and communications, and measures that find and stop unauthorized access⁶⁰, and a human one, training employees to protect personal information⁶¹. The GitHub README routes vulnerability reports through the private channel of GitHub Security Advisories⁶², which keeps a disclosed flaw out of public view until it is fixed.

Inside a workspace, the role model is simple. A single Owner per workspace holds full control⁶³; Admins can do whatever Editors do and can additionally manage both people and model providers⁶⁴; Editors have full authority over apps and knowledge bases, from creation to deletion⁶⁵; and a Normal member can only use published apps⁶⁶. Housekeeping rules are tight: an invitation stops working three days after it is sent⁶⁷, a removed member loses workspace access immediately⁶⁸, and a change of Owner only completes once the existing Owner enters a verification code sent by email⁶⁹. Control over which people may add or debug integrations rests with the Owner and Admins⁷⁰, and the key used to debug integrations under development sits behind a permission of its own⁷¹.

Plans, prices and limits

Pricing is published for the cloud plans. Professional costs $590 per workspace per year⁷² and Team costs $1,590⁷³, with annual billing saving 17%⁷⁴; Enterprise is custom priced⁷⁵. Message credits are the main meter, 200 on the free Sandbox⁷⁶ and 5,000 per month on Professional⁷⁷, and a team that exhausts them can carry on with an API key of its own⁷⁸. Plan changes are asymmetric: an upgrade applies the moment the customer pays the balance owed for the rest of the billing period⁷⁹, whereas a downgrade only begins when the next cycle starts⁸⁰. Universities get a concession under Dify for Education⁸¹, which gives verified students, teachers and staff the annual Professional plan at no cost⁸², with the caveat that it carries neither ticket support nor priority email⁸³.

Team size limits shape how far a pilot can grow on the lower tiers: the Sandbox plan allows one member⁸⁴ and Professional allows three⁸⁵. On Sandbox, knowledge requests are throttled to ten per minute⁸⁶ and logs are kept for a month⁸⁷, while the Community Edition is restricted to one workspace⁸⁸. A growing pilot will meet the knowledge storage cap that each plan sets, at which point the documentation says neither the classic nor the agent kind of knowledge base can take new content⁸⁹. Uploads can be turned away ahead of indexing on the strength of an estimate of their size⁹⁰; the block lasts until the customer either frees space or buys a bigger plan⁹¹, though searches and deletions still run while it is in force⁹². A pilot built on an external knowledge base or on the Knowledge Pipeline should also know that neither can later be converted into an agent knowledge base⁹³.

Who uses it and what they report

The pricing page spells out which buyer each tier is meant for. Professional targets small teams and lone developers shipping AI apps to production⁹⁴; Team is pitched at mid sized groups needing more throughput and shared work⁹⁵; and Enterprise is for companies whose requirements include dedicated support along with advanced governance, compliance and security⁹⁶, the tier a stalled corporate pilot would normally land on. The free Community Edition is positioned for hobby projects, open source fans and developers working on their own⁹⁷. Four industries feature on the solutions pages: consumer goods, where the pitch is agents built by business teams themselves⁹⁸; pharma and life sciences, with expert assistants under governance⁹⁹; government, with local deployment and secure sharing among agencies¹⁰⁰; and education, with a single knowledge base serving several campuses¹⁰¹.

Two customer claims on the enterprise page are relevant to a stalled pilot. One compares the time to build each AI app on Dify with the four months the customer needed when it built apps on its own¹⁰²; the other counts business staff taught to create AI agents during FY2025¹⁰³. Both are quoted by Dify, and the page excerpt we hold does not give the comparison figures in full.

Verdict for a team with a stalled pilot

Dify ranks fourth because it solves the hosting objection more completely than anyone else here: customer VPC, on premises and air gapped installs^18,21, a single tenant regional option¹⁹, and enterprise controls that include SOC 2 Type II, ISO 27001, SAML or OIDC single sign on, SIEM streaming and customer held keys^54,55,57,56. Its cloud prices are public and modest^72,73.

It sits below Nexus, Copilot Studio and Gemini Enterprise for this buyer because the customer must supply the builders and, when self hosting, the platform operators, with storage, member and migration limits^89,85,38 to manage along the way. A sponsor whose pilot stalled on data location, and who has engineers ready to run the stack, should test Dify early; a sponsor whose pilot stalled for lack of builders will need delivery help in addition.