If you work in healthcare, finance, government, or any regulated industry, you've had this conversation:
"We want to adopt visual regression testing." "Where do the screenshots go?" "They get uploaded to the vendor's cloud for comparison." "No."
End of conversation. The compliance team doesn't care how good the diff algorithm is. They care that screenshots of your internal application - potentially containing patient data, financial figures, or classified information - are being transmitted to a third party's infrastructure.
Why Cloud Visual Testing Fails Compliance
Every major cloud visual testing tool works the same way: your CI captures screenshots, uploads them to the vendor's cloud, the vendor compares them, and screenshots remain stored on vendor infrastructure.
For an internal healthcare dashboard, those screenshots contain PHI. For a banking application, they contain financial data subject to SOC 2, PCI DSS, and GLBA. For government applications, the screenshots may contain CUI that cannot legally leave certain network boundaries.
Most vendors don't offer on-premise deployment, data residency guarantees, FedRAMP authorization, or BAAs that cover screenshot data. Applitools has an enterprise on-prem option - at six figures annually. Percy and Chromatic are cloud-only.
The Self-Hosted Architecture
Self-hosted visual testing keeps everything within your network boundary. Screenshots are captured, compared, stored, and reviewed entirely on your infrastructure. The deployment is a Docker Compose setup:
git clone https://github.com/las-team/lastest.git
cd lastest
docker-compose up -dYour compliance team can audit the entire data flow. No third-party data processor to evaluate. No vendor security questionnaire. No BAA negotiation.
The AI Question
What AI sees: Text prompts describing what to test, selector information, error messages. Not screenshots or rendered UI.
For organizations that can't even send text descriptions:
- Fully local AI with Ollama. Run an open-source LLM on your own hardware. Zero API calls. Zero data leaves the network.
- AI-free mode. Point-and-click recording. No AI, no API keys, no external communication.
Diff Processing: No Cloud Required
All three diff engines - pixelmatch, SSIM, and Butteraugli - run locally in TypeScript on your server. Text-region-aware diffing uses Tesseract.js for OCR, also bundled locally. The SHA256 hash fast-path is a local computation. Nothing leaves your network.
Air-Gapped Operation
Some environments have no internet access at all. A properly containerized tool with bundled dependencies works in air-gapped environments out of the box. The Docker image includes the application, database, browser, diff engines, and OCR models.
The only features lost in air-gap mode are cloud AI (use Ollama) and GitHub/GitLab integration (use local git hooks).
What You Gain
- Compliance by architecture. No data processor evaluations. No vendor security audits. Your data never enters a third party's control.
- Zero recurring cost. No per-screenshot fees. No monthly subscriptions.
- Unlimited scale. The only limit is your CI runner's compute capacity.
- Full auditability. Every screenshot, diff, and approval decision in your database on your infrastructure.
For most regulated industries, self-hosted isn't a preference - it's a requirement. The good news is that self-hosted visual testing in 2026 isn't the "roll your own BackstopJS scripts" experience it was in 2020. Docker-based tools with full dashboards, approval workflows, and AI assistance exist. The compliance conversation doesn't have to end at "no."