Self-Hosted Deployment

On-Site Web Filtering for Schools

Run the filter inside your own network, on hardware you control. Student browsing records never leave the district, policy is enforced at your edge, and the categorization data behind it — more than 120 million classified domains — refreshes daily from our side without your traffic ever passing through ours.

100%Logs kept in-network
120M+Domains in the dataset
DailyCategory refreshes
57+Content categories
100% In-Network Logs
Your Hardware
Daily Data Refresh
CIPA-Aligned
Hybrid Option
What on-site means

What “on-site” actually means for a district

Cloud filtering is the fast default, and for many schools it is the right one. On-site web filtering for schools exists for the districts where one of four requirements outweighs convenience.

Local decisions, local data

In an on-premise deployment, the component that decides whether a page loads sits inside your building — typically a virtual machine or appliance at the network edge. Requests from classrooms hit it directly, it consults a locally stored copy of our category database, and it answers in the time it takes to traverse your own LAN.

Browsing stays private

Nothing about a student's browsing has to be sent to an outside service to make that decision. The lookup happens against local data, the block page is served locally, and the log entry is written to storage the district owns. Your internet link is used for learning traffic, not for round-trips to a vendor.

One-way update feed

What does cross the internet is small and one-directional: a signed update feed that delivers fresh category data every day, so a domain registered this week is already classified when a student tries it next week.

Data residency

Board policy, state guidance or community expectation says student browsing records stay on district-owned systems. On-prem makes that a fact of architecture, not a clause in a vendor contract.

Full local control

Your team wants to change a policy, grant an exception or pull a log at 7:45 on a Monday morning without opening a ticket with anyone. The console is yours; the change is immediate.

Predictable behavior

Filtering decisions do not depend on the health of an internet path to a vendor's region. If your LAN is up, the filter is up, at LAN latency — a real consideration for rural links.

Staying current

How a local filter stays current with a moving web

The weakness of traditional appliances was never the hardware; it was the data going quiet. A box configured in August with a static list is meaningfully blind by October.

Classification — deciding what 120 million-plus domains actually are — happens continuously on our side, including newly registered domains as they appear. Enforcement happens entirely on yours. The bridge is a daily update your appliance pulls automatically, so the local database is never more than a day behind the live web.
Because domains carry multiple category labels, the local engine makes the same nuanced calls the cloud makes. A site tagged both “Video” and “Adult” is handled by whichever policy is stricter for that grade band, and SafeSearch enforcement applies to the search engines students actually use.
Encrypted HTTPS traffic is categorized by domain, so the shift to an all-encrypted web does not blind the filter. The local engine sees what it needs to without inspecting payload, maintaining both privacy and accuracy.
What stays on-prem is custody of your traffic and your records — not yesterday's picture of the internet. For the broader case for category-driven filtering, see our overview of web filtering software for schools.
An honest comparison

On-premise vs. cloud: where each model genuinely wins

Both deployments run on the same categorized dataset, so blocking accuracy is identical. The trade-offs are operational — and they are real in both directions.

Decision factorOn-premiseCloud
Browsing data stays in-district Always, by design Processed by the service
Filtering survives WAN issues Runs on the LAN Depends on the internet path
Full administrative control Your hardware, your rules Within the vendor console
Rollout speed Days: provision and integrate Same afternoon
Covers take-home devices Only via hybrid setup Follows the device anywhere
Hardware to maintain One VM or appliance None

Choose on-prem when…

Your governing board treats browsing logs as records that must never sit on third-party infrastructure. The self-hosted model is the only one that answers that requirement directly — and a hybrid can close the take-home gap.

Choose cloud when…

Your 1:1 program sends Chromebooks home every night and your team is small. Start with cloud-based web filtering for schools — cloud wins on speed and reach.

The engine underneath

Self-hosted does not mean second-tier data

A common fear about appliances is that they run on stale lists. Here, the on-prem deployment consumes exactly the classification stream the cloud service does.

120M+Domains classified
57+Content categories
Multi-labelCategories per domain
24hMaximum data age
Adult content Gambling Self-harm Malware Weapons AI tools Streaming Social
Getting to production

A realistic on-prem rollout, start to finish

Self-hosting adds a provisioning phase that cloud skips, but for a team that runs its own infrastructure none of these steps will be unfamiliar.

01

Size and provision

Choose a VM or appliance sized to your concurrent-user count and place it where traffic already converges — usually beside the firewall at the district edge, or per-building for large campuses.

02

Load dataset & connect updates

The initial category database is installed locally and the daily update feed is verified, so the box is current before it filters its first request.

03

Define policy by grade

Set category rules per elementary, middle and high school, per building and per user group, then layer your own allow and block exceptions on top.

04

Cut traffic over gradually

Route one building or VLAN through the filter first, watch the logs with instructional staff for a week, and expand once everyday classroom resources are confirmed to pass cleanly.

05

Wire reporting into audit

Schedule category-level reports from the local log store so the evidence your E-Rate certification depends on accumulates automatically, on your own storage.

Day-two operations

What running it yourself actually involves

Fear of the unknown keeps some districts off on-prem. Here is the honest workload once the system is in production.

Monitor one service

The appliance surfaces health, throughput and update status like any other monitored host. Fold it into the dashboards and alerting you already run; it does not need babysitting.

Let updates arrive

Category data refreshes itself daily. Software updates are applied on your maintenance windows, on your schedule — nothing changes underneath you unannounced.

Manage exceptions, not lists

Because categories cover millions of sites at once, day-to-day work is a handful of allow/block exceptions per term, usually requested by teachers and resolved in minutes.

Scale when you grow

More students means resizing a VM or adding a node at a new building — capacity planning your team already does for every other core service.

Own your retention

Keep logs exactly as long as board policy dictates and not a day longer. Deletion is a local operation you can verify, not a request you submit.

Answer stakeholders fast

When a principal or parent asks why a site was blocked, the named category and the log line are on your screen in seconds, with no support queue between question and answer.

Formats that drop into gear you already run

DNS blocklist / RPZ EDL for firewalls PAC / hosts files CSV export API

Districts routinely feed the AI-tools list straight into an existing resolver or firewall as a first step, then broaden to full category filtering on the appliance.

The AI-tools blocklist fits on-prem infrastructure naturally

One advantage of owning your enforcement points is that curated data can plug into them directly. Our bundled blocklist tracks more than 16,000 AI-tool domains — essay writers, homework solvers, image generators, deepfake and voice-cloning tools, companion chatbots — organized into categories and refreshed daily from a screen of roughly 300,000 newly registered domains per day.

Because it ships as DNS RPZ, firewall EDL, PAC and hosts formats, CSV, or an API, it can enforce at your resolver and firewall as well as on the filtering appliance itself. That gives a self-hosted district defense in depth against the fastest-moving content problem in K-12 without adding a single external dependency.

  • Permit approved classroom AI while blocking ungoverned tools
  • Reduce students pasting personal data into unknown services
  • Updated daily, delivered in formats your stack consumes
Best of both

Hybrid: on-prem at the core, cloud for the backpack

The honest weakness of a purely on-site model is the school bus. Once a managed Chromebook leaves the building, an edge appliance cannot see it. A hybrid deployment resolves this without giving up local custody for campus traffic.

On campus: the appliance decides

All building traffic is filtered locally at LAN speed. Logs for the overwhelming majority of student browsing — the school-day hours — are written only to district storage, satisfying the strictest data-custody stance.

Off campus: policy follows the device

Managed take-home devices enforce the same grade-band policy through the cloud path when they are outside your network, so evenings and weekends are not a blind spot. One policy definition drives both paths.

Rule of thumb: if fewer devices go home than stay racked in carts, pure on-prem may be all you need. The moment a real 1:1 take-home program starts, add the cloud leg for those devices — CIPA-relevant risk does not keep school hours.
Compliance

Compliance evidence you can put your hands on

An on-site filter is a direct, inspectable implementation of the technology protection measure CIPA requires — you can walk an auditor to the rack.

What the law requires

The Children's Internet Protection Act requires schools and libraries taking E-Rate discounts to enforce a technology protection measure blocking obscene material, child sexual abuse material and content harmful to minors, alongside an internet safety policy, monitoring of minors' online activity, and education on appropriate online behavior.

Local custody simplifies records

Category-level reports demonstrating that the required categories are blocked district-wide come from your own log store, on your own retention schedule, without asking a third party to export anything. Districts standardizing across many buildings get one policy language and one evidence trail; our page on web filtering for school districts covers that consolidation.

Two boundaries worth stating plainly

CIPA does not require blocking social media outright, so an on-prem deployment should reflect deliberate local policy rather than reflexive maximum blocking. And no filter substitutes for the safety-policy and instruction requirements — our guide to what CIPA requires walks through the full obligation.

Network placement

Three placement patterns, from single school to county district

Where the filtering engine physically sits shapes both performance and administration, and the right answer depends on how your network is already laid out. A single-building school usually runs one modest VM beside its firewall and is done; every request is filtered a few racks away from the classroom that made it.

A district with a hub-and-spoke WAN, where building traffic already flows through a central point, filters at that hub. One engine, one policy console, one log store — and each campus inherits its grade-band policy automatically based on which network it sits on.

Large or geographically scattered districts place a node per building or per region, all pulling the same daily dataset and the same central policy. Students get LAN-speed decisions everywhere, and a WAN outage at one campus never takes filtering down at another.

  • Single school: one edge VM, minimal footprint
  • Hub-and-spoke district: filter at the point traffic already crosses
  • Distributed district: per-building nodes, centrally governed

Before you commit, answer these

Custody: does written board or state policy require browsing records to stay on district systems? If yes, on-prem or hybrid is your shortlist.
Take-home reality: how many devices leave campus nightly? That number sizes the cloud leg of a hybrid — or rules out pure on-prem.
Team capacity: who patches the VM, watches the dashboard and owns exceptions? Name the person before procurement, not after.
Budget

Budgeting and procurement without surprises

On-prem costs concentrate differently than cloud costs — but for districts with existing virtual infrastructure, the incremental hardware cost is frequently close to zero.

Cost structure

Instead of a pure per-student subscription, you are combining a license for the filtering software and its daily data feed with infrastructure you largely already own — hypervisor capacity, rack space, backup. For districts with an established virtualization footprint, the incremental hardware cost is frequently close to zero.

Total effort, not just invoices

Count the hours your team will spend on provisioning and the phased cutover, then weigh them against what local custody saves elsewhere: no vendor data-processing review for browsing logs, no export requests before an audit, no dependency clauses to negotiate. For many technology directors, the second column is why the project gets board approval.

Timing matters

Because filtering underpins the E-Rate certification, schedule the deployment so the system is enforcing policy and accumulating category-level evidence before the school year — and the certification window — arrives. A spring pilot with a summer cutover is the pattern that avoids filtering a live student body during week one. Licensing details for both deployment models are on our pricing page.

Questions

On-premise filtering, asked and answered

Not in the core on-prem model. Filtering decisions are made against a local copy of the category database, and logs are written only to district-owned storage. The single external connection is the inbound daily update feed that refreshes classifications. If you add the hybrid leg for take-home devices, only those off-campus devices use the cloud path — campus traffic remains entirely local.
New domains are classified on our side as they appear and included in the daily update, so the local database is never more than about a day behind the live web. Between updates, unknown domains are handled by the default rule you choose for uncategorized sites — most districts block-by-default for younger grades and log-and-review for older ones.
Filtering keeps working for anything still reachable, because decisions are made on the LAN against local data — there is no cloud dependency in the enforcement path. This independence is one of the strongest arguments for on-site web filtering for schools in areas with fragile or congested upstream links.
No. Both deployments are driven by the same dataset: 120M+ domains, 57+ categories, multiple categories per domain, refreshed daily. The difference between the two models is where enforcement happens and who holds the logs, not the quality of the classifications.
Yes. CIPA requires a technology protection measure blocking obscene content, child sexual abuse material and material harmful to minors, plus an internet safety policy, monitoring and student education. A self-hosted filter enforces the technical measure and, because logs are local, producing category-level evidence for your E-Rate certification is a report from your own system rather than a vendor request.
Typically a single virtual machine at the network edge, sized to your concurrent user count; very large or multi-campus districts sometimes place a node per building. If you already run a virtualization cluster, no new physical hardware is usually required — sizing guidance is part of deployment planning.
Yes, and districts do both. Policies are defined the same way in either model, so adding a cloud leg for a new 1:1 take-home program — or pulling filtering in-house after starting in the cloud — is a deployment change, not a rebuild. See cloud-based web filtering for schools for the other half of the comparison, and pricing for how each model is licensed.

Keep the filter — and the records — in your building

Talk through sizing, network placement and a phased cutover with an engineer, and see the daily-updated dataset running on infrastructure you control.