# Self-hosted screen recording for teams that fail vendor reviews
_Disclosure: This post contains affiliate links. If you buy through them, INS.ae may earn a commission at no extra cost to you. We only recommend tools we'd use on client work._
Nobody in your org voted for a screen recorder. A product manager recorded a walkthrough with an internal dashboard in frame, pasted the link into Slack, and now a video containing your production data lives on a vendor's storage in a region nobody chose. Two weeks later that link shows up in a review form in your queue, due Friday: approve or block. Block it and teams keep recording anyway with whatever the app store offers. Approve it and your name is on the paperwork.
What you actually want is boring in the best way. Your teams send video updates like everyone else does, and you never file a security exception to make it happen. Most recorders can't get you there. Cap can usually clear the review on its own terms: it is a self-hosted screen recording option in the literal sense (open source, self-hostable), and it sells its compliance artifacts at public prices instead of behind a sales call. Here's how it answers the three questions that stall recorder reviews, and where it will still embarrass you in front of an auditor.
The three questions that stall every recorder review
Every security review of a screen recorder reduces to three questions:
- Where do the recordings live?
- Who can verify what the software actually does?
- What happens when we leave?
Cloud-only proprietary recorders answer question one with "our servers, our regions, trust our subprocessor list," question two with "here's our certification PDF," and question three with "file an export ticket." Those answers are all defensible. None of them land in a review spreadsheet the way "the code is on GitHub and the bucket is ours" does.
Answer one: your storage, your region
Cap is a screen recorder with native apps for macOS (Apple Silicon and Intel), Windows, and Linux (.deb builds for Debian and Ubuntu), plus a Chrome extension. The code is open source and auditable on GitHub, and the company reports over 50,000 users. On the storage question it gives you a menu: Cap Cloud (encrypted), your own S3 bucket in any region, your own Google Drive, fully local files, or a self-hosted deployment on your infrastructure.
For a GDPR conversation, the S3 option is the whole answer. Recordings land in a bucket you own, in the region your DPO named, under your IAM policies, inside your existing data classification. The residency question becomes a bucket policy question. Self-hosting is the version where the app talks only to servers you run. Dub.co founder Steven Tey, in an endorsement Cap publishes on its site, zeroes in on exactly this combination: open source code and your own S3 bucket.
Answer two: they let you read the code
Auditable code is rarer in this category than it should be. Cap's capture path, upload path, and storage handling are all readable before anyone signs anything. The paperwork exists too: SOC 2 Type II and ISO 27001 are included at the Pro level, and HIPAA coverage is a signed BAA at $99 per month per organization, added self-serve. SAML SSO is $199 per month flat, unlimited users. No sales gate, no minimum seats.
The procurement point matters as much as the price. Loom, the incumbent every recorder gets compared against, keeps its Enterprise tier quote-only. The tier where Loom's mature SSO and SCIM live has no public number, so your review spreadsheet carries an empty cell until a sales conversation happens, and annual billing on its published Business tier pays the full year up front per seat. Cap's structure is the mirror image: the Enterprise plan is everything in Pro at Pro pricing ($12/user/month billed monthly, $8.16 billed annually) plus the optional add-ons you actually want, priced publicly. You can cost a rollout from Cap's pricing page before a sales meeting.
Run the numbers for a 25-person regulated org, all from published prices (vendor pages, Sep 2026):
- 25 Cap Pro seats, annual billing: 25 x $8.16 x 12 = $2,448/yr
- SAML SSO, unlimited users: $199 x 12 = $2,388/yr
- Signed HIPAA BAA: $99 x 12 = $1,188/yr
- Total: $6,024/yr, about $20 per person per month, with SSO, BAA, SOC 2 Type II and ISO 27001 in the same stack. Billing Pro monthly instead adds $1,152 over the year.
For scale, Loom Business runs about $15/user/month on annual billing, roughly $4,500 for the same 25 seats, with AI features a separate ~$20/user tier, but neither published tier answers the SSO/SCIM residency questions an Enterprise review asks. The honest way to present this to your committee: Cap's compliance line item is knowable today, Loom's equivalent is one quote away, and you should demand that quote rather than guess it.
Answer three: the exit is the product
Cap's cancellation terms are one paragraph on its pricing page: shares stay active, a full export is available, the recordings are yours forever, and you can move to a self-hosted instance to keep the features running. Recordings are plain video files, so leaving is a storage operation, not a migration project. In the vendor risk section of your review, the row "what happens when we leave" can read: export everything, or point the clients at our own server. Filling that row correctly is most of what wins the approval.
What reviewers forget to ask, and Cap answers anyway
- Password-protected shares, for partner walkthroughs that shouldn't hit the open internet.
- Viewer analytics, so you can show who watched what instead of assuming the video policy works.
- A custom domain (cap.yourdomain.com), so outbound links carry your domain rather than a vendor-branded URL that looks like phishing in a bank's Slack.
- A CLI, a REST API, and an MCP server whose tool list runs to 76 entries, with least-privilege auth, and the agent asking before it records, uploads, or spends. If your platform team wants to script the recorder into internal tooling, there is something to script, and we build that kind of embedding for clients (web app development).
Where it will still cost you red lines
A tool that passes every question on the form is lying somewhere. Here's the honest list.
SCIM is the big one. Cap's SSO is self-serve, but SCIM provisioning is something you "arrange" rather than a toggle in an admin console. Loom Enterprise has years of IT punishment behind it and its SSO/SCIM story is mature. If your deprovisioning runbook cannot tolerate a manual off-boarding path until SCIM is sorted, put that requirement in the pilot contract, before rollout, not after.
Age is second. Loom is Atlassian-owned; nobody gets questioned for approving the incumbent. Cap is younger, with a smaller integration ecosystem. If your vendor register wants analyst coverage, a named account rep, and a decade of audit history before it lets a tool in, this purchase is a fight, and the facts sheet above is your ammunition, not a guarantee.
Packaging is third. Linux support means .deb for Debian and Ubuntu. A Fedora or Arch fleet is compiling from the open source repo or getting a different answer than the rest of the org.
And self-hosting, the feature this whole pitch rests on, means it is yours now. Your infra, your patching, your uptime. Frame it to your own team as control rather than burden, because that's literally what it buys: the ability to answer "where does it live" with "here." Just make sure someone is staffed to answer "who patches it" too.
A rollout that survives audit
- Hand your reviewer the GitHub repo first. Reading the actual capture path is the cheapest trust available.
- Pilot one team on Cap Pro monthly at $12/user for a month, so nothing annual is committed during the trial. Add SAML SSO ($199/mo flat) and the BAA ($99/mo) only if the pilot's scope needs them.
- Point storage at your own S3 bucket in the regulated region from day one, so the residency answer is in the pilot report itself.
- Set the sharing policy while adoption is small: custom domain on, password-protected shares required for anything that leaves the network, viewer analytics on so you can see actual use.
- Write the exit runbook during the pilot, not at renewal. Export path, self-host image, owner names.
Once video clears review, volume becomes the next problem instead of permission. That's when clients have us build the repeatable content pipeline (automated content generation).
If you want to see the admin side before you open a review ticket, Cap's pricing lists the seats and both add-ons with public numbers, and the Pro pilot is one month of $12 seats. The GitHub repo is the other half of the pitch, and it does not need a sales call either.
FAQ
Is Cap really self-hostable, or is that marketing?
Self-hostable in the deployment sense. The app is open source with auditable code on GitHub, and Cap's terms state that if you cancel, shares stay active, you can export everything, and you can keep features running on a self-hosted instance. The recordings are plain video files. The catch is operational: a self-hosted instance is your infrastructure, your updates, and your uptime to maintain.
Does Cap sign a HIPAA BAA, and what does compliance cost?
Yes. A signed BAA is a $99 per month per organization add-on, self-serve, with no sales call. SOC 2 Type II and ISO 27001 are included at the Pro level ($12/user/month billed monthly, $8.16/user/month annually). SAML SSO is a separate $199 per month flat fee for unlimited users. There are volume discounts at 10+ users.
How does Cap's Enterprise pricing compare with Loom Enterprise?
Cap's Enterprise plan is everything in Pro at the Pro per-seat price, plus optional self-serve add-ons (SAML SSO $199/mo, HIPAA BAA $99/mo), with no sales gate and no minimum seats. Loom Enterprise is quote-only, so there is no published number to compare against; you have to request it from Loom and model whatever comes back against Cap's public page, as of September 2026.
Does self-hosting a screen recorder solve GDPR data residency?
No tool solves residency on its own, but storage location is what the question is really about. Cap offers BYO S3 in any region, BYO Google Drive, fully local files, or a self-hosted deployment, so recordings can sit entirely in infrastructure you control and classify. Pair that with the custom domain and password-protected shares and the outbound link story is defensible too. Verify the current terms on Cap's site before you cite them in a filing.
