<p>I'm working in a company where we have build a SaaS-application with the PHP/MySQL/Redis/JS-stack.</p>

<p>It runs in our own Google Kubernetes Engine as a hosted/managed service for our clients.</p>

<p>Most of our business logic is placed in the PHP-layer.</p>

<p>Now we want to provide our product as an on-premise solution, so that our clients can deploy the whole product in their own private cloud or maybe even in their own basement.</p>

<p>This also means that the clients get access to all our "business secrets" (business logic) and this worries me.
We are a small business and we are doing business with large companies. Some of them might be interested in doing what we do themselves.</p>

<p>PHP is not compiled and the obfuscaters I have found does not seem to obfuscate the code too much.</p>

<p>We have talked about following solutions:</p>

<ol>
<li><p>Trust the customers to not copy/get inspired by our solution and only protect it through law/contracts</p></li>
<li><p>Move some vital parts of our logic to our own server and make the on-prem solutions call to our server sometimes. This way we can control licensing etc. But we fear that the customers then will say that it is not totally on-prem. Which is true.</p></li>
<li><p>Obfuscate it the best we can and hope for the best. Maybe we are just paranoid?</p></li>
<li><p>Do something that makes it possible for the clients to run the code in their private cloud without accessing the source code - we have looked into Google Cloud Marketplace, but as far as I can see, the clients will get access to the VM.</p></li>
</ol>

<p>Do you have any good inputs in this regard?
We are looking for creative solutions. The main goal is to protect our business.</p>

<p>It would be best if we could offer our Kubernetes setup as a fully on-prem solution, but if you have good ideas to how we can provide it to client's private cloud (even only in GCP) that is also very welcome.</p>

<p>Thanks in advance!</p>

thephper
<p>Your question relates rather to IP than to k8s and clouds.</p>

<p>Solutions are:</p>

<h1>Trust and open source</h1>

<blockquote>
  <ol>
  <li>Trust the customers to not copy/get inspired by our solution and only protect it through law/contracts</li>
  </ol>
</blockquote>

<p>You are right. And there is a power.</p>

<blockquote>
  <p>“The best way to find out if you can trust somebody is to trust them.”
  ― Ernest Hemingway </p>
</blockquote>

<p>You can select appropriate license and give your app to the client.
See <a href="https://stackoverflow.com/a/336068/5720818">this answer</a>: </p>

<blockquote>
  <p>Some parts of a EULA that come to mind:</p>
  
  <ul>
  <li>Limiting your liability if the product has bugs or causes damage.</li>
  <li>Spelling out how the customer can use their licensed software, for how long, on how many machines, with or without redistribution rights, etc.</li>
  <li>Giving you rights to audit their site, so you can enforce the licenses.</li>
  <li>What happens if they violate the EULA, e.g. they lose their privilege to use your software.</li>
  </ul>
  
  <p>You should consult a legal professional to prepare a commercial EULA.</p>
  
  <ul>
  <li>"<a href="http://discuss.joelonsoftware.com/default.asp?biz.5.293027.14" rel="nofollow noreferrer">EULA advice</a>" on joelonsoftware</li>
  <li>"<a href="http://www.avangate.com/articles/eula-software_75.htm" rel="nofollow noreferrer">How to Write an End User License Agreement</a>" </li>
  </ul>
</blockquote>

<h1>Not-prem</h1>

<blockquote>
  <ol start="2">
  <li>Move some vital parts of our logic to our own server and make the on-prem solutions call to our server sometimes. This way we can control licensing etc. But we fear that the customers then will say that it is not totally on-prem. Which is true.</li>
  </ol>
</blockquote>

<p>Not the best solutions since it's not real on-prem.
Your client's servers may be located in secure zone under firewall without access to your server.</p>

<p>Anyway, it's popular solutions.
For example, see how <a href="https://www.vepp.com/" rel="nofollow noreferrer">Vepp</a> works.</p>

<blockquote>
  <ol start="3">
  <li>Obfuscate it the best we can and hope for the best. Maybe we are just paranoid?</li>
  </ol>
</blockquote>

<p>Solutions are:</p>

<ul>
<li><a href="https://www.ioncube.com/php_encoder.php" rel="nofollow noreferrer">ionCube PHP Encoder</a></li>
<li><a href="https://www.sourceguardian.com/" rel="nofollow noreferrer">SourceGuardian</a></li>
<li><a href="http://www.semanticdesigns.com/Products/Obfuscators/PHPObfuscator.jsp" rel="nofollow noreferrer">Thicket<sup>™</sup> Obfuscator for PHP</a> by Semantic Designs</li>
<li><a href="https://www.zend.com/products/zend-guard" rel="nofollow noreferrer">Zend Guard</a></li>
</ul>

<p>There are some vital examples of php-driven self-hosted applications.
I.e. <a href="https://www.bitrix24.com/self-hosted/" rel="nofollow noreferrer">Self-hosted Bitrix24</a></p>

<h1>Private cloud with ecryption</h1>

<blockquote>
  <ol start="4">
  <li>Do something that makes it possible for the clients to run the code in their private cloud without accessing the source code - we have looked into Google Cloud Marketplace, but as far as I can see, the clients will get access to the VM.</li>
  </ol>
</blockquote>

<p>Yes, you can distribute your app as encrypted VM.</p>

<ul>
<li>VirtualBox: install <a href="https://www.virtualbox.org/wiki/Downloads" rel="nofollow noreferrer">Oracle VM VirtualBox Extension Pack</a> and enable disk encrytion</li>
<li>VMWare-vSphere You can use <a href="https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-E6C5CE29-CD1D-4555-859C-A0492E7CB45D.html" rel="nofollow noreferrer">virtual machine encryption</a> since v6.5</li>
<li><a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#how-ebs-encryption-works" rel="nofollow noreferrer">AWS</a>, <a href="https://cloud.google.com/storage/docs/encryption/customer-managed-keys" rel="nofollow noreferrer">GCP</a>, <a href="https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview" rel="nofollow noreferrer">Azure</a> support encryption of your data. If your client agreed with cloud hosting, it might work.</li>
</ul>
