You forked your AI platform. Now you own the upgrade problem.
You installed LibreChat, modified it to fit your company, and it now serves anywhere from 15 to 8,000 people. Upstream now ships roughly thirty changes a day. Every release is a decision you make alone. Almma OS maintains the distribution — including your modifications — so upgrades stop being a risk you carry personally.
Run on your infrastructure. Your data never leaves it. Your changes stay yours.
If you run LibreChat in production, you've hit some of these.
Written the way it actually shows up — not as a feature gap list.
Upgrades that force a rollback
One release spiked CPU and memory badly enough to roll back — and you still don't know which change caused it.
Stale Helm images
Tags months behind. Nobody is confident which one is safe to move to, so nothing moves.
Upstream moves faster than you can
Roughly thirty pull requests a day since the ClickHouse acquisition. Every release you skip widens the gap, and the auth changes land whether you're ready or not.
Patches you can't contribute back
Legal won't allow it, so the fork drifts further from upstream with every release you skip.
Compliance questions you can't answer
Where data is processed, what the DPA covers, how SSO groups map — asked by people who need it in writing.
One engineer holding all of it
Usually on top of another full-time job. It's now too important to break, and there is no second person.
$ kubectl top pod -l app=librechat NAME CPU MEM librechat-7f9c8d-2xk 1893m 3.1Gi # after upgrade librechat-7f9c8d-9mq 1740m 2.9Gi $ helm rollback librechat 14 Rollback was a success.
Illustrative — reconstructed from a common failure pattern. Not a customer cluster.
What Almma OS is
A maintained distribution of LibreChat that carries your changes forward, so you upgrade on a tested path instead of a private one.
01 · Distribution
Maintained distribution
Pinned, signed images and a supported Helm chart. You run it in your cluster; we maintain what's inside it and tell you exactly what changed.
02 · Upgrades
Tested upgrade path
Every release runs a regression and load suite against a profile matching your deployment. Resource deltas are published per version, before you upgrade.
03 · Security
Security patching
CVE tracking across the dependency tree, backported to the version you are actually running — not only to latest. SBOM with every release.
04 · Your fork
Your changes, carried forward
We build the enhancements your company needs and keep them rebased against upstream every release, so you are never stranded on a fork.
05 · Assurance
Security gap analysis
Standardized resiliency testing against known attack vectors on every upstream release, returned as an evidence pack your auditors can read. The faster upstream ships, the larger the re-test surface — and the auth surface is where it has been shipping.
06 · Escalation
Support and escalation
A named engineer, agreed response times, and a defined path when something breaks in production at eleven at night. Troubleshooting escalation is part of the contract, not a favour.
almma-os/ ├─ upstream/ # tracked, pinned, diffed each release ├─ patches/ # your changes, rebased and tested ├─ tests/ # regression + load, run before you get it ├─ hardening/ # CSP, JWT, MCP scoping, 2FA, air-gap └─ evidence/ # SBOM, CVE report, attack-vector results
$ helm upgrade librechat almma/librechat --version 0.7.9 ✔ regression suite 142 checks ✔ load profile 900 seats ✔ your patches rebased 9 files ✔ hardening baseline 28 controls ✔ CVE scan 0 high
Your compliance checklist
The questions that stall these deployments, named plainly. If one of them is your blocker, bring it to the call.
| Requirement | Why it blocks | Established in diagnosis |
|---|---|---|
| Data Processing Agreement | Legal won't sign off without one, and there's no counterparty on an open-source deployment | Reviewable DPA drafted for your deployment, with subprocessor list |
| Standard Contractual Clauses | Cross-border transfer has no cover without them | SCC module prepared and scoped to your data flows |
| EU-only processing | Egress outside the EU fails your own policy review | Region-pinned architecture reviewed and documented |
| Air-gapped deployment | No path to install or update without outbound network access | Offline image bundle and private registry procedure specified |
| SSO / OIDC + group mapping | Agent sharing can't respect existing org structure | Entra ID, Okta, or LDAP group mapping designed against your directory |
| CSP headers | Without them, MCP servers can't be operated in your environment | Hardened reference policy defined for your gateway |
These are the artifacts the diagnosis engagement produces for your environment. Nothing here is a stock certificate — the whole point is that your deployment is not stock.
auth:
oidc:
provider: entra-id # okta | ldap
groupMapping: true
region: eu-central-1 # EU-only processing
airgap: true # offline image bundle
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; script-src 'self'; connect-src 'self' https://<your-gateway>
Evaluate it before you deploy it
AlmmaGPT is the same platform, hosted by us. Bring your team in at chat.almma.ai, see how it behaves with real work, then deploy in your own environment when you're ready.
Same codebase, same admin model, same upgrade train — the only difference is whose cluster it runs in. Nothing you configure in the hosted tenant is thrown away when you move it in-house.
Evaluate hosted
A tenant on AlmmaGPT, your SSO, a real team. No procurement cycle to see whether the platform holds up.
Diagnose your environment
Fork diff, upgrade history and compliance gaps read against what you already run.
Deploy in your cluster
The same distribution, in your infrastructure, with your configuration carried over.
Stay on the release train
Tested upgrades and security patches, with your changes rebased against upstream.
Explicit non-responsibilities
Stated up front so you can rule us out quickly.
We do not host your data or operate your cluster. It stays in your infrastructure.
We do not sell or resell models and inference.
We do not replace your platform team, your identity provider, or your monitoring.
We do not take over your product roadmap or decide what your users get.
We do not fork away from upstream and call it our own product.
Relationship to upstream
Almma is not affiliated with, endorsed by, or an official distributor of the LibreChat project or ClickHouse, which acquired it in November 2025."
ClickHouse's own commercial offerings — ClickHouse Agents and managed LibreChat — are a different thing from what we do, and we do not position against them. If one fits your situation better, we will tell you that on the call.
In practice
Your patches live in a private branch we rebase each release. If you ever stop working with us, you keep the branch, the tests and the evidence pack.
How this is priced
One way in, then one ongoing relationship. The shape is published so you can screen us in or out before spending a meeting on it.
Phase 1 · pick the one that matches where you are
Installation, standard
LibreChat deployed as-is in your environment: cluster, identity provider, storage and certificates wired up, handed over documented. No diagnosis needed to quote it.
Fixed fee · quoted same week
Installation, custom
Deployed with the modifications your organization actually requires, structured from day one so they survive upgrades instead of stranding you on a fork.
Fixed fee · scoped before quoted
Diagnosis engagement
For deployments already running. We read your fork diff, your upgrade history and your compliance gaps, then hand back a written risk report and an upgrade plan. Yours to keep whether or not we work together.
Fixed fee · scoped in weeks, not months
Ranges shared on the call, before any scoping.
Phase 2
Ongoing maintenance
Release train, security patching, your changes carried against upstream, a named engineer and agreed response times. Cancellable at the end of any term.
Monthly · banded by environments and seats
Add-on
Security gap analysis
Standardized resiliency testing against known attack vectors on every upstream release, returned as an evidence pack your auditors can read. The faster upstream ships, the larger the re-test surface.
Monthly · added to maintenance
Exact figures depend on how far your fork has drifted and how many environments you run. Both are settled in writing before any work starts.
