Yes, we have a lot of work to do on our landing page to better explain these points. It's early days, but we will get there! Here is some light on them:

It's cloud hosted, and we do support self-hosting for enterprises. The code is not open-source. We support Okta, Google, and other OAuth providers for Authentication. For Authorization we have the concept of Targets, which are abstractions of your cloud resources to users/developers. Say you have a Mysql database, you can create a read-only Target and let everyone use it, and create a second Target for the same database with write access. In the second Target you require reviews from tech leads, or let selected groups run queries.