Deployment options for controlled enterprise adoption.

Three deployment patterns. One control plane. Pick the boundary that fits your risk class.

Architecture · Deployment

Control plane: Three deployment patterns. One control plane.
Managed cloud: Managed cloud · Fastest start. EU + US + APAC regions.
Customer cloud: Customer cloud · Run in your AWS / Azure / GCP. CMK + HSM custody.
Air-gapped: Private / air-gapped · No outbound to provider APIs. OSS-only model routing.
Same in all: What stays the same regardless of mode.; Secrets + credentials · Environment separation · Operational monitoring

Across the architecture

Three modes.

Each mode draws the boundary in a different place. The control plane is the same in all three.

Deployment patterns

Whichever boundary you pick, these three hold the same way in every mode.

Operational details: the controls that hold in every deployment mode
Operational details	Managed cloud	Customer cloud	Private / air-gapped
Secrets + credentials Customer-managed encryption keys across all modes.	Yes	Yes	Yes
Environment separation Dev, staging, prod boundaries enforced at platform layer.	Yes	Yes	Yes
Operational monitoring Self-hosted Prometheus / OTel endpoints in private modes.	Yes	Yes	Yes

Choose a mode. The boundary moves; the control plane above it and the controls beneath it stay where they are.

Managed cloud. Fastest start. EU + US + APAC regions.

Deployment boundary Managed cloud

Connect one repository, one ticketing tool, and one mission. See evidence in days, not quarters.