Deployment models.
Three options. Same software, different ownership boundaries.
The three models
We run the fabric. Your data lands in a single-tenant cell in your chosen region with customer-managed keys.
Data plane in your AWS / GCP / Azure account; we operate the control plane. Data never leaves your perimeter.
For sovereign deployments. You operate everything; we ship images and detection updates.
Choosing a model
The software is identical across all three; only the ownership boundary moves. This table is the quick decision aid.
| SaaS | BYOC | Self-Hosted | |
|---|---|---|---|
| Data plane | Our cloud | Your cloud account | Your infrastructure |
| Control plane | We operate | We operate | You operate |
| Keys | Your KMS (CMK) | Your KMS | Your KMS / HSM |
| Regions | 14 incl. EU, GovCloud | Any in your cloud | Anywhere |
| FedRAMP | High (GovCloud) | High eligible | ATO-ready |
| Provision | Instant | ~14 min (Terraform) | Helm chart |
| Updates | Automatic | Automatic (control plane) | Signed bundle |
| SLA | 99.95% control plane | 99.9% control plane | Self-operated |
Connectivity
Collectors push outbound only over mutually-authenticated TLS — there is no inbound listener to expose. In BYOC, event data stays in your account and never crosses your perimeter; only control signals (detection-plan updates, health, case metadata) traverse the link. Sovereign and air-gapped deployments receive detection and intelligence updates as a signed offline bundle instead of a live feed.