Run the data plane in your account.

Bring-your-own-cloud keeps every byte of telemetry and every encryption key inside your AWS account. threatDefendr runs only the managed control plane — orchestration, detection content, and updates — and never sees your data. This is the reference architecture and the path to a live cell.

Split of responsibility

BYOC draws one clean line: the data plane — storage, compute, and keys — lives in your account; the control plane stays managed by us. The two communicate over a mutually-authenticated channel that carries orchestration and metadata only, never raw events.

Prerequisites

• An AWS account (or a dedicated sub-account in your Organization) for the cell.
• Terraform >= 1.6 and credentials that can create IAM roles, KMS keys, VPCs, and storage.
• A KMS customer-managed key (CMK) in the target region — or let the module create one.
• A free /20 CIDR block for the data-plane VPC.
• Egress to the control-plane endpoints (published per region) for the orchestration channel.

Provision the data plane

The data plane is a Terraform module. Point it at your CMK and a CIDR, choose a managed control plane, and set retention; everything it creates — storage tiers, the compute autoscaler, IAM — lands in your account under your state.

HCLmain.tf
module "threatdefendr_dataplane" {
  source  = "threatdefendr/dataplane/aws"
  version = "~> 2026.06"

  workspace   = "acme-prod"
  region      = "us-east-1"
  vpc_cidr    = "10.40.0.0/20"
  kms_key_arn = aws_kms_key.td.arn      # your CMK

  control_plane = "managed"             # managed | self-hosted
  retention = {
    hot_days  = 365
    cold_days = 2555                     # 7y WORM, in your account
  }
}

SHELLdeploy
$ td deploy byoc --plan ./threatdefendr.tfplan
  -> validating account 4915-xxxx-xxxx . ok
  -> data-plane cell td-cell-acme-prod . creating
  -> storage (NVMe hot, S3 warm, Glacier cold) . ok
  -> compute autoscaler . ok
  -> control-plane handshake . established
  ok  cell live in your account . 0 bytes leave the boundary

Customer-managed keys

Storage is envelope-encrypted: data keys are generated locally and wrapped by your CMK, so threatDefendr can run compute without ever holding a key it can export. Grant the data-plane role exactly the three KMS actions it needs — no more.

JSONkms key policy (statement)
{
  "Sid": "AllowDataPlaneEnvelopeEncryption",
  "Effect": "Allow",
  "Principal": { "AWS": "arn:aws:iam::ACCT:role/td-dataplane" },
  "Action": ["kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey"],
  "Resource": "*"
}

Verify & cut over

Before you route production telemetry, confirm the cell is healthy end to end: storage online, events flowing within the latency budget, the control-plane channel authenticated, and the CMK reachable. Then move connectors over one source at a time.

Where to go next

• Deployment models — SaaS, BYOC, and self-hosted compared.
• Security model — tenant isolation and key management in depth.
• Trust center — attestations for your authorization package.