Hosting and operations options.
The same product in all three shapes. What changes is where your network edge sits and who operates what is inside it.
SaaS
We operate it
- Platform
- Connectors
- Your users
Private cloud
Operated as agreed
- Platform
- Connectors
- Your users
- Your subscription
On-prem / air-gapped
You operate it
- Your users
- Your subscription
- Platform
- Connectors
- AI model
The options compared
| SaaS | Private cloud | On-prem / air-gapped | |
|---|---|---|---|
| Tenancy | Multi-tenant | Single tenant | Single tenant by design |
| Who operates it | We do | As agreed | You do |
| Updates | Continuous, managed by us | Scheduled, in your window | In-app software updates, you decide when |
| Content packs | Live daily sync | Live daily sync | Signed manual upload |
| Identity | SAML, OIDC, SCIM | SAML, OIDC, SCIM | SAML, OIDC, SCIM against your directory |
| AI | Your verified provider | Your verified provider | A fully local model if you want one |
| Backups | Tenant-scoped, we run them | In your subscription | In your infrastructure |
| Network requirements | Outbound HTTPS | Outbound HTTPS | None. Runs air-gapped |
| Activation | Subscription | Subscription | Ed25519-signed licence, online or offline |
Procurement questions
The answers procurement and security teams ask for before they approve, for each deployment option.
- Where are the platform and its data hosted?
- Private cloud: in your organization's own cloud subscription, in the region you choose.
- On-premises: inside your infrastructure and your network edge.
- Where do backups reside?
- SaaS: daily tenant-scoped backups that we run, kept for 90 days by default, with retention adjustable per tenant.
- Private cloud: inside your subscription.
- On-premises: inside your infrastructure.
- Who operates each deployment?
- SaaS: we do.
- Private cloud: as agreed with each customer.
- On-premises: your team, with in-app software updates applied when you decide.
- How do external AI providers affect data handling?
- The AI Copilot stays disabled until an AI provider has been configured and verified for your tenant. Each tenant has its own AI configuration and retrieval index.
- Once enabled, prompts and the data the Copilot needs to answer are sent to the provider you chose, under your agreement with that provider. Every prompt is logged for audit.
- You can point the Copilot at a model running entirely inside your network, in which case nothing leaves it.
What air-gapped means here
Air-gapped here means the installation needs no outbound connection for licensing, content or telemetry.
Licence activation is Ed25519-signed and node-locked, and works fully offline. Content packs, which are signed and versioned, install by manual upload, and the signature is what makes that path safe.
Continuous control monitoring connectors run inside the platform on your network, so no connector call and no credential leaves it. If you enable the AI Copilot, you can point it at a model running entirely inside your perimeter.
The result is that an air-gapped installation is not a reduced version. It is the same product with a different network edge.
What you will need for on-premises
The full technical requirements, from server sizing through database, object storage, certificates and optional outbound network ports, are documented in the on-premises technical prerequisites. Ask and we will send it; it is the document your infrastructure team wants before they agree to anything.
Request the technical prerequisites
Installation and onboarding
- 01Guided install wizardWalks through database, storage, certificates and the first administrator account, validating each step before moving on.
- 02Licence activationOnline or offline. The offline path exchanges a signed request file for a signed licence file.
- 03Onboarding wizardScopes your organization, builds the first org tree and perimeters, activates frameworks and imports the starting content.
- 04Updates afterwardsIn-app software updates and update notifications, so on-premises does not mean frozen on a version.
Talk to us about the shape you need.
Bring your data residency requirement and we will tell you which shape fits it, including when that is not the most expensive one.