# Deployment

Choose where the Introspection platform runs: Managed Cloud, your cloud account through BYOC, or an on-premises environment.

The platform has the same logical split in every model. The **Control Plane**
handles identity, orchestration, and configuration. The **Data Plane** runs tasks
and holds conversations, observations, files, and telemetry. The deployment
model decides where those components—and especially the customer-data
boundary—operate.

The organization view shows each data plane's cloud, region, isolation model, and health.

## The three models

### Managed Cloud

Introspection operates the platform in Introspection-managed cloud
infrastructure. This is the fastest path to production and requires no customer
cloud account or cluster operations. Organization and project boundaries keep
customer data isolated within the managed service.

### BYOC

Introspection deploys the Data Plane into your AWS, GCP, or Azure account. You
choose the supported cloud and region, and the agent-run data stays inside that
cloud boundary. Network controls and topology are coordinated as part of the
deployment. The Control Plane and SDK contract remain consistent with Managed
Cloud.

BYOC provisioning is available to eligible Max and Enterprise organizations
when enabled for the account. Contact Introspection to confirm availability
and the supported cloud and region for your deployment.

### On-prem

The platform runs in infrastructure you operate, including on-premises or
air-gapped environments. This is the deployment model for requirements that
cannot use a public-cloud control or data boundary. Exact topology, identity,
upgrades, and support responsibilities are defined as part of the Enterprise
deployment.

## Comparison

| | Managed Cloud | BYOC | On-prem |
| --- | --- | --- | --- |
| **Infrastructure location** | Introspection cloud account | Your AWS, GCP, or Azure account | Your datacenter or private environment |
| **Network boundary** | Introspection-managed | Your VPC and network controls | Your private or air-gapped network |
| **Operations** | Introspection-operated | Introspection-managed deployment in your account | Defined with the Enterprise deployment |
| **Best fit** | Fastest managed path | Cloud residency and customer-controlled networking | On-premises or air-gapped requirements |

## Choosing a model

- **Choose Managed Cloud** when you want Introspection to operate the infrastructure for you.
- **Choose BYOC** when data and network controls must stay in your cloud account.
- **Choose on-prem** when the platform must run in your private or air-gapped environment.

Deployment is an infrastructure decision, not a per-task runtime option. Projects
are assigned to the Data Plane deployments available to their organization;
changing that topology is an operational action, not an SDK parameter.

## Related

- [**Security model**](/platform/security): isolation, encryption, and credential handling across the deployment boundary.
- [**Infrastructure**](/platform/infrastructure): encryption, networking, and identity across all models.
- [**Organizations & projects**](/platform/projects): the tenancy model deployments sit beneath.

Deployment

Choose where the Introspection platform runs: Managed Cloud, your cloud account through BYOC, or an on-premises environment.

The platform has the same logical split in every model. The Control Plane handles identity, orchestration, and configuration. The Data Plane runs tasks and holds conversations, observations, files, and telemetry. The deployment model decides where those components—and especially the customer-data boundary—operate.

Organization data planes across AWS, Azure, and GCP with shared or dedicated isolation and healthy status — The organization view shows each data plane’s cloud, region, isolation model, and health.

The three models

Managed Cloud

Introspection operates the platform in Introspection-managed cloud infrastructure. This is the fastest path to production and requires no customer cloud account or cluster operations. Organization and project boundaries keep customer data isolated within the managed service.

BYOC

Introspection deploys the Data Plane into your AWS, GCP, or Azure account. You choose the supported cloud and region, and the agent-run data stays inside that cloud boundary. Network controls and topology are coordinated as part of the deployment. The Control Plane and SDK contract remain consistent with Managed Cloud.

BYOC provisioning is available to eligible Max and Enterprise organizations when enabled for the account. Contact Introspection to confirm availability and the supported cloud and region for your deployment.

On-prem

The platform runs in infrastructure you operate, including on-premises or air-gapped environments. This is the deployment model for requirements that cannot use a public-cloud control or data boundary. Exact topology, identity, upgrades, and support responsibilities are defined as part of the Enterprise deployment.

Comparison

	Managed Cloud	BYOC	On-prem
Infrastructure location	Introspection cloud account	Your AWS, GCP, or Azure account	Your datacenter or private environment
Network boundary	Introspection-managed	Your VPC and network controls	Your private or air-gapped network
Operations	Introspection-operated	Introspection-managed deployment in your account	Defined with the Enterprise deployment
Best fit	Fastest managed path	Cloud residency and customer-controlled networking	On-premises or air-gapped requirements

Choosing a model

Choose Managed Cloud when you want Introspection to operate the infrastructure for you.
Choose BYOC when data and network controls must stay in your cloud account.
Choose on-prem when the platform must run in your private or air-gapped environment.

Deployment is an infrastructure decision, not a per-task runtime option. Projects are assigned to the Data Plane deployments available to their organization; changing that topology is an operational action, not an SDK parameter.

Security model: isolation, encryption, and credential handling across the deployment boundary.
Infrastructure: encryption, networking, and identity across all models.
Organizations & projects: the tenancy model deployments sit beneath.