Infrastructure · deployment
Same build. Three trust boundaries.
Where the kernel runs is a compliance decision, not a product tier. Nothing is held back from the self-hosted build to make the managed one look better.
01 / side by side
| Managed | BYOC | Air-gapped | |
|---|---|---|---|
| Where sandboxes run | Velone hosts | Your cloud account | Your metal |
| Where the control plane runs | Velone | Velone | Your metal |
| Workload data leaves your perimeter | Yes | No | No |
| Evidence storage | Velone or your bucket | Your bucket | Your bucket |
| Secrets custody | Velone KMS or yours | Yours | Yours |
| Egress path | Velone gateway | Your VPC | Your network |
| Upgrades | Continuous | Continuous | Signed bundles |
| Phone-home | n/a | Control plane only | None |
| Time to first session | Minutes | About a day | A week |
| Minimum commitment | Monthly | Annual | Annual |
02 / byoc
What we install in your account.
A Terraform module and a host agent. You keep the keys, the network, and the bill for compute.
module "velone" {
source = "velone/data-plane/aws"
version = "1.4.0"
region = "eu-central-1"
host_class = "m6a.metal"
pool_depth = 8
evidence_bucket = aws_s3_bucket.velone_evidence.id
kms_key_arn = aws_kms_key.velone.arn
egress_allowlist = [
"api.stripe.com",
"github.com",
]
control_plane = "eu.velone.in" # policy + scheduling only
}- What crosses the boundary
- Scheduling decisions, policy versions, and evidence chain heads. Never workload data, never tool arguments, never file contents.
- What you operate
- The hosts and their capacity. We monitor health and page ourselves on control-plane issues.
- IAM footprint
- A scoped role for host lifecycle and the evidence bucket. Read access to nothing else in your account.
03 / air-gapped
For estates with no egress at all.
Defence, healthcare, and parts of finance cannot phone home. The disconnected build assumes that from the start rather than bolting it on.
- Delivery
- Signed OCI bundles and a checksum manifest, shipped on your schedule. Verify the signature before it touches the network.
- Licensing
- Offline licence file with an expiry. No activation call, no usage telemetry.
- Models
- Point sessions at your own inference endpoints. Nothing requires a hosted model provider.
- Support
- Diagnostics bundle you inspect and choose to send. We never pull data from your environment.
04 / questions
Can we start managed and move to BYOC later?
Yes, and most teams do. Sessions, policy, and evidence are portable; the migration is a change of scheduling target plus an export of the chain. We do not charge to move you.
Does BYOC cost more?
The licence is the same and you pay your own cloud bill for compute, which is usually cheaper at scale. The annual minimum exists because the deployment carries real onboarding effort.
Who is on call for the data plane in BYOC?
You own the hosts, we own the software. We monitor host health and alert you; if a host is wedged, the fleet reschedules around it automatically.
keep reading
Ring 0
Bring your compliance constraint first.
It is the fastest way to find out whether we fit. If we cannot meet it, we will say so on the call.