Deployment models | Skyflow

Skyflow supports three deployment models to meet different security, compliance, and infrastructure requirements. All three provide the same core capabilities: a zero-trust data privacy vault, tokenization, and policy-based access control. They differ in how infrastructure is isolated, managed, and integrated into your environment.

Model	Infrastructure	Isolation
Multi-tenant SaaS	Shared, fully managed	Logical isolation
Virtual Private Skyflow	Dedicated VPC (managed)	Physical isolation
Bring Your Own Cloud (BYOC)	Customer cloud account	Full infrastructure control

Skyflow also supports hybrid architectures where on-premises systems connect to Skyflow using private connectivity, allowing you to keep sensitive data within your network boundaries while leveraging vault capabilities in the cloud.

All three models support the same options for encryption key management, including Skyflow-managed keys, Bring Your Own Key (BYOK), and Bring Your Own KMS (BYOKMS).

Multi-tenant SaaS

Multi-tenant SaaS is the default Skyflow deployment model: fully managed on shared infrastructure. Your data is logically isolated within Skyflow’s infrastructure, and Skyflow manages all operations, scaling, and availability.

Attribute	Detail
Infrastructure	Shared, fully managed by Skyflow
Isolation	Logical (encryption and access controls)
Time to deploy	Fastest of all models
Private connectivity	Optional enhancement
Customer-managed keys	Optional enhancement

Best for: Teams that want a fully managed experience with no infrastructure overhead.

Virtual Private Skyflow

Virtual Private Skyflow runs on dedicated, fully managed infrastructure. Skyflow deploys your environment in a dedicated Virtual Private Cloud (VPC), providing physical isolation while maintaining a fully managed experience.

Attribute	Detail
Infrastructure	Dedicated VPC per customer
Isolation	Physical (dedicated compute, storage, and networking)
Managed by	Skyflow
Private connectivity	Supported
Performance	Predictable; no shared-resource contention

Best for: Organizations that need stronger isolation guarantees without taking on infrastructure management.

Bring Your Own Cloud (BYOC)

With BYOC, Skyflow runs inside your cloud environment. Skyflow is deployed into your cloud account (AWS or GCP), giving you full ownership of infrastructure while Skyflow operates and manages the platform. All traffic stays within your network boundaries.

Attribute	Detail
Infrastructure	Your AWS or GCP account
Isolation	Full network control
Responsibility model	You own the infrastructure; Skyflow operates the service
IAM control	Full. You manage roles and policies.
Data residency	Customer-controlled
Architecture	Private by default

Best for: Organizations with strict data residency requirements, or those that must keep all infrastructure within their own cloud environment.

Private connectivity

Private connectivity is available across all three deployment models. For workloads that cannot traverse the public internet, Skyflow supports:

AWS PrivateLink
GCP Private Service Connect
VPN or dedicated network connections
Hybrid connectivity for on-premises systems

These options keep traffic within private networks and allow on-premises systems to securely connect to Skyflow’s vault capabilities in the cloud.

AWS PrivateLink

Skyflow supports AWS PrivateLink for customers who want API traffic between their AWS environment and Skyflow to stay on the AWS private network. With PrivateLink configured, requests from your VPC reach Skyflow through a private endpoint: traffic doesn’t traverse the public internet, and it bypasses the CDN edge, which typically reduces latency.

PrivateLink secures the network path for traffic sent through it. It doesn’t change how your vault endpoint is exposed: the standard endpoint remains available alongside the private one. To restrict which networks can call your vault, configure IP allowlists on your service accounts:

Active - All enforces IP restrictions on bearer token generation and all API calls.
Active - Auth Only enforces IP restrictions on bearer token generation only.

IP allowlists apply per service account and per role assignment.

For deployments requiring the vault to be reachable exclusively via private connectivity, contact Skyflow. This is supported for dedicated and BYOC deployment models.

How to choose

Most customers begin with a managed model and evolve as their security, compliance, and infrastructure requirements grow.

Model	Choose when…
Multi-tenant SaaS	You want minimal operational overhead, fast time to deploy, and strong logical isolation is sufficient.
Virtual Private Skyflow	You need dedicated infrastructure and physical isolation guarantees, but still want Skyflow to manage operations.
Bring Your Own Cloud (BYOC)	You require maximum control over your cloud environment, networking, IAM, and data residency.

Key management: Configure customer-managed keys with BYOK or BYOKMS.
IP allowlists: Restrict API access to specific IP addresses.
Compliance and certifications: Review Skyflow’s compliance posture.
Security best practices: Apply Skyflow’s full security checklist.