Skip to content
DeepintShield DeepintShield

Deployment options

DeepintShield runs in three shapes. They share the same gateway, guardrails, and APIs - what changes is where your data lives and who operates the infrastructure.

DeepintShield Cloud

Fully hosted at app.deepintshield.com. Nothing to deploy - sign up, create a virtual key, and point your SDK at the gateway. Best for most teams.

Enterprise VPC

The data plane runs in your own cloud (GKE / AKS / EKS); DeepintShield manages the control plane. No prompt, response, key, or audit data leaves your VPC. Best for strict data-residency and compliance requirements.

Self-Hosted (Enterprise)

Run everything - control plane and data plane - in your own infrastructure, including fully air-gapped. Delivered with our solutions team. Talk to sales to scope it.

Which one should I choose?

Section titled “Which one should I choose?”
CloudEnterprise VPCSelf-Hosted
Where your data livesDeepintShield CloudYour cloud accountYour infrastructure
Who operates itDeepintShieldDeepintShield (control plane) + you (data plane)You
Get startedMinutes - sign upGuided onboarding with our teamTalk to sales
NetworkUse app.deepintshield.comOutbound-only to the control plane; no public ingressNone required (air-gap option)
Best forMost teams; fastest pathData residency, regulated industriesAir-gapped, on-prem, full control

DeepintShield Cloud

Section titled “DeepintShield Cloud”

Hosted and operated by DeepintShield. There is nothing to install - see the Gateway quickstart:

  1. Sign up at app.deepintshield.com.
  2. Add your provider keys and create a virtual key.
  3. Point your SDK or app at https://app.deepintshield.com.

Enterprise VPC

Section titled “Enterprise VPC”

You host the DeepintShield data plane (gateway + guardrails + ML detectors, with your own Postgres, Redis, and vector store) in your GKE / AKS / EKS cluster. DeepintShield runs the control plane at app.deepintshield.com for policy authoring, dashboards, and billing.

What stays in your VPC: every prompt, completion, embedding, retrieved chunk, provider key, and audit record. Only signed configuration flows down and aggregate counts flow up, over a single outbound-only, pinned mutual-TLS connection - there is no inbound path into your environment, and the control plane is never on the request hot path, so the split adds no extra latency.

See Enterprise VPC deployment for the step-by-step install.

Self-Hosted (including air-gapped)

Section titled “Self-Hosted (including air-gapped)”

Run the full stack - control plane and data plane - entirely in your own infrastructure, including fully air-gapped environments. Self-hosting is an Enterprise offering delivered with our solutions team, who provide the deployment bundle, license, and a guided rollout for your platform (GKE, EKS, AKS, on-premise, or air-gapped).

Next steps

Section titled “Next steps”