Layer 01
Customer control plane
Policy · Identity · Audit
Always administered by you, wherever the platform runs.
Platform · Deployment and data sovereignty
Your environment. Your keys. Your control.
Choose where the platform runs and who holds the keys. Vaultize supports on-premises, private-cloud, sovereign-cloud, hosted and hybrid design patterns.
Deployment principle
Your architecture determines the deployment.
Regulated enterprises differ in where data may reside, who may operate infrastructure and who must hold encryption keys. Vaultize aligns deployment and custody with that operating model.
Deployment freedom is a platform principle. Exact availability and responsibility boundaries are confirmed during architecture planning.
Layer 02
Keys and source-side encryption
BYOK · HSM · Key rotation
You hold the keys. Cleartext stays inside your trust boundary.
Layer 03
Runs where you decide
On-premises · Private cloud · Sovereign regional cloud · Hosted · Hybrid
The deployment model follows your residency and custody constraints. Isolated or air-gapped requirements are confirmed during solution design.
Deployment models
Six operating patterns. Your constraints pick one.
The model is selected from residency, custody, isolation and operating constraints, not from a generic hosting preference.
01
On-premises
Operate the platform inside enterprise-controlled infrastructure.
02
Private cloud
Place the platform within a customer-controlled cloud environment.
03
Sovereign regional cloud
Align hosting location with regional sovereignty requirements.
04
Air-gapped
Available as a design subject to solution confirmation; offline update and licensing planning are included for isolated networks.
05
Hosted
Vaultize operates the platform for you, where your risk posture and approved architecture allow.
06
Hybrid
Combine patterns around workload and custody needs, for example sovereign production with hosted disaster recovery.
Custody and control
Sovereignty is a set of specific, verifiable decisions.
01
Data location
You decide where protected content and platform services operate, and the configuration is evidence you can show.
02
Key custody
Where confirmed for the selected deployment, BYOK, enterprise HSM support and key rotation keep encryption keys in your hands. Vaultize operates on policy, not on possession of your keys.
03
Source-side protection
Encryption at the source keeps cleartext inside your trust boundary before anything moves.
04
Independence
Designed to minimise external runtime dependencies; the deployment stack and support model are confirmed during solution design.
Architecture planning
Make deployment decisions from constraints, not labels.
Six questions decide the architecture. Bring the answers and the review is short.
Bring your six answers to an architecture sessionResidency
Where may data and platform services operate?
Keys
Who must hold and rotate encryption keys?
Operations
Which teams administer policy, infrastructure and recovery?
Connectivity
Which identity, repository, SIEM and application paths are required?
Isolation
Which workloads require dedicated infrastructure boundaries?
Recovery
Which critical data must remain recoverable even if production and backup are both compromised?
Availability guidance
Deployment fit is confirmed for the proposed architecture.
Deployment options vary by product, workload and operating model. During solution design we confirm availability, residency, maintenance, offline update and licensing requirements for the proposed architecture.
Map the deployment model to your sovereignty requirements.
Bring your six answers: residency, keys, operations, connectivity, isolation and recovery. We will use them to frame the architecture discussion.