Deployment Targets (Cloud → Air-Gapped)
Where will it actually run? The tradeoffs across SaaS, the customer’s cloud/VPC, on-prem, and air-gapped — and what each costs you.
The four targets
- Your SaaS (multi-tenant)
- Fastest to ship + update. Blocked when data can’t leave the customer’s network.
- Customer cloud / VPC
- Runs in their account. You get cloud tooling but their network + IAM rules.
- On-prem
- Their hardware/datacenter. You manage installs + updates; no managed services.
- Air-gapped
- No internet at all. Everything (models, deps, images) ships in by hand. Hardest.
What changes as you move right
- Data egress
- SaaS: leaves. VPC: stays in their account. On-prem/air-gap: never leaves.
- Updates
- SaaS: you push anytime. Air-gap: scheduled, manual, versioned bundles.
- Model hosting
- Cloud APIs fine on SaaS/VPC; on-prem/air-gap → self-host an open model (vLLM etc.).
- Secrets
- Their vault, their KMS, their rotation policy — not your
.env. - Observability
- Your dashboards on SaaS; on-prem you ship logs to their stack or a local one.
- Your access
- Full on SaaS; on-prem you may get a screen-share and someone else’s hands.
De-risk early
- Ask in discovery
- “Where can this run, and who approves it?” — it reshapes the whole architecture.
- Package portably
- Containerize; avoid a single cloud’s managed-only services if on-prem is possible.
- Plan the update path
- How do you ship v2 to an air-gapped site? Decide before v1.
- Least privilege
- Request the minimum access; security says yes faster to a small ask.
Cost, effort & pricing
- Effort ramp
- Each step right roughly multiplies deployment + support effort: SaaS ≪ VPC < on-prem ≪ air-gapped.
- Who pays for compute
- SaaS: you (bake into price). VPC/on-prem: the customer’s cloud/hardware bill — price the software, not the infra.
- Support model
- SaaS: you see everything and fix fast. On-prem/air-gap: you debug blind through their team — budget for it.
- Price the friction
- Air-gapped and on-prem deals should carry a premium — they cost far more to deliver and maintain.
- GPU reality
- Self-hosting an open model on-prem means sizing, buying, and babysitting GPUs — a real project, not a checkbox.