Deployment Targets (Cloud → Air-Gapped)

Where will it actually run? The tradeoffs across SaaS, the customer’s cloud/VPC, on-prem, and air-gapped — and what each costs you.

The four targets

Your SaaS (multi-tenant): Fastest to ship + update. Blocked when data can’t leave the customer’s network.
Customer cloud / VPC: Runs in their account. You get cloud tooling but their network + IAM rules.
On-prem: Their hardware/datacenter. You manage installs + updates; no managed services.
Air-gapped: No internet at all. Everything (models, deps, images) ships in by hand. Hardest.

Data egress: SaaS: leaves. VPC: stays in their account. On-prem/air-gap: never leaves.
Updates: SaaS: you push anytime. Air-gap: scheduled, manual, versioned bundles.
Model hosting: Cloud APIs fine on SaaS/VPC; on-prem/air-gap → self-host an open model (vLLM etc.).
Secrets: Their vault, their KMS, their rotation policy — not your .env.
Observability: Your dashboards on SaaS; on-prem you ship logs to their stack or a local one.
Your access: Full on SaaS; on-prem you may get a screen-share and someone else’s hands.

Ask in discovery: “Where can this run, and who approves it?” — it reshapes the whole architecture.
Package portably: Containerize; avoid a single cloud’s managed-only services if on-prem is possible.
Plan the update path: How do you ship v2 to an air-gapped site? Decide before v1.
Least privilege: Request the minimum access; security says yes faster to a small ask.