VPC Deployment
Running your software inside the customer’s own cloud account and network, rather than in your SaaS.
A VPC deployment puts the system inside the customer’s virtual private cloud so their data never leaves their boundary. It is the most common compromise between a SaaS product and a full on-prem install, and it changes what you can assume: you may not own the network, the egress rules, the secrets manager or the deployment pipeline.
Worked example: a pipeline that works in your account fails inside the customer’s VPC because outbound calls to a third-party API are blocked by egress rules — a class of failure that is invisible until you deploy there. Gotcha: observability is the usual casualty; plan for logs that cannot leave, and build an exportable diagnostic bundle before your first incident, not during it.