Scheduled maintenance in progress — sign-in and sign-up are temporarily disabled. The rest of the site works normally.

Skip to content
All posts
Security

Where your data runs: cloud, silo, or your own infra

Same platform, three places to run it — from our managed cloud to fully inside your VPC. Flip between them and see exactly what leaves your perimeter.

J
Jhosetp Chino
Founder & Engineer · Jun 9, 2026 · 5 min read
Share

“Where does our data go?” is the first question a serious buyer asks — and the one most AI platforms answer with a shrug and a data-processing addendum. We answer it with a switch.

Thaliq runs as the same images and the same code in three topologies. What changes between them isn’t the product — it’s the adapters and where they run. Flip between the three and watch what crosses your perimeter:

Where your agent runsInteractive
Managed by us, multi-tenant pool.
Client
APIThaliq Cloud
RuntimeThaliq Cloud
Modelmanaged
Thaliq perimeter
Data lives
in Thaliq Cloud
Isolation
shared runtime pool
Inference
managed or BYO-key
You operate
nothing — fully managed

Same images, same code — only the adapters and where it runs change.

One product, three postures

  • Cloud · shared — the default. We run everything, multi-tenant. Fastest to start; you operate nothing.
  • Cloud · isolated runtime (silo) — your agent runtime is dedicated, no neighbors, while the control plane stays managed. The isolation tier without leaving our cloud.
  • Self-host — the whole platform (API + runtime) deployed inside your own VPC. Your data never leaves your perimeter. Inference is your model (BYO-LLM, e.g. Claude on Vertex). There’s no phone-home; it validates its license offline.

Notice what doesn’t change as you move right: the agent, the tools, the loop, the API contract. That’s the point. Sovereignty shouldn’t cost you a different, worse product.

How the same image can go anywhere

The trick is boring, which is why it works: ports and adapters. Every piece of infrastructure the platform touches — object storage, database, secrets, event bus, telemetry, the model — sits behind a port. In our cloud the adapter is S3, DynamoDB, Bedrock. In yours it’s GCS, Cloud SQL, Vertex. The domain code never knows the difference.

So “self-host” isn’t a forked, lagging edition maintained on the side. It’s the same build, wired to different adapters, with the business plane (billing, provisioning) simply left out of the client image — by construction, not by promise.

Who this is for

If you’re in a regulated industry — health, finance, the public sector — “trust us, it’s encrypted” isn’t an answer you can take to your security review. Being able to say “the platform runs in our account, our data never leaves, we bring our own model” is. That’s the posture self-host gives you, and it’s the same Thaliq everyone else runs.

Pick the tier that matches your risk. Move up when you need to. The product comes with you.

Ready to build your first agent?

The infrastructure is done. Bring your model and ship.

Get started