Flexible Deployment, Data Sovereignty First
SaaS, hybrid, and fully private deployments use different data boundaries. Hybrid and private modes can keep raw events customer-side.
Full SaaS
Mode A · Small teams, fast enablement
Control plane and data plane inside a cloud tenant boundary
- Managed infrastructure
- Automatic upgrades
- Tenant-configured data region
Hybrid (Recommended)
Mode C · Most enterprises
Customer-side retains raw events, SaaS hosts console
- Explicit raw-data boundary
- Managed console
- Masked summary upload
Fully Private
Mode B · Finance, government, regulated
Events and detection stay inside a private customer boundary
- Private data plane
- Offline upgrade packages
- Designed for regulated environments
Data Flow & Boundaries
Data location depends on deployment mode. Every mode must define its security boundary, storage region, masking level, and retention policy.
| Data Type | Example | Storage | Outbound | Notes |
|---|---|---|---|---|
| Raw Event Details | Raw tool params, paths, context | Deployment-dependent | By mode | Cloud tenant for SaaS; customer-side for hybrid/private |
| Masked Event Summary | Hashed paths, domains, rule tags | SaaS + Customer | Yes | For unified ops dashboard |
| Alert Metadata | Alert level, rule ID, time window | SaaS + Customer | Yes | No plaintext sensitive fields |
| AI-BOM Asset List | Model/tool/MCP nodes | SaaS + Customer | Configurable | Supports stats-only sync |
| Policy Config | allow/deny/risk thresholds | SaaS → Customer | Yes | Requires signature verification |
Four-Tier Masking Standard
Hybrid and private modes mask customer-side. Full SaaS applies the same levels inside the cloud tenant security boundary.
L0
No Masking
Enum values reported directly
Applies to: Tool name, decision type, protocol
L1
Partial Masking
Retain suffix + hash
Applies to: File path, URL
L2
Heavy Masking
Stats features only
Applies to: Command params, prompt content
L3
No Egress
Never leaves the current security boundary
Applies to: Keys, tokens, certificates, user plaintext
Delivery Boundaries
By Contract
Control Plane Availability
Tenant Policy
Data Region
Signed
Policy Delivery
Progressive
Version Migration