Documentation
Deployment models
One platform, three places to run it. The connector cluster inside your network is common to all three.
| SaaS (REAP Cloud) | Customer Cloud | Customer On-Prem | |
|---|---|---|---|
| Where REAP runs | REAP-operated, multi-tenant, AWS (opens in a new tab) U.S. regions, multi-AZ | Your AWS (opens in a new tab), Azure (opens in a new tab) or GCP (opens in a new tab) account | Your data center; air-gapped operation to confirm per customer |
| Where your data lives | REAP Cloud (U.S.) | Your cloud account | Your data center |
| Who operates the platform | REAP | REAP deploys; shared operation per agreement | You, with REAP support |
| Time to first value | Days | ||
| Typical fit | Most enterprises; pilots without residency constraints | When policy requires the platform and its data in your own cloud account | When policy excludes cloud hosting |
| Model endpoints | REAP-managed | REAP-managed; your endpoint | options |
| Product status | Available | By arrangement | By arrangement |
Common to all models
- A connector cluster inside your network handles collection.
- Read-only, least-privilege credentials by default, brokered through your PAM where available.
- SSO (SAML/OIDC), RBAC, multi-tenancy and audit logging are platform services.
- Encryption in transit (TLS 1.2+) and at rest (AES-256, cloud KMS).
Choosing
Rule of thumb If your security policy allows SaaS for configuration and telemetry metadata, start there. If data residency or an examiner requires it, Customer Cloud in your own account is available by arrangement and scoped with your cloud and identity teams before week 0; choose On-Prem, also by arrangement, when policy requires it. Air-gapped operation is confirmed per customer.
Last reviewed: October 7, 2026 (draft) · Owner: solutions engineering · Corrections: security@reapnet.ai