Skip to content
DeepIntShield DeepIntShield

Deployment options

DeepIntShield offers three operated deployment shapes plus a repository-owned Cloud Run reference tier. They share the same gateway and APIs; what changes is where your data lives, who operates the infrastructure, and the latency and availability envelope.

DeepIntShield Cloud

Fully hosted at app.deepintshield.com. Nothing to deploy - sign up, create a virtual key, and point your SDK at the gateway. Best for most teams.

Cloud Run cost tier

Run the full reference stack in your Google Cloud project with Cloud Run, Cloud SQL, GCS, Redis, models, and required OpenFGA. Best for dev, demos, and low traffic that tolerates scale-to-zero cold starts.

Enterprise VPC

The data plane runs in your own cloud (GKE / AKS / EKS); DeepIntShield manages the control plane. No prompt, response, key, or audit data leaves your VPC. Best for strict data-residency and compliance requirements.

Self-Hosted (Enterprise)

Run everything - control plane and data plane - in your own infrastructure, including fully air-gapped. Delivered with our solutions team. Talk to sales to scope it.

Which one should I choose?

Section titled “Which one should I choose?”
CloudCloud Run cost tierEnterprise VPCSelf-Hosted
Where your data livesDeepIntShield CloudYour Google Cloud projectYour cloud accountYour infrastructure
Who operates itDeepIntShieldYouDeepIntShield (control plane) + you (data plane)You
Get startedMinutes - sign upRepository scriptsGuided onboarding with our teamTalk to sales
NetworkUse app.deepintshield.comPublic Cloud Run ingress or authenticated proxyOutbound-only to the control plane; no public ingressNone required (air-gap option)
Best forMost teams; fastest pathDev/demo/low traffic; cost-firstData residency, regulated industriesAir-gapped, on-prem, full control

DeepIntShield Cloud

Section titled “DeepIntShield Cloud”

Hosted and operated by DeepIntShield. There is nothing to install - see the Gateway quickstart:

  1. Sign up at app.deepintshield.com.
  2. Add your provider keys and create a virtual key.
  3. Point your SDK or app at https://app.deepintshield.com.

Cloud Run cost tier

Section titled “Cloud Run cost tier”

The deployment/tiers/cloud-cheap reference deploys one multi-container Cloud Run service with durable Cloud SQL application/OpenFGA databases and a GCS model cache. OpenFGA is required, canonical GAF startup fails closed, and the scripts configure the stable deployment origin/encryption needed by strict MCP OAuth 2.1.

Its defaults scale from zero to one instance, so it trades idle compute cost for cold-start latency and is not an HA profile. See Cloud Run cost tier for deployment, verification, scaling, and security behavior.

Enterprise VPC

Section titled “Enterprise VPC”

You host the DeepIntShield data plane (gateway + guardrails + ML detectors, with your own Postgres, Redis, and vector store) in your GKE / AKS / EKS cluster. DeepIntShield runs the control plane at app.deepintshield.com for policy authoring, dashboards, and billing.

What stays in your VPC: every prompt, completion, embedding, retrieved chunk, provider key, and audit record. Only signed configuration flows down and aggregate counts flow up, over a single outbound-only, pinned mutual-TLS connection - there is no inbound path into your environment, and the control plane is not on the ordinary request hot path. Local policy enforcement, configuration-cache misses, instrumentation, and upstream calls still add workload-dependent latency; benchmark the complete VPC path under expected concurrency and failure modes.

See Enterprise VPC deployment for the step-by-step install.

Self-Hosted (including air-gapped)

Section titled “Self-Hosted (including air-gapped)”

Run the full stack - control plane and data plane - entirely in your own infrastructure, including fully air-gapped environments. Self-hosting is an Enterprise offering delivered with our solutions team, who provide the deployment bundle, license, and a guided rollout for your platform (GKE, EKS, AKS, on-premise, or air-gapped).

Next steps

Section titled “Next steps”