Forward Deployed Engineering Tutorial · Deploying in Customer Environments · Lesson 14 of 24
SaaS, Customer VPC, On-Premises and Air-Gapped
The ways software is deployed for enterprise customers, and what each means for networking, updates, support and security.
Deployment models
| Model | Where it runs | You control | Typical customers |
|---|---|---|---|
| Multi-tenant SaaS | Your cloud | Everything | Most |
| Single-tenant SaaS | Your cloud, dedicated to one customer | Everything | Larger customers wanting isolation |
| Customer VPC / BYOC | Customer's cloud account | Software; they control the account | Data-sensitive enterprises |
| On-premises | Customer's data centre | Little; they run it | Regulated industries, legacy |
| Air-gapped | No internet at all | Almost nothing; updates by approved media | Defence, some government and critical infrastructure |
needs = {"data must stay in customer cloud": True, "customer runs on-prem only": False, "no internet access": False}
if needs["no internet access"]:
model = "air-gapped install (offline images, models and licence)"
elif needs["customer runs on-prem only"]:
model = "on-premises install (Helm/VM appliance)"
elif needs["data must stay in customer cloud"]:
model = "deploy into the customer's VPC (BYOC) with Terraform/Helm"
else:
model = "multi-tenant SaaS"
print("recommended:", model)
Output
recommended: deploy into the customer's VPC (BYOC) with Terraform/Helm
Consequences for engineering
- Packaging: Helm charts or Terraform modules the customer can apply; versioned, documented releases.
- Updates: customers may lag many versions; support upgrades across versions.
- Observability: you may not see logs; ship diagnostics bundles and clear error messages.
- Dependencies: no calls to the internet in air-gapped installs; mirror images and models locally.
Test yourself
A customer requires that data never leaves their AWS account, but they're happy for you to operate the software. Which model fits?
Multi-tenant SaaSDeploy into the customer's VPC (bring your own cloud)Email them a ZIP fileAir-gapped
Show answer
Answer: Deploy into the customer's VPC (bring your own cloud)
BYOC keeps data in their account while you ship and operate the software.