Self-hosted / VPC
Run the full control plane inside your own network. Cirvix never has to see raw payloads, only the decisions.
Every component described in the architecture overview runs inside your VPC in this mode — the gateway, the evaluator, and the decision log — with no requirement for agent traffic itself to leave your network.
Network requirements
| Direction | Path | Why |
|---|---|---|
| Egress | Gateway → model providers | Agents still need to reach whichever model they call |
| Egress | Gateway → your vault | Secret handle resolution |
| Ingress | Agent runtimes → gateway | The one path agent traffic takes |
| Egress (optional) | Decision log → external checkpoint witness | Independent verification of published checkpoints |
Data residency
Decisions, policy files, and trace metadata live inside your deployment. Secret values never leave your vault — only opaque handles cross the boundary, and the vault itself stays one you already run.
Note
For the full breakdown of what is and isn't stored, see Data handling.
Bring your own vault and identity provider
Neither is replaced by a self-hosted deployment — Vault, AWS/Azure/GCP secret managers, and Okta/Entra/Google all plug in the same way they do in the hosted product.
Edit this page on GitHub
Was this page helpful?