Skip to main content
Runlayer runs either as a Runlayer-hosted deployment (single-tenant infrastructure Runlayer operates for you) or self-hosted in your own AWS account or Kubernetes cluster. The two models split operational ownership differently. This page makes that split explicit so on-prem and self-hosted teams know exactly what they own versus what Runlayer owns. For the deployment topologies themselves (hosted, dedicated account, shared VPC, multi-tenant operator), see Deployment Overview. This page is about ongoing operations and support, not initial architecture.

​
The model at a glance

In both models your organization gets an isolated, single-tenant deployment — you are never sharing a database with other Runlayer customers. The difference is who runs the infrastructure, not whose data it is.

​
What stays the same in both models

Some things are part of the product and Runlayer owns them regardless of where you deploy:
  • Detection and governance logic — prompt-injection and data-exfiltration scanners, policy enforcement, and audit-log generation ship in the container images. You get the same controls self-hosted as hosted.
  • Product updates — every version is published in the changelog. Hosted deployments receive them automatically; self-hosted deployments pull the new image tag when you choose (see Updates).
  • AI Watch endpoint agent — runs on employee devices and reports only to your own tenant host, including on air-gapped networks with no public-internet egress.

​
Self-hosted: what you own operationally

If you run Runlayer in your own AWS account or cluster, you take on the infrastructure lifecycle:
  1. Provision with the ECS + Terraform, EKS + Terraform, or Helm modules. These ship autoscaling, managed Postgres/Redis, load balancing, and (on the Terraform paths) automated backups.
  2. Update by bumping the image tag and running terraform apply — updates are manual and fully under your control. See Updates.
  3. Monitor through CloudWatch (Terraform paths ship alarms) or your own Grafana/observability stack. See Monitoring.
  4. Back up and restore the database on your schedule. Automated backups are provisioned on the Terraform paths; with an external/BYO database on Helm, backups are your responsibility. See Backup & Restore.
  5. Secure the network and hosts — security groups, IAM/IRSA, KMS encryption, and TLS certificates. See Security.
Runlayer offers managed maintenance services (proactive monitoring, security patching, capacity planning) for self-hosted deployments as a support add-on. If you want Runlayer to co-own day-2 operations rather than owning them entirely yourself, see Maintenance and talk to your account team.

​
Support boundaries

Commercial support tiers, response-time SLAs, and dedicated Field Engineering hours are set in your order form, not in these public docs. Ask your Runlayer account team for the specifics that apply to your contract.

Deployment Overview

Hosted vs. self-hosted topologies and account isolation

Updates

How self-hosted version updates work

Backup & Restore

Data protection procedures

Monitoring

Observability and alerting