Deployment Options
AI Runtime runs where your security and compliance requirements need it to: as a managed service, as a dedicated gateway reachable only from your network, or inside your own cloud account. The console, policies and incidences work the same way in every option.
Limited access
AI Runtime is available to select customers. Dedicated and self-hosted deployments are part of the Enterprise plan. Contact sales to discuss the option that fits your environment.
Options at a Glance
| Option | Where the gateway runs | Who operates it | Best for |
|---|---|---|---|
| SaaS | ByteHide's managed, multi-tenant gateway | ByteHide | Getting started, most production workloads |
| Dedicated | A single-tenant gateway in a dedicated cloud account, reachable privately from your network | ByteHide | Regulated environments that need network isolation without running infrastructure |
| Self-hosted | Your own cloud account: AWS, Azure or Google Cloud | You, with ByteHide's deployment kit | Keeping the gateway, its configuration and its incidence data in your own cloud account |
SaaS
The default. Your organization's gateway is served at https://gateway.bytehide.com/YOUR_ORG_ID, and you only configure routes, policies and credentials in the console. ByteHide runs, scales and updates the gateway.
Dedicated
A gateway that serves only your organization, in its own cloud account, with its own control plane and data stores. Nothing is shared with the SaaS gateway or other customers. Your applications and agents reach it over private connectivity from your data center or cloud network, such as a site-to-site VPN, and its data plane is not published on the public internet.
Your team keeps using the same ByteHide console: it talks to your dedicated gateway instead of the SaaS one. See Dedicated & Self-Hosted.
Self-Hosted
The gateway runs in your own cloud account, managed by your team, with:
- Infrastructure as code for AWS, Azure and Google Cloud (Terraform and Pulumi).
- A Helm chart for managed Kubernetes (EKS, AKS, GKE), the recommended setup for production.
- A Docker Compose option on virtual machines, for proofs of concept or a single team.
Prompt classification is provided by ByteHide's hosted classification service, as in every other option.
See On-Premises Deployment for the install steps, Requirements for sizing, and Architecture for the diagrams.
What Stays the Same
Whatever the option:
- The same gateway mode and in-app mode integrations, URLs aside.
- The same policies, detectors, routes, consumers and MCP protection.
- The same prompt classification, served by ByteHide's hosted classification service.
- The same Incidences, Attackers, Playbooks, Alerts and Audit log in the console.
Next Steps
Dedicated & Self-Hosted
How the private deployments are built
On-Premises Deployment
Install options, steps and upgrades
Architecture
Components, request paths and diagrams
Network Requirements
What to prepare on your side