Identity and keys
The design uses your identity provider, secrets manager, encryption keys, logs and access controls. A local installation must reject access from other customer organisations.
Sovereign deployment
For organisations that need the portal, identity, orchestration and evidence to remain in a controlled estate—not just the test environment.
Sovereign installation, disconnected operation and release parity require implementation and acceptance testing. They are not generally available deployment capabilities today.
Your controlled estate
The design uses your identity provider, secrets manager, encryption keys, logs and access controls. A local installation must reject access from other customer organisations.
A customer-controlled update process verifies signed release manifests and immutable images. You approve maintenance windows, permission changes and migrations.
The design supports transferred release bundles and locally checked entitlements. No workload inventory or evidence should be required by a licensing exchange.
Agree the hosting substrate, identity integration, database/object adapters, backup and restore, offline dependency supply, update/rollback path and supported capabilities. Prove these in your boundary before relying on parity with the managed product.
Today’s managed implementation uses WorkOS and AWS-specific database/event transports. Portable identity and infrastructure adapters, signed release delivery and disconnected acceptance remain implementation work. A diagram alone cannot establish sovereignty.
Compare all deployment optionsUse the evaluation discussion to establish the boundary, delivery work and acceptance evidence your organisation requires.