Platform architecture
ThreatLens sits between your people and the AI models they use, so every request passes a single governed checkpoint before a model ever sees it. The same core deploys three ways — in our cloud, inside your own cloud, or fully on‑premises. What changes between them is the trust boundary and where inference and data‑at‑rest live.
The governed checkpoint
Identical in every deployment. Before a model receives anything, ThreatLens:
| Stage | What it does |
|---|---|
| Identity | Signs the user in (SSO / SCIM) and trims access to what they're already permitted to see. |
| Classify & DLP | Detects sensitive content and redacts or withholds it. |
| Policy & Route | Decides allow / warn / block, and which model may serve the request. |
| Audit | Writes an immutable, per‑request record of the decision. |
Public cloud · SaaS
ThreatLens runs the governed checkpoint and stores governed data in our multi‑tenant cloud. You connect your identity provider and content sources; models are reached through governed egress to provider APIs.
Best when you want the fastest path to adoption with no infrastructure to run.
Private cloud · your VPC
The same checkpoint and encrypted store run inside your cloud account. Governed data never leaves your VPC; models are reached by governed egress from your network using your keys. ThreatLens delivers software and policy updates through a control‑plane link only.
Best when data residency or single‑tenant isolation matters and you want ThreatLens running inside a boundary you already control.
On‑premises · air‑gap capable
Everything — checkpoint, store, and the model itself — runs inside your data center. Inference uses a private model on your own infrastructure, so there is no runtime dependency on any external service. Egress to approved providers is optional and off by default.
Best when you operate under strict isolation, sovereignty, or air‑gap requirements and inference must stay on infrastructure you own.
Choosing a deployment
The governed checkpoint is identical across all three. These are the real trade‑offs.
| Public cloud (SaaS) | Private cloud (your VPC) | On‑premises | |
|---|---|---|---|
| Runs in | ThreatLens cloud | Your cloud account | Your data center |
| Governed data at rest | ThreatLens tenant — encrypted, isolated, your retention policy | Your VPC — never leaves your account | Your perimeter — never leaves your walls |
| Model inference | Provider APIs (your keys or included credits) | Provider APIs, egress from your VPC (your keys) | Private / local model on your infrastructure |
| Runtime dependency on ThreatLens cloud | Yes — it is the service | Control plane only (policy & updates) | None — air‑gap capable |
| Adopt it when | Speed; no infra to run | Residency & VPC control | Strict isolation / sovereignty |
This page is a conceptual reference to how ThreatLens is structured and deployed. Exact component boundaries and integrations are confirmed for your environment during onboarding.