Enterprise BYOC is the PrivateStack deployment tier where the governed AI workspace runs inside your own AWS account, in a VPC you own, under keys you manage. Under this deployment, prompts, completions, retrieval documents, and audit logs remain in your VPC; control-plane metadata is the documented exception, and the boundary map below says exactly what that means.
This page is the honest version of "your data stays with you". It names every data path, says where each one runs, who can see it, whether it leaves your VPC, and which artifact proves it. If a row says yes, qualified, that is by design and you will see it before you sign.
Everything on this page describes the Enterprise BYOC deployment only. PrivateStack's Hosted and Solo tiers run on DSE-managed infrastructure, with inference processed by a disclosed zero-data-retention inference subprocessor under contract. Those tiers are privacy as contract. BYOC is privacy as infrastructure. They are not interchangeable, and no sentence here should be read as describing the hosted tiers.
"Bring your own cloud" is used loosely across the market. At DSE it means three specific, checkable things about where PrivateStack and its BisChat workspace actually run.
The data plane, meaning model serving, the conversation store, file and attachment storage, the vector index, and the audit log, is provisioned into an AWS account you own. DSE reaches it only through an assumed, least-privilege IAM role with an external ID, and every assumption lands in your CloudTrail. AWS is the supported cloud for BYOC today.
The workload runs in subnets you design, behind security groups and route tables you control. Required egress is documented as an allowlist before deployment, so "what still calls out" is a list you have read, not a discovery you make later.
Every content-bearing store is encrypted under AWS KMS keys you administer. The key policy, not our intentions, decides which principals can decrypt what. You see the policy JSON before signing, and you can revoke it.
Terminology: the data plane is everything that touches your content. The control plane is the machinery that provisions, licenses, and upgrades the stack; DSE operates it. The boundary map below is organized around that split.
Read the "leaves your VPC?" column first. For the Enterprise BYOC deployment, every content-bearing path stays. Two rows leave by design: control-plane metadata and telemetry. Neither carries prompts, completions, documents, or log content, and both are enumerated in a written egress inventory at architecture review.
| Data path | Where it runs | Who can see it | Leaves your VPC? | Evidence artifact |
|---|---|---|---|---|
| User prompts and completions | Application and inference tier in your AWS account, inside your VPC. | Your users, per the roles you configure. DSE only through approved, time-boxed support access that you grant per incident. | No | Application audit log export; VPC flow logs; documented egress allowlist |
| Model weights and inference | Open-weight model artifacts pulled into your account at deploy time from a documented source; inference runs on compute in your account. | Your platform administrators. | No | Deployment manifest listing model artifacts and their source; instance and service inventory |
| Retrieval documents and embeddings | Object store and vector index in your account, encrypted under your KMS key; chunk text is stored beside each vector, inside the same boundary. | Your users, per corpus and role; your administrators. | No | KMS key policy; bucket and index inventory; encryption-at-rest configuration |
| Audit logs | Per-request log store in your account, exportable without DSE in the path. | Your security and compliance team. DSE support only under approved access, which is itself logged. | No | Log schema and export sample; retention setting; CloudTrail record of any DSE session |
| Control-plane metadata (tenant configuration, entitlements, billing) | The PrivateStack control plane, operated by DSE on DSE-managed AWS infrastructure in the United States. | DSE operations. | Yes, qualified | Egress inventory listing endpoints and payload fields; subprocessor disclosure; DPA |
| Telemetry and metrics | Health and usage counters emitted from your deployment to the DSE control plane, restricted to the documented allowlist. | DSE operations. | Qualified | Telemetry payload schema showing counters and identifiers only, never content; allowlist configuration |
| Support access | A break-glass IAM role in your account: requested per incident, approved by you, time-boxed, scoped to the task. | The DSE engineer for that session only; every action recorded in your CloudTrail. | No data movement; inbound, logged, revocable | Role trust and permission policy JSON; approval record; session log |
| Backups | Snapshots in your account under your KMS key, on a retention schedule you set. | Your administrators. | No | Backup policy; snapshot inventory; restore test record |
| Contrast: Hosted tier (not BYOC) | Governed, isolated workspace on DSE-managed AWS infrastructure in the United States; inference processed by a disclosed zero-data-retention inference subprocessor. | DSE operations, and the inference subprocessor for the duration of each request under zero-data-retention terms. | Yes: there is no customer VPC in this tier | Subprocessor disclosure; DPA; audit-log export; no training on customer data |
Honesty note: the control-plane and telemetry rows are the reason this page does not claim that "nothing ever leaves". Seat counts, feature flags, and health counters are vendor business state, not your content. If a vendor tells you nothing leaves, ask for the egress inventory. We will hand you ours before you sign.
If a contract, a regulator, or a data-classification policy says content must stay inside infrastructure you control, BYOC is the tier that can say yes with evidence. If it does not, the hosted tier is cheaper and faster.
Each step produces an artifact you keep whether or not you continue. Prices are the published Private AI floors from the security services pricing page; the final fee is set at scoping.
Thirty minutes. We confirm the boundary requirement, the AWS estate, and who administers IAM and KMS on your side. You leave with a fit or not-fit answer.
Data-flow review, hosting pattern, role and key-policy design, the egress inventory, and the per-layer responsibility split, written for your reviewers.
One environment, one workflow, one corpus, deployed into your account through the assumed role, tested against AI-specific failure modes, and handed over with an evidence package.
Separate environments, SSO, multiple corpora, change control, and then operations: upgrades, re-testing, evidence upkeep, and break-glass support.
Only the Enterprise BYOC deployment runs the data plane inside a customer-owned account. PrivateStack's Hosted and Solo tiers are governed workspaces on DSE-managed infrastructure with inference through a disclosed zero-data-retention inference subprocessor. That is a contractual posture, disclosed affirmatively, and it is a good fit for many teams. It is not the posture described on this page.
BYOC supports AWS as the data-plane cloud today. It does not freeze the software: upgrades reach your account through a documented, version-pinned mechanism with rollback, and that path is reviewed with the same scrutiny as any other deployment credential. Control-plane metadata and telemetry leave your VPC by design, with content excluded. DSE does not operate a 24/7 SOC, does not certify compliance with any framework, and does not provide legal advice. The written egress inventory and responsibility split for your specific deployment, not this page, are the binding description.
Prompts, completions, retrieval documents, embeddings, audit logs, and backups stay in your VPC under the BYOC deployment. Control-plane metadata, meaning tenant configuration, entitlements, and billing, and operational telemetry leave by design; neither carries content, and both are listed field by field in the egress inventory you receive at architecture review.
Through an IAM role you publish with a trust policy naming DSE's principal, guarded by an external ID, with permissions you set. Deployment and support roles are separate. You can narrow or delete the role at any time; every assumption is a CloudTrail management event in your account.
PrivateStack ships open-weight models such as Llama, Mistral, and DeepSeek. Model artifacts are pulled into your account at deploy time from a source listed in the deployment manifest, and inference runs on compute in your account. DSE does not train foundation models and does not train on your content.
A written per-layer split ships with every deployment: you own the account guardrails, network, keys, and the data plane you now host; DSE builds and delivers platform updates through the documented mechanism, maintains the serving stack and model catalog it ships, watches the control plane, and notifies on a contracted clock. The vendor-neutral version of that split is in the BYOC on AWS guide.
Compliance is a property of your program, not of a deployment tier. BYOC gives you the architecture a HIPAA Security Rule or GLBA safeguards review expects: content inside your boundary, access on every call, attributable logs, and change control. DSE prepares the evidence; your counsel and your reviewers draw the conclusions.
The Private AI Pilot starts from $40,000 fixed, the Foundation from $75,000, and Managed Ops from $8,000 a month on a 12-month minimum. Those are published list floors; the final fee is set at scoping and fixed in writing. Larger estates route to custom pricing.