# Deployment options

Witbitz can run as a hosted platform, in a customer's cloud boundary, or in an air-gapped environment. The product
claim changes slightly in each mode, so the docs keep the deployment model explicit.

---

## The options

<div class="flow four" aria-label="Deployment boundary map">
  <div class="node"><strong>Hosted</strong><span>Witbitz operates the runtime; builders get tenant keys during private beta.</span></div>
  <div class="node"><strong>Enterprise</strong><span>The same runtime runs inside a customer cloud boundary.</span></div>
  <div class="node"><strong>Air-gap</strong><span>No external egress; model and replacement services stay local.</span></div>
  <div class="node"><strong>Bridge</strong><span>Sovereign Spaces collaborate without merging tenants or trust domains.</span></div>
</div>

| Option | Status | Boundary | Best fit |
|---|---|---|---|
| **Hosted private beta** | Live, invite-only | Witbitz-operated cloud | Early builders and platform integrations. |
| **Enterprise VPC / on-prem** | Runnable today | Customer-controlled cloud or network | Enterprise buyers who want their own model, storage, IdP, and ops. |
| **Air-gap** | Runtime switch exists; self-hosted model quality remains the main work | No external egress | Regulated, defense, government, and high-control deployments. |
| **Bridge** | Early protocol preview | Multiple sovereign Spaces or external parties | Cross-organization collaboration without merging tenants or trust domains. |

## Hosted

Hosted is the default private-beta path. Witbitz operates the runtime and exposes the tenant-keyed `/v1` API to invited
integrators. The privacy claim rests on the checkable hosted evidence:

- admission gate checks
- sealed storage transparency
- browser egress lock
- signed build certificate
- reproducible render build

Read: [Hosted private beta](./hosted-private-beta.md), [Verify it yourself](./verify.md)

## Enterprise VPC / on-prem

In a customer boundary, the same runtime points its seams at customer-controlled services:

- model endpoint
- object store
- record store
- secrets backend
- identity provider
- logs, backup, retention

The trust story shifts from "verify Witbitz's hosted deployment" to "verify the image you run and control the
boundary yourself."

Read: [Enterprise and on-prem](./on-prem.md)

## Air-gap

`AIRGAP=1` refuses outbound paths in the browser and server. External tools are disabled unless replaced with local
services. The model must also be in-boundary for a true air-gap.

Read: [Air-gap mode](./air-gap.md)

## Bridge

The Bridge is not a deployment target for one app. It is the cross-boundary protocol for governed collaboration
between sovereign Spaces, including external parties that do not run Witbitz internally.

Read: [The Bridge](./the-bridge.md)

## Choosing a mode

| Need | Start with |
|---|---|
| Build against the API quickly | Hosted private beta |
| Keep data and model calls inside your tenant | Enterprise VPC / on-prem |
| Prove no external egress | Air-gap |
| Collaborate with another organization without sharing a tenant | Bridge |
| Verify hosted privacy claims | Hosted + verify page |
| Remove Witbitz as an operator | On-prem |