Deployment & data ownership
Keep ownership of your data. Run your own agent VMs and connections in your VPC, with a cloud platform for coordination.
Three ways to host the same platform
- Fully managed: Entergenie operates the platform, standard runners, and connections. Your data remains yours.
- Your runners: use the same cloud platform with agent VMs and connections in your VPC. Agree which task context, results, and audit records the cloud platform receives.
- Enterprise · Fully self-hosted: operate the entire platform, task records, runners, and connections in your infrastructure. Only aggregate execution seconds and a deployment identifier are required for billing; disconnected installations can submit a monthly usage summary.
Mix managed and customer-hosted runners in one cloud workspace. Choose the execution environment for each agent or session and pay that runner’s usage rate. Confirm the selected runner can reach its approved connections; a managed runner does not automatically gain access to private VPC resources.
All three use the same task and agent concepts and controls. Compare usage rates and hosting responsibilities →
A cloud platform. Your choice of execution environment.
Use Entergenie’s cloud platform to manage agents, tasks, policies, and reviews. For a cloud-hosted platform, choose managed execution or run your own agent virtual machines in your VPC. In the customer-hosted option, sessions execute in your infrastructure and use connections that you host and operate.
Task coordination and task execution have different boundaries. The cloud platform coordinates work; your agent VMs access approved systems within your network. Agree which task descriptions, status updates, results, and audit records the cloud platform receives. Hosting execution privately does not by itself make every part of a task private.
Connect to your data where it already lives
Host your own MCP servers and connection services beside your business systems. Give each connection a Capability Owner, a limited service identity, and access only to approved resources. Keep source-system credentials in your secret manager and behind the connection rather than passing them into model context.
A connection exposes scoped tools; it does not require a wholesale copy of the source system into Entergenie. Choose what a tool returns, redact unnecessary fields, and enforce resource permissions in the system that owns the data.
Decide what crosses each boundary
| Boundary | What to decide |
|---|---|
| Business systems → agent VM | Approved resources, returned fields, temporary files, and session storage. |
| Agent VM ↔ cloud platform | Task context, status, evidence, results, approval payloads, and audit metadata that may be transmitted and retained. |
| Agent VM → model endpoint | Prompts, tool outputs, provider region, processing terms, and any model-provider retention. |
| Execution → observability | Log and trace destinations, redaction, access, retention, and deletion. |
Choose your own LLM endpoint, including one hosted in your environment. If you select an external model API, the context sent to that API leaves your VPC. Private agent VMs and connections do not remove that boundary. Configure network egress and model routing around your data requirements.
Own the environment. Make operations explicit.
For customer-hosted VMs and connections, assign responsibility for VM images, patching, isolation, networking, credentials, monitoring, and availability. Define the supported runtime, connectivity, update process, and support boundary with Entergenie before rollout.
Agree processing locations, access, retention, export, and deletion for every place that stores task data, including the cloud platform, session disks, model providers, and backups. A private VPC is one boundary in that design, alongside policy and execution identity.
Plan your deployment
- Choose managed execution or customer-hosted agent VMs in your VPC.
- Identify source systems, host the required connections, and assign their owners.
- Choose model endpoints and allow only the necessary network paths.
- Agree the task context, results, and telemetry that can reach the cloud platform.
- Verify allowed and denied access with non-sensitive fixtures before connecting business data.
VM sizing, runtime provisioning, private connectivity, and operating costs are scoped to your environment. Discuss your deployment requirements →