Whichever you choose, the product contract is the same: API keys or sessions authenticate requests,
the edge resolves identity before backend services handle the request, APIs are organization-scoped,
telemetry uses trusted run identity, and runtime capabilities are discovered through the API rather
than assumed from the deployment model.
Hosted SaaS
The managed hiloop deployment, operated by hiloop. Use it for the fastest path to telemetry capture, query, branch comparison, and runtime workflows without operating Kubernetes, databases, object storage, or the web/API control plane.
You remain responsible for managing API keys and user access, choosing what agent commands to run,
deciding which payloads are appropriate to capture, securing your own source repositories and
external services, and rotating any credentials you pass to workloads.
Requests enter through the hiloop edge: the edge resolves identity, backend services enforce organization
scope, and telemetry is stored under the resolved project and organization.
Hybrid
Managed hiloop services combined with customer-owned storage for selected payloads. Use it when you want managed operations but need event or workspace payloads to stay under customer-controlled object storage and keys.
Choose hybrid when operational simplicity matters, payload locality is a requirement, and the control
plane can remain managed. Exact payload classes and key ownership are part of the deployment
agreement. Choose on-prem instead when metadata, identity, control plane, runtime, and payloads all
need to stay inside your environment.
BYOC
A hiloop-operated control plane over a data plane in your own cloud account. Identity, projects, admission, and orchestration stay managed; sandbox compute, workspace and event payload storage, and telemetry run inside your account. The data plane in your account holds one outbound, mutually authenticated control connection to the managed control plane; content-bearing traffic — workspace bytes, event payloads, sandbox egress — stays inside your boundary and never transits hiloop-operated infrastructure.
Choose BYOC when payloads and compute must stay in your account but you want the control plane
operated for you. The exact scope is part of the deployment agreement.
On-prem and air-gapped
hiloop running entirely inside customer infrastructure. The customer controls the cluster, database, object storage, registry, TLS certificates, identity provider, network policy, and local observability. Use it when data and metadata must remain inside the customer environment. On-prem has two support postures. The default, supported posture sends a fixed platform-health metrics contract — never workload data, event payloads, or customer telemetry — to hiloop support. Fully air-gapped deployments disable it (supportTelemetry.enabled=false), which removes the
external exporter and pipeline entirely; local platform observability keeps working either way.
On-prem installs use Helm charts — the generated Helm reference lists chart
values and defaults. For an air-gapped install, mirror images and charts into a registry reachable
from the cluster first. A typical rollout:
- Provision the cluster and namespaces.
- Configure identity, session issuer, and audience consistently.
- Provide database and object storage credentials.
- Mirror images and chart artifacts.
- Configure DNS, TLS, and routes.
- Configure local observability.
- Validate backup and restore.
- Smoke-test identity, telemetry ingest, query, and a bounded sandbox create, exec, and delete.
Next
- Helm deployment — chart wiring and values.
- Security model — the trust boundary across models.
- Network requirements — connectivity and egress.
- Backup and restore — recovery procedures.