Deployment
It runs where your data already is.
Single-tenant, in your environment. Not a tenant in ours with a residency label — no payload reaches us on any path, and the outbound connections a deployment could make are enumerable and probed rather than described.
Four tiers, and what each one gives up
| Tier | Runs | Signing key | What it forbids |
|---|---|---|---|
| Sandbox | Ours, synthetic data only | Ephemeral — and every artefact says so | Real data. It is for learning the shape. |
| Your cloud | Your VPC, your account | Your KMS or HSM | Nothing by default; egress is per-feature and off unless set |
| On-premise | Your data centre | Yours, up to external custody | Anything your network does not permit |
| Airgapped | No route out at all | Yours | Every outbound path — including external anchoring |
Airgapped costs you a property, and the platform says which. External anchoring is what makes integrity independent of trusting the operator. Forbid the path and that independence is gone — so the deployment states it rather than quietly dropping the mechanism and leaving the claim on the page.
Custody decides what a signature is worth
deployment- The key is on the server. The operator could re-sign a rewritten history, and an auditor is entitled to say so.
kms/hsm- Non-exportable. They can sign new records; they cannot extract the key.
external- You hold it. RotaGrant can ask for a signature and cannot produce one alone — withdraw access and sealing stops, which is a check you can run rather than a promise you have to take.
A private key is never uploaded, pasted, downloaded or exported. The capability is absent from the interface rather than present and forbidden.