BYOC or self-hosted
BYOC and self-hosted both keep your data in your own cloud. They differ in who operates the data plane after the initial deployment. For a comparison that includes SaaS, see Deployment options.- Choose BYOC when you want Braintrust to operate the data plane on your behalf.
- Choose self-hosted when your team operates the data plane using Braintrust’s published Terraform modules and Helm charts, or when your organization prohibits Braintrust access to your cloud after deployment.
Responsibilities
You and Braintrust coordinate maintenance, incident communication, and escalation contacts. Together, you determine whether a problem originates in the data plane or in your cloud configuration.
How BYOC works
Braintrust separates its services into two planes. The control plane, which Braintrust hosts, runs the UI, authentication, and platform management. The data plane runs in your account and serves your application’s requests. See Architecture for the components.What stays in your cloud
Your application data stays in the data plane in your account. The control plane receives metadata and telemetry, and outside destinations receive data only for features you turn on.- Data-plane records stay in your account. Experiment records, logs, traces, spans, datasets, prompts, and completions are stored in the data plane’s databases, object storage, and caches.
- The control plane stores metadata only. It stores identity, organization settings, and metadata such as project and experiment names. It doesn’t store or process the contents of your data-plane records.
- Telemetry goes to the control plane. It includes health check status, system metrics such as CPU, memory, and indexing lag, and aggregate billing usage. Braintrust controls telemetry to support your deployment, and you can’t disable it.
- Loop sends its own telemetry. The Loop runtime always sends its own metrics and traces when deployed. You cannot disable this telemetry independently. These traces exclude LLM calls, tool calls, and the contents of your traces.
- Features you turn on can send data outside your cloud. Each has its own destination and permissions. Examples include model providers such as a configured Bedrock integration, export storage, and Topics, which sends trace text to Braintrust-hosted inference endpoints with zero data retention. See Manage built-in models.
Braintrust access to your account
Braintrust deploys the data plane with the same Terraform modules it publishes for self-hosting, pinned to a reviewed version for each deployment. Before the first deployment, you apply a bootstrap in your account. It creates Braintrust’s identities and permissions, plus deployment storage and logging. You review it before applying it and can revoke access at any time without Braintrust’s involvement. Braintrust reaches your account through two separate paths: deployment automation and named engineers. Both paths produce audit records in your account.- Standing Observer access can’t read application data directly. Both paths use short-lived credentials. Engineers make operational changes, including routine maintenance, through temporary Diagnostics access, which can read and modify data through running services whether or not the engineer opens a shell.
- You own audit collection. You configure cloud audit collection, retention, and any replication to a separate audit environment. Braintrust doesn’t create that archive for you.
- Deployment access is privileged. Deployment automation can change workloads that access data. Access restrictions and audit records reduce risk but don’t eliminate this trust relationship or guarantee complete transcript capture from a privileged shell.
Next steps
- Set up BYOC on AWS: Prepare your account and apply the bootstrap.
- BYOC operations and lifecycle: Understand upgrades, incident response, and offboarding.
- AWS access and security: Review roles, guardrails, and audit controls.
- Deployment options: Compare SaaS, BYOC, and self-hosted.