> ## Documentation Index
> Fetch the complete documentation index at: https://docs.braintrust.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Bring your own cloud (BYOC)

> Keep application data in your cloud with BYOC while Braintrust operates the data plane.

With bring your own cloud (BYOC), Braintrust operates the data plane in a dedicated cloud account or project you own. You control the account, billing, network, encryption keys, audit logs, and organization policies. Braintrust deploys, upgrades, monitors, and repairs the data-plane services.

> [!WARNING]
>
> The BYOC [private preview](https://docs.braintrust.dev/feature-lifecycle.md) is available on AWS to a limited set of customers on an Enterprise plan. Behavior can change during the preview. [Contact Braintrust](https://braintrust.dev/contact) to request access.
>
> For existing AWS and Google Cloud deployments, see [BYOC for existing deployments](https://docs.braintrust.dev/admin/deployment/byoc/v1).

## BYOC or self-hosted

BYOC and self-hosted both keep your data in your own cloud. They differ in who operates the data plane after the initial deployment. For a comparison that includes SaaS, see [Deployment options](https://docs.braintrust.dev/admin/deployment.md).

* Choose **BYOC** when you want Braintrust to operate the data plane on your behalf.
* Choose [**self-hosted**](https://docs.braintrust.dev/admin/self-hosting.md) when your team operates the data plane using Braintrust's published Terraform modules and Helm charts, or when your organization prohibits Braintrust access to your cloud after deployment.

## Responsibilities

| Area | You | Braintrust |
| :- | :- | :- |
| Cloud account | Provide a dedicated account or project, pay cloud costs, and choose its organization and deployment region. | Deploys only into the approved account and region. |
| Bootstrap and access | Review and apply the initial setup (bootstrap), and maintain Braintrust's access for the term of your agreement. | Provides the bootstrap and explains every identity and permission. Uses only short-lived credentials. |
| Network and endpoint | Raise any additional DNS, WAF, or connectivity requirements during scoping. | Provides the standard supported networking setup and endpoint, and reviews additional requirements with you. |
| Guardrails | Own organization policies, SCPs, IAM Deny policies, and allowed regions. | Identifies guardrails that block the deployment and proposes changes. |
| Audit and security monitoring | Configure cloud audit logs, retention, archives, security monitoring (SIEM), and alerts. | Records its own operations and supports investigations. |
| Capacity | Approve quota increases and enable required services. | Helps you check quotas and prepare the account. |
| Data-plane operation | Coordinate changes that affect the deployment. | Deploys, upgrades, scales, monitors service health, and responds to incidents. |
| Data and offboarding | Decide what to export, keep, or delete when you leave. Pay for and clean up resources you keep. | Removes the infrastructure serving your data plane and verifies which resources remain. |

You and Braintrust coordinate maintenance, incident communication, and escalation contacts. Together, you determine whether a problem originates in the data plane or in your cloud configuration.

## How BYOC works

Braintrust separates its services into two planes. The **control plane**, which Braintrust hosts, runs the UI, authentication, and platform management. The **data plane** runs in your account and serves your application's requests. See [Architecture](https://docs.braintrust.dev/admin/self-hosting/architecture.md) for the components.

### What stays in your cloud

Your application data stays in the data plane in your account. The control plane receives metadata and telemetry, and outside destinations receive data only for features you turn on.

```mermaid theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
flowchart LR
    accTitle: BYOC data flow
    accDescr: Your users sign in through the Braintrust control plane and send data to the data plane in your account. The data plane reads and writes application data in your account, sends identity requests and telemetry to the control plane, and reaches outside destinations only for features you turn on.
    U["Your users and applications"]
    subgraph BT["Braintrust"]
        CP["Control plane<br/>UI, identity, product metadata"]
    end
    subgraph YOURS["Your BYOC account"]
        P["Data plane<br/>API, Gateway, Brainstore"]
        DATA[("Application data")]
    end
    X["Feature destinations<br/>Model providers or export storage"]
    U -->|"UI and sign-in"| CP
    U -->|"Ingest and query"| P
    P -->|"Identity, configuration,<br/>and telemetry"| CP
    P <-->|"Read and write"| DATA
    P -.->|"Only for features you turn on"| X
```

* **Data-plane records stay in your account.** Experiment records, logs, traces, spans, datasets, prompts, and completions are stored in the data plane's databases, object storage, and caches.
* **The control plane stores metadata only.** It stores identity, organization settings, and metadata such as project and experiment names. It doesn't store or process the contents of your data-plane records.
* **Telemetry goes to the control plane.** It includes health check status, system metrics such as CPU, memory, and indexing lag, and aggregate billing usage. Braintrust controls telemetry to support your deployment, and you can't disable it.
* **Loop sends its own telemetry.** The Loop runtime always sends its own metrics and traces when deployed. You cannot disable this telemetry independently. These traces exclude LLM calls, tool calls, and the contents of your traces.
* **Features you turn on can send data outside your cloud.** Each has its own destination and permissions. Examples include model providers such as a configured [Bedrock integration](https://docs.braintrust.dev/integrations/ai-providers/bedrock.md), [export storage](https://docs.braintrust.dev/admin/data-management/export.md), and [Topics](https://docs.braintrust.dev/observe/topics.md), which sends trace text to Braintrust-hosted inference endpoints with zero data retention. See [Manage built-in models](https://docs.braintrust.dev/admin/ai-providers.md#manage-built-in-models).

### Braintrust access to your account

Braintrust deploys the data plane with the same Terraform modules it publishes for self-hosting, pinned to a reviewed version for each deployment. Before the first deployment, you apply a **bootstrap** in your account. It creates Braintrust's identities and permissions, plus deployment storage and logging. You review it before applying it and can revoke access at any time without Braintrust's involvement.

Braintrust reaches your account through two separate paths: deployment automation and named engineers. Both paths produce audit records in your account.

```mermaid theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
flowchart TB
    accTitle: Braintrust access to your BYOC account
    accDescr: The Braintrust deployment service uses short-lived credentials for the deployment identity, which provisions and updates the data plane and writes deployment state and operation records. Braintrust engineers use named sessions with the human access identities: Observer for standing inspection, and activated Diagnostics for operational changes and troubleshooting. Cloud audit events, deployment state and operation records, and diagnostic transcripts stay in records you control. You configure cloud audit collection for the deployment and human access identities' AWS API activity separately from Diagnostics session transcripts.
    subgraph BT["Braintrust"]
        M["Deployment service"]
        H["Braintrust engineers"]
    end
    subgraph YOURS["Your BYOC account"]
        D["Deployment identity"]
        S["Human access identities<br/>Observer, Diagnostics"]
        P["Data plane"]
        subgraph REC["Records you control"]
            OPS["Deployment state<br/>and operation records"]
            EVENTS["Cloud audit events<br/>you collect"]
            LOG["Diagnostic transcripts"]
        end
    end
    M -->|"Short-lived credentials"| D
    H -->|"Named individual sessions"| S
    D -->|"Provision and update"| P
    S -->|"Observer inspection or<br/>activated Diagnostics"| P
    D -.->|"Recorded AWS API activity"| EVENTS
    S -.->|"Recorded AWS API activity"| EVENTS
    D -.->|"State and records"| OPS
    P -.->|"Session transcripts"| LOG
```

* **Standing Observer access can't read application data directly.** Both paths use short-lived credentials. Engineers make operational changes, including routine maintenance, through temporary Diagnostics access, which can read and modify data through running services whether or not the engineer opens a shell.
* **You own audit collection.** You configure cloud audit collection, retention, and any replication to a separate audit environment. Braintrust doesn't create that archive for you.
* **Deployment access is privileged.** Deployment automation can change workloads that access data. Access restrictions and audit records reduce risk but don't eliminate this trust relationship or guarantee complete transcript capture from a privileged shell.

One account can host more than one Braintrust data plane, such as staging and production. IAM permissions don't fully isolate data planes that share a bootstrap. For role permissions, isolation limits, and audit controls, see [AWS access and security](https://docs.braintrust.dev/admin/deployment/byoc/aws-security.md).

## Next steps

* [Set up BYOC on AWS](https://docs.braintrust.dev/admin/deployment/byoc/aws.md): Prepare your account and apply the bootstrap.
* [BYOC operations and lifecycle](https://docs.braintrust.dev/admin/deployment/byoc/manage.md): Understand upgrades, incident response, and offboarding.
* [AWS access and security](https://docs.braintrust.dev/admin/deployment/byoc/aws-security.md): Review roles, guardrails, and audit controls.
* [Deployment options](https://docs.braintrust.dev/admin/deployment.md): Compare SaaS, BYOC, and self-hosted.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.