Skip to main content
Braintrust operates your BYOC data plane, including upgrades, monitoring, and incident response. You control changes to your cloud environment, including what data to export, retain, or delete. See Responsibilities for who manages what.
The BYOC private preview is available on AWS to a limited set of customers on an Enterprise plan. Behavior can change during the preview. Contact Braintrust to request access.For existing AWS and Google Cloud deployments, see BYOC for existing deployments.

​
Upgrades and maintenance

Braintrust upgrades deployments to newer, reviewed module versions. Available features depend on the version deployed in your account, so confirm it with your account representative. See the data plane changelog for changes in each release.
  • Coordination. Braintrust reviews and confirms the Terraform plan for each upgrade. Maintenance notice and scheduling follow your agreement with Braintrust. Share scheduling preferences and blackout windows with your account representative.
  • Validation and recovery. After each upgrade, Braintrust checks the deployment’s health. If an upgrade causes problems, Braintrust supports service recovery and reconciles the deployment through the deployment process.
  • Version. To see the data plane version, go to Settings > Data plane, or request the data plane’s /version endpoint.
  • Vulnerabilities. When a scan reports a vulnerability (CVE), Braintrust checks whether it can be exploited in your deployment. Based on that assessment, Braintrust adds safeguards, applies an emergency update, schedules an upgrade, or asks you to take action.

​
Service health

Braintrust monitors the health of your data plane using telemetry and cloud metrics and alarms, without reading the contents of your data-plane resources. To view throughput, resource usage, and status checks yourself, go to Settings > Infra dashboard. The dashboard is view-only. Service-level commitments, such as uptime targets and service credits, are defined in your agreement.

​
Coordinate changes to your environment

Changes on your side can break deployments and upgrades without an obvious error. Coordinate with Braintrust before you:
  • Add or change organization policies, SCPs, or IAM Deny policies that apply to the account. An explicit deny overrides the permissions Braintrust’s identities need.
  • Change the trust, permissions, or bindings of Braintrust’s identities.
  • Change networking, DNS, or firewall rules that the data plane uses.
  • Edit resources that Braintrust manages. The next deployment can overwrite your edits.
  • Turn off logging.
Time spent in an unsupported state, including while Braintrust’s access is revoked, affects incident response, upgrades, and the treatment of downtime under your agreement.

​
Incident response

If you suspect that a Braintrust identity is misused or compromised, contain the affected access promptly. In parallel, preserve audit logs and session activity outside the BYOC account. Don’t delay revocation while an export or archive completes. To contain access:
  • Block new sessions by removing or restricting the trust relationship or bindings for the affected identity.
  • End existing access separately. Short-lived credentials that were already issued can remain valid until they expire unless you revoke them. See Revoke access on AWS.
Braintrust restricts access from the affected identities on its side and works with you to restore the agreed configuration through the deployment process. For incidents that affect personal data, Braintrust notifies you as described in its Data Processing Agreement.

​
Offboarding

If several data planes share a bootstrap, wait until all of them are removed before revoking shared access or deleting the bootstrap stack.
1

Export your data

Export the data you want to keep before Braintrust removes the data plane. See Export data.
2

Deprovision the data plane

Braintrust removes the data-plane infrastructure and keeps the data resources listed in Deprovisioning. Braintrust then confirms removal and gives you a verified list of the resources that remain.
3

Revoke access

Revoke Braintrust’s access, then confirm in your audit logs that no new Braintrust sessions start.
4

Clean up

Wait for Braintrust to confirm removal and verify which resources remain before deleting them. Deleting them earlier can prevent Braintrust from completing those checks.
Decide whether to keep or delete the retained data and the versioned objects in the state and operation log buckets, then delete the bootstrap’s CloudFormation stack. Braintrust doesn’t delete any of these for you.
You are responsible for the costs and cleanup of resources you keep. Keeping them does not provide a supported way to restore the data plane. Braintrust’s contractual obligations for personal data are described in the Data Processing Agreement.

​
Deprovisioning

When you leave BYOC or retire a data plane, Braintrust removes its infrastructure using retain-data mode, the only mode available for customer deployments:
  • Removed: The infrastructure that serves the data plane.
  • Retained: The Brainstore bucket and its controls, the KMS key and alias that the module created, and an encrypted final RDS snapshot.
  • Unchanged: The Terraform state bucket and the operation log bucket.
Braintrust verifies the retained resources from their metadata, without reading Brainstore objects or decrypting data, and gives you the verified list. If an initial deployment failed before creating a database, there may be no final RDS snapshot. Braintrust confirms which resources remain during recovery.

​
Next steps