Skip to main content
Preview. BYOC is available to design partners as a guided pilot. The deployment is scoped and set up with you during onboarding rather than self-serve. To start a pilot, write to [email protected].
By default, Karta runs your agents on Karta-operated infrastructure. BYOC lands the part of Karta that touches your data - the data plane - inside your own AWS account, while Karta keeps operating the control plane (the API, console, identity, metering, billing, and release orchestration). Your workspace content, per-user durable state, and model traffic stay in your cloud.

​
What runs where

Control plane (Karta-operated)

The API, dashboard, identity, metering, billing, and release orchestration. Stays on Karta’s infrastructure - it is never moved into your account.

Data plane (your AWS account)

The agent compute and durable storage. Runs your agents in per-session microVMs and holds workspaces and per-user state in your account’s S3.

​
How it works

  • Outbound-only connectivity. The data plane in your account dials out to the Karta control plane. No inbound network path into your account is required.
  • Your credentials stay yours. Karta never holds your static AWS keys. Where access is needed, it is through a cross-account IAM role you create, scoped with a per-tenant external id, and you can withdraw it at any time.
  • You own the account. The data plane is provisioned in your account from a versioned module. For the first design partners you run the apply yourself, so secrets are generated in place in your own Secrets Manager.
  • Data residency by design. Per-user durable state lives in your account’s S3 and never transits the control plane. Only metadata crosses.

​
Data residency

Stays in your AWS accountCrosses to the Karta control plane
Workspace content and repositoriesAPI-key validation
Per-user durable memory and stateUsage and metering events (billing)
Session content and model trafficAccount, agent, and session metadata
Model traffic runs from your data plane using the provider you configure for the org - for example Amazon Bedrock in your own account, or a provider key you supply with BYOK.

​
Trust model

BYOC is the deployment side of the same posture described on Trust and Multi-tenancy: per-session microVM isolation, default-deny cross-org access, and operators that do not read tenant content. BYOC adds that the data plane - the only part that processes your agents’ content - runs in infrastructure you own and control.

​
Start a pilot

1

Talk to us

Write to [email protected] so we can scope the pilot - region, harness, and access model.
2

Provision the data plane

You apply the Karta data-plane module in your AWS account. Karta never touches your account credentials.
3

Connect your org

Link the data plane to your Karta org. The control plane reaches it outbound-only, over the channel established during setup.
4

Deploy agents as usual

Define and deploy agents exactly as you would on the managed platform - the workflow does not change.

BYOK

Bring your own model-provider key, billed to your provider account.

Trust & compliance

Encryption, isolation, and the platform’s security posture.