> ## Documentation Index
> Fetch the complete documentation index at: https://docs.karta.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# BYOC - bring your own cloud

> Run Karta's data plane inside your own AWS account. Workspaces, durable state, and model traffic stay in your cloud; Karta operates the control plane.

<Note>
  **Preview.** BYOC is available to design partners as a guided pilot. The
  deployment is scoped and set up with you during onboarding rather than
  self-serve. To start a pilot, write to
  [hello@karta.sh](mailto:hello@karta.sh?subject=Karta%20BYOC%20pilot).
</Note>

By default, Karta runs your agents on Karta-operated infrastructure. **BYOC**
lands the part of Karta that touches your data - the **data plane** - inside your
own AWS account, while Karta keeps operating the **control plane** (the API,
console, identity, metering, billing, and release orchestration). Your workspace
content, per-user durable state, and model traffic stay in your cloud.

## What runs where

<Columns cols={2}>
  <Card title="Control plane (Karta-operated)" icon="server">
    The API, dashboard, identity, metering, billing, and release orchestration.
    Stays on Karta's infrastructure - it is never moved into your account.
  </Card>

  <Card title="Data plane (your AWS account)" icon="cloud">
    The agent compute and durable storage. Runs your agents in per-session
    microVMs and holds workspaces and per-user state in your account's S3.
  </Card>
</Columns>

## How it works

* **Outbound-only connectivity.** The data plane in your account dials out to the
  Karta control plane. No inbound network path into your account is required.
* **Your credentials stay yours.** Karta never holds your static AWS keys. Where
  access is needed, it is through a cross-account IAM role you create, scoped with
  a per-tenant external id, and you can withdraw it at any time.
* **You own the account.** The data plane is provisioned in your account from a
  versioned module. For the first design partners you run the apply yourself, so
  secrets are generated in place in your own Secrets Manager.
* **Data residency by design.** Per-user durable state lives in your account's S3
  and never transits the control plane. Only metadata crosses.

## Data residency

<table>
  <thead>
    <tr><th>Stays in your AWS account</th><th>Crosses to the Karta control plane</th></tr>
  </thead>

  <tbody>
    <tr><td>Workspace content and repositories</td><td>API-key validation</td></tr>
    <tr><td>Per-user durable memory and state</td><td>Usage and metering events (billing)</td></tr>
    <tr><td>Session content and model traffic</td><td>Account, agent, and session metadata</td></tr>
  </tbody>
</table>

Model traffic runs from your data plane using the provider you configure for the
org - for example Amazon Bedrock in your own account, or a provider key you supply
with [BYOK](/platform/byok).

## Trust model

BYOC is the deployment side of the same posture described on
[Trust](/security/trust) and [Multi-tenancy](/concepts/multi-tenancy): per-session
microVM isolation, default-deny cross-org access, and operators that do not read
tenant content. BYOC adds that the data plane - the only part that processes your
agents' content - runs in infrastructure you own and control.

## Start a pilot

<Steps>
  <Step title="Talk to us">
    Write to [hello@karta.sh](mailto:hello@karta.sh?subject=Karta%20BYOC%20pilot)
    so we can scope the pilot - region, harness, and access model.
  </Step>

  <Step title="Provision the data plane">
    You apply the Karta data-plane module in your AWS account. Karta never touches
    your account credentials.
  </Step>

  <Step title="Connect your org">
    Link the data plane to your Karta org. The control plane reaches it
    outbound-only, over the channel established during setup.
  </Step>

  <Step title="Deploy agents as usual">
    Define and deploy agents exactly as you would on the managed platform - the
    workflow does not change.
  </Step>
</Steps>

<CardGroup cols={2}>
  <Card title="BYOK" icon="key" href="/platform/byok">
    Bring your own model-provider key, billed to your provider account.
  </Card>

  <Card title="Trust & compliance" icon="shield-check" href="/security/trust">
    Encryption, isolation, and the platform's security posture.
  </Card>
</CardGroup>