Two ways to run Substrait
| On Substrait’s cloud | In your own cloud | |
|---|---|---|
| What you install | Nothing | Substrait, in your cloud account or data centre |
| Sign-in | Google, or a sign-in link by email | Your company’s own sign-on |
| Security settings | Standard settings, set up with you | Your own policies |
| Who sets it up | You, with no setup fee, configured by your own team | Substrait’s forward-deployed team, scoped with your IT |
| How long you stay | As long as you like | Yours to run |
The move from Substrait’s cloud to your own is always open.
On Substrait’s cloud
Many organisations share one Substrait installation, and each is kept apart. Every query carries the organisation, and a request for another organisation’s data fails closed. Each tool gets its own database and credential, apart from every other tool and from the platform itself.
In your own cloud
“Your own environment” means your own tenant: your cloud account, your identity and access rules, your keys and your bill. It can be AWS, Google Cloud, Azure or your own data centre.
- Substrait runs the whole tool, front end, back end and data, inside your perimeter.
- Substrait runs the unmodified tool your builder produced.
- Substrait’s control plane sends policy and deployment instructions; your side sends back status and decisions, never data.
- The connection is outbound from your side, so Substrait never opens a connection into your network.
- Your audit trail and reports are written to storage you control.
- You can manage your own encryption keys.
- Each organisation uses its own AI model key.
Four topologies
| Topology | Where each part runs |
|---|---|
| Substrait’s cloud | Control plane and tools on Substrait’s cloud |
| Hybrid | Control plane on Substrait’s cloud; tools and data in your cloud account |
| Self-hosted | Control plane and tools in your environment |
| Air-gapped | Everything in your data centre, with no outbound connection |