Deployment modes
| Mode | Database | Storage | Keys | Inference |
|---|---|---|---|---|
| Cloud | Authpermit | Authpermit | Authpermit KMS | Authpermit |
| Sovereign | Authpermit | Your bucket | BYOK | Authpermit or yours |
| Private | Yours (via authpermitd) | Yours | HYOK | Yours |
| Air-gapped | Yours | Yours | Yours | Yours |
Switch modes under Settings → Data & residency. authpermitd is a Rust data-plane agent that only opens outbound TLS to the control plane.