Skip to main content
Restate Cloud BYOC (Bring Your Own Cloud) gives you the same fully-managed Restate Cloud experience, deployed as a private region inside your own cloud account and VPC. Your application data never leaves your infrastructure, and at high volume BYOC is dramatically cheaper than usage-based pricing.

Restate Cloud

Fully managed by Restate. No infrastructure to maintain. Best for getting started quickly.

BYOC

A private region of Restate Cloud, fully managed inside your own cloud account and VPC. Data sovereignty, network isolation, and compliance.

Self-hosted

You run and manage everything. Full control, full responsibility.

​
Why BYOC?

BYOC is designed for organizations that need:
  • Data sovereignty — all data remains in your cloud account and chosen region
  • Network isolation — Restate workloads run in your VPC, and application data never crosses the public internet
  • Compliance — meet policies that require workloads to remain within customer-controlled infrastructure
  • Cost at scale — priced by reserved capacity, up to 10x cheaper at high volume than per-action pricing
  • Existing commitments — use your cloud provider savings plans, reserved instances, and negotiated pricing

​
How it works

A BYOC deployment has three layers:
  1. Foundation — You deploy a cloud-native template (CloudFormation on AWS, ARM on Azure) into your account. This creates the networking, secrets store, and a deployment agent that manages the rest of the infrastructure on Restate’s behalf.
  2. Infrastructure — The deployment agent provisions a Kubernetes cluster, container registry, certificate management, and supporting infrastructure. This happens automatically after the foundation is deployed.
  3. Application — Restate data plane components are deployed into the cluster: the ingress proxy, tunnel, Restate operator, and monitoring stack. Environment creation, updates, and scaling are managed by Restate’s control plane.
The deployment agent uses an egress-only polling model — it reaches out to Restate’s control plane to pull work, rather than receiving inbound commands. To manage the region’s environments, Restate’s control plane connects to your managed Kubernetes API endpoint (which you can restrict by IP allowlist) using a scoped token. Application data stays inside your VPC — it never crosses the public internet, and Restate operators can never see it.
For details on the security properties of each layer, see Security Model.

​
Supported cloud providers

Cloud ProviderStatus
AWSGenerally available
GCPGenerally available
AzurePreview

​
Get started

BYOC deployments are set up in collaboration with the Restate team. To get started:

Contact Restate

Reach out to discuss your requirements and begin onboarding.