> ## Documentation Index
> Fetch the complete documentation index at: https://docs.restate.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Restate Cloud BYOC

> Run Restate Cloud in your own cloud account with full data sovereignty and network isolation.

Restate Cloud BYOC (Bring Your Own Cloud) gives you the same fully-managed Restate Cloud experience, deployed as a private region inside your own cloud account and VPC.
Your application data never leaves your infrastructure, and at high volume BYOC is dramatically cheaper than usage-based pricing.

<CardGroup cols={3}>
  <Card title="Restate Cloud" icon="cloud">
    Fully managed by Restate. No infrastructure to maintain. Best for getting started quickly.
  </Card>

  <Card title="BYOC" icon="cloud-arrow-down">
    A private region of Restate Cloud, fully managed inside your own cloud account and VPC. Data sovereignty, network isolation, and compliance.
  </Card>

  <Card title="Self-hosted" icon="server">
    You run and manage everything. Full control, full responsibility.
  </Card>
</CardGroup>

## Why BYOC?

BYOC is designed for organizations that need:

* **Data sovereignty** — all data remains in your cloud account and chosen region
* **Network isolation** — Restate workloads run in your VPC, and application data never crosses the public internet
* **Compliance** — meet policies that require workloads to remain within customer-controlled infrastructure
* **Cost at scale** — priced by reserved capacity, up to 10x cheaper at high volume than per-action pricing
* **Existing commitments** — use your cloud provider savings plans, reserved instances, and negotiated pricing

## How it works

A BYOC deployment has three layers:

1. **Foundation** — You deploy a cloud-native template (CloudFormation on AWS, ARM on Azure) into your account. This creates the networking, secrets store, and a deployment agent that manages the rest of the infrastructure on Restate's behalf.

2. **Infrastructure** — The deployment agent provisions a Kubernetes cluster, container registry, certificate management, and supporting infrastructure. This happens automatically after the foundation is deployed.

3. **Application** — Restate data plane components are deployed into the cluster: the ingress proxy, tunnel, Restate operator, and monitoring stack. Environment creation, updates, and scaling are managed by Restate's control plane.

The deployment agent uses an **egress-only polling model** — it reaches out to Restate's control plane to pull work, rather than receiving inbound commands. To manage the region's environments, Restate's control plane connects to your managed Kubernetes API endpoint (which you can restrict by IP allowlist) using a scoped token. Application data stays inside your VPC — it never crosses the public internet, and Restate operators can never see it.

<Info>
  For details on the security properties of each layer, see [Security Model](/byoc/security).
</Info>

## Supported cloud providers

| Cloud Provider | Status              |
| :------------- | :------------------ |
| AWS            | Generally available |
| GCP            | Generally available |
| Azure          | Preview             |

## Get started

BYOC deployments are set up in collaboration with the Restate team. To get started:

<Card title="Contact Restate" icon="envelope" href="https://restate.dev/contact">
  Reach out to discuss your requirements and begin onboarding.
</Card>