Managed BYOC

Superblocks Managed BYOC delivers the full power of Superblocks in a deployment model designed for organizations that require strict data residency, security controls, and infrastructure ownership. With Managed BYOC, Superblocks runs as a dedicated, single-tenant instance inside your AWS account. This gives customers direct control over networking, data boundaries, and compliance posture, while Superblocks continues to manage the platform lifecycle, upgrades, and reliability. The result is the trust and governance of customer-owned infrastructure, without the operational burden, slow iteration cycles, or complexity of traditional self-hosted deployments.

Managed BYOC architecture

This model provides data residency in your AWS account, network isolation with a dedicated VPC for each data plane, and private connectivity to data sources in your other AWS accounts, for organizations with strict security and compliance requirements.

How it works

In the Superblocks Managed BYOC deployment model:

• Single-tenant instance in your account: Superblocks is deployed as a dedicated, single-tenant instance within your AWS account. You choose the AWS region at deployment. Contact your Superblocks deployment team for supported AWS regions.
• AI inference: Clark and its development sandbox run in your account, and Clark’s AI inference runs through the Superblocks Inference Gateway. Data sent to AI models is never used for training.
• Data planes colocated with your data: Data planes run in your Managed BYOC account, each in its own VPC, and can run in each AWS region where your data lives. They reach data sources in your other AWS accounts over private networking, such as VPC peering, Transit Gateway, or PrivateLink, and support AWS VPC endpoints local to the deployment.
• Direct app connections: Deployed applications load their frontend from a CDN in your account, then call the data plane directly, minimizing latency and data movement.
• Protected access: Users reach your instance over the internet through Superblocks-managed AWS WAFs. You can restrict access, for example to your corporate IP ranges, with custom WAF rule groups.
• Enterprise identity: Your team signs in with your enterprise SSO provider, and access within Superblocks is governed by Superblocks RBAC.
• Encryption: All data is encrypted in transit and at rest.
• Managed operations: Superblocks operates and supports the platform as a fully managed service, adhering to least-privilege access and customer-defined boundaries.

This model keeps your application data, and the Clark chat history that holds AI prompts and responses, within your AWS environment. Superblocks manages platform operations, including upgrades, security patches, reliability, and ongoing support, without requiring you to run or maintain the system yourself.

Why choose Managed BYOC

Managed BYOC is best for enterprises requiring the highest level of compliance, security and data residency. Customers in Financial Services, Insurance, Healthcare & Life Sciences, Telecommunications and Government often choose this deployment model because:

• AWS data residency and isolation: All application data is processed and stored within your AWS account and selected AWS regions. Clark chat history, including AI prompts and responses, is stored in your account.
• Private, zero-retention AI inference: Clark uses the Superblocks Inference Gateway: outbound-only, encrypted in transit, with zero data retention and no prompt or response logging.
• Enhanced observability and audit readiness: Full telemetry is written to CloudWatch and X-Ray in your account, and you can also send it to your own observability destinations to support your monitoring and audit workflows.
• AWS-native security and governance enforcement: Govern Superblocks with your existing AWS account controls, such as IAM, service control policies, and governance guardrails, and filter outbound traffic with AWS Network Firewall.
• Security tooling: Run CrowdStrike and Wiz sensors in the deployment, and scan Superblocks software images out of band.
• Leverage AWS Enterprise Discount Program (EDP): All infrastructure resources run in your AWS account and can count toward your existing AWS committed spend and procurement agreements. See the billing overview for how Managed BYOC is billed.

Managed service model

In Managed BYOC, Superblocks is responsible for:

• Delivering regular platform updates and feature enhancements
• Managing upgrades
• Ensuring release compatibility, stability, and reliability
• Providing operational support and incident response

All upgrades are planned, executed, and supported by Superblocks. The Superblocks-hosted management plane triggers each upgrade and pushes it to a deployer that runs in your Managed BYOC account. The deployer reconciles the environment and applies the upgrade. This ensures Managed BYOC environments remain secure, supported, and current, without requiring customers to plan, test, or operate upgrades themselves. Customers retain control over cloud-level access, security policies, deployment environments, and AI execution boundaries, while Superblocks manages the ongoing operation and lifecycle of the platform. Your team grants Superblocks break-glass administrative access to your AWS account during deployment.

Next steps