> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superblocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Shared and centralized services

Every Superblocks instance is single-tenant, in both [deployment models](https://docs.superblocks.com/enterprise/deployment-overview.md). A small set of services runs centrally in Superblocks Cloud and serves every instance. Superblocks owns and operates these services, and each one has a specific, limited interaction with your instance.

| Service | What it does | Dedicated Cloud | Managed BYOC |
| - | - | :-: | :-: |
| [Identity gateway](#identity-gateway) | Handles sign-in and routes authentication to your SSO provider | ✓ | ✓ |
| [Management plane](#management-plane) | Triggers and pushes platform upgrades | ✓ | ✓ |
| [Superblocks Inference Gateway](#superblocks-inference-gateway) | Serves Clark's AI model requests | ✓ | ✓ |
| [Telemetry and analytics](#telemetry-and-analytics) | Collects platform telemetry and product analytics | ✓ | ✓ |
| [Support access](#support-access) | Lets Superblocks support and debug your instance | ✓ | ✓ |

## Identity gateway

Sign-in for every Superblocks instance goes through the identity gateway, which Superblocks runs on Auth0 in both deployment models. When a user signs in, the gateway routes authentication to your SSO provider, then returns the user to your instance with a verified identity. Access within Superblocks is then governed by the roles your admins assign.

See [Single sign-on](https://docs.superblocks.com/admin/org-administration/auth/single-sign-on/index.md) to connect your identity provider.

## Management plane

The management plane delivers platform upgrades to every instance. It triggers each upgrade and pushes it to a deployer that runs inside your instance. The deployer reconciles the environment and applies the upgrade.

In Managed BYOC, the deployer runs in your AWS account, so the management plane never applies changes to your account directly. See [Managed service model](https://docs.superblocks.com/enterprise/cloud-prem/aws.md#managed-service-model).

## Superblocks Inference Gateway

Clark sends its AI model requests to the Superblocks Inference Gateway, which Superblocks operates in Superblocks Cloud. The gateway applies only to Clark. AI features in deployed apps use the provider you set in [App AI](https://docs.superblocks.com/integrations/app-ai.md).

In both deployment models, Superblocks is responsible for:

* **Zero data retention:** Superblocks holds agreements with model providers so they don't retain prompts or responses.
* **No training on your data:** Superblocks holds agreements with model providers so your data is never used to train models.
* **Secure transmission:** Data sent to inference providers is encrypted in transit.

On Managed BYOC, the gateway also works as follows:

* **Outbound only:** Your Managed BYOC account connects out to the gateway. The gateway doesn't connect into your account.
* **Encrypted and signed:** Every request is encrypted in transit with TLS 1.2 or higher and signed with short-lived AWS credentials.
* **Restricted access:** The gateway accepts requests only from identities that Superblocks has authorized.
* **No prompt or response logging:** The gateway doesn't log prompts or responses.

## Telemetry and analytics

Superblocks collects telemetry and product analytics from every instance in a central service, so it can operate the platform for you. Superblocks uses this data to monitor platform health and reliability, validate upgrades as they roll out, troubleshoot with your team during support cases, and understand how features are used so it can improve Superblocks, including the quality of Clark. The data is operational and usage telemetry, not the data your apps handle. Access is restricted to authorized Superblocks personnel and audited, and Superblocks doesn't use telemetry to train foundation models.

## Support access

Superblocks keeps the access it needs to support and debug your instance.

In Managed BYOC, your team grants Superblocks break-glass administrative access to your AWS account during deployment. Superblocks uses that access only for break-glass purposes. See the [Managed BYOC deployment guide](https://docs.superblocks.com/enterprise/cloud-prem/deployment-guide.md).

## Related pages

* [Shared responsibility](https://docs.superblocks.com/enterprise/shared-responsibility.md)
* [Deployment models](https://docs.superblocks.com/enterprise/deployment-overview.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.