Managed
We operate it. Fastest route to a first deployment, suitable where the data classification allows it.
Security
Your evidence does not have to leave your control.
StromaOS runs in four deployment postures, differing in exactly one respect: who operates the compute. In your VPC, embedded in your data platform, or air-gapped, nothing in the request path is ours to host. Managed is the exception - we operate it, under the data classification your agreement sets. The governance envelope is identical in all four.
Posture
Your models. Your evidence. Your choice of perimeter.
Commitments you can verify during an architecture review rather than take on trust.
Deployment
Four postures. The same governance envelope in each.
The deployment model changes where the work runs. It does not change what is enforced.
Your VPC
Runs in your cloud account, inside your network boundary, under your identity provider and your controls.
Embedded
Deployed natively into the data platform you already run, so work executes where the data already lives.
Air-gapped
Fully sovereign, no egress, your own models. For classified programs and jurisdictions that require it.
Data handling
Preparation happens where your data already sits.
Mapping, de-identification and entitlement run as governed steps against your sources rather than by migrating your data into a vendor environment and selling it back to you. In self-operated postures those steps execute entirely within your boundary; under managed deployment they execute within the boundary your agreement defines.
Mapped in place
Semantic transformation maps your sources to a common model where they sit. Systems of record are not replaced and data is not migrated to us.
De-identified before it is used
PHI and PII removal runs as a governed step at the point of preparation - not as a preprocessing task someone remembers to do - with a record of what was protected and how attached to the run.
Entitlement enforced
Licensed assets resolve only when your entitlement verifies. A run that loses entitlement withholds its result rather than discarding the work.
Controls
Authority is checked before the action, not audited after.
A log tells you what happened. A constraint tells you what can happen. These are behaviors you can observe during an architecture review.
Policy evaluated before dispatch
Policy is declared as code, bound to the work, and evaluated against live context - which user, which tenant, which study, which data classification - before an action reaches a model.
It stops rather than guesses
A control that cannot be evaluated stops the run. A check that cannot reach its service refuses; it does not pass. Unknown is never recorded as none.
Named human authority
Selection resolves to a named authority inside your organization, recorded with who signed and what the signature meant. There is no path where the platform decides and you inherit the liability.
Scoped pause, not a kill switch
Abrupt termination leaves half-written batch records. New dispatch halts, in-flight work completes to the next transactional boundary, and resumption requires explicit approval.
Independence
What happens to you if something happens to us.
Every enterprise buyer asks this, and in regulated pharma they ask it early.
It runs where you decide
Three of the four postures put execution on your compute inside your own boundary, where your existing controls apply rather than being duplicated. Managed exists for speed where the data classification allows it.
It runs your models
Bring your own. Nothing is required, resold or metered, and we do not compete with the providers you have standardized on.
The evidence is yours
Open schema, queryable, exportable. The retention obligation on regulated evidence outlives any vendor relationship, so the record has to be readable without us.
Bring your architects and your auditor.
An architecture review maps our governance artifacts to your evidence model, and shows you the gaps in both directions.