Tekplanit
Cloud · Private cloud · On-prem

Deploy Tekplanit where your data has to live.

Same product, three shapes. Pick the one your security review accepts — multi-tenant SaaS, single-tenant in your cloud account, or fully air-gapped inside your datacenter.

Read the deployment guide →

Cloud

The default SaaS — start in minutes, scale in months.

Best for: Teams that want zero infrastructure work. Multi-tenant, region-pinned, SOC 2 in-flight.

Operations: Tekplanit runs the database, queues, object storage, LLM routing, SMTP, monitoring, and patching. SLA 99.9%.

Customer provides

  • Domain (optional)
  • SSO IdP (optional)

Highlights

  • •Auto-scaling API + worker pool
  • •Tekplanit-managed LLM router (OpenAI / Anthropic / Gemini)
  • •Daily backups, point-in-time restore
  • •Region pinning (US, EU, APAC)

Private cloud

Single-tenant in your AWS / Azure / GCP / OCI account.

Best for: Enterprises that need data isolation, network-policy control, or BYO encryption keys but can still pull a Helm chart from a public registry.

Operations: You own the cluster; Tekplanit ships the Helm chart, container images, and operates the install/upgrade with your ops team.

Customer provides

  • A Kubernetes cluster (1.27+)
  • PostgreSQL, Redis, object storage (or use the bundled chart for evaluation)
  • An LLM endpoint — OpenAI, Azure OpenAI, Bedrock via gateway, or any OpenAI-compatible private model
  • TLS certificates and DNS

Highlights

  • •Helm chart with sensible defaults
  • •Dedicated Postgres, Redis, object storage — your account, your VPC
  • •Bring-your-own-LLM (OpenAI-compatible) or use Tekplanit's hosted bridge
  • •Customer-managed KMS keys for at-rest encryption

On-prem / air-gapped

Inside your datacenter, with zero outbound network required.

Best for: Defense, intelligence, healthcare, and regulated banking customers running OpenShift, Rancher, or vanilla Kubernetes inside their network.

Operations: We ship a single offline tarball of images + Helm chart + setup script. Operator runs `airgap-install.sh`. No call-home.

Customer provides

  • Kubernetes cluster (OpenShift, Rancher, EKS-A, vanilla)
  • Internal container registry
  • PostgreSQL, Redis, object storage (S3-compatible)
  • An on-prem LLM endpoint (vLLM, NIM, Ollama, …) or none

Highlights

  • •Air-gap mode blocks every outbound HTTP call by default
  • •Bundled migration job for clean upgrades
  • •Signed images, SBOM included, license file in lieu of online billing
  • •Self-check banner verifies DB, Redis, storage, LLM, SMTP on every restart

Side-by-side

A quick reference for security and procurement reviews.

 CloudPrivate cloudOn-prem
TenancyMulti-tenantSingle-tenantSingle-tenant, customer datacenter
Data residencyUS / EU / APAC region pinningCustomer-chosen regionCustomer datacenter
Outbound internet requiredn/a (Tekplanit-managed)Yes (LLM endpoint, SMTP)Optional — air-gap supported
LLM providerTekplanit-managed routerBring-your-own (OpenAI-compatible)Bring-your-own (incl. local vLLM / NIM)
DatabaseTekplanit-managed PostgresCustomer-managed PostgresCustomer-managed Postgres
Object storageTekplanit-managedCustomer S3 / GCS / AzureCustomer S3-compatible / PVC
IdentityTekplanit Auth + optional SSOOIDC / SAMLOIDC / SAML, no external IdP required
BillingStripe-managedStripe or invoiceSigned license file
UpdatesContinuous, Tekplanit-drivenHelm upgrade on customer scheduleOffline tarball, customer-driven

What you'll need for self-host

The Helm chart, container images, and air-gap install script all assume the same baseline. We ship sensible defaults and a startup self-check that verifies every dependency before the API opens for traffic.

PostgreSQL 14+

Managed or customer-supplied. SSL required. Helm chart can deploy a bundled Postgres for evaluation only.

Redis 6+

Required for BullMQ workers, distributed rate limits, and session sharing across replicas.

Object storage

Any S3-compatible store, GCS, Azure Blob, or a PVC-backed local mount for small installs.

LLM endpoint

OpenAI, Anthropic, Gemini, Azure OpenAI, or any OpenAI-compatible private endpoint (vLLM, NIM, Ollama, Bedrock with gateway).

TLS + SSO

Customer-managed certificates and an OIDC or SAML identity provider. JWT secret and encryption key are operator-supplied.

New · Self-host
Self-host CI: passing — every release

Docker Compose bundle — one host, under 15 minutes

For evaluation, single-team installs, and small/medium enterprise deployments you don't need Kubernetes. The Compose bundle brings up the full Tekplanit stack — api-server, web, openclaw gateway, Postgres, Redis — on one Docker host. Same product, same images, same air-gap guard as the Helm install.

Time to first login
Under 15 minutes from clone to dashboard, including image pull and bootstrap.
Bring your own LLM
Point at Azure OpenAI, Bedrock, vLLM, NIM, Ollama, or any OpenAI-compatible endpoint. Verified in CI.
Air-gapped capable
Flip AIR_GAPPED=true, mirror four images, and the stack runs with zero outbound network.
Read the self-host guide Commercial Source-Available License v1 →

Not sure which one fits?

Our deployment engineers review your security and IT requirements and recommend the simplest shape that meets them. Most enterprise deals start in private cloud and only move to on-prem if the procurement contract requires it.