DEPLOYMENT & DATA CONTROL
Deploy around the network and data boundary you have. zer0 cipher supports four deployment models that change where Brain and Pinky run, how HQ connects, who operates the environment, and how updates and licensing are handled.
Book a Demo Interactive architecture See where Brain, Darko, and Pinky run in each model. Pick a model to trace how the control plane, evidence store, and internal execution agents sit across the network boundary — and where the data stays.
01 zer0 cipher SaaSManaged Brain in zer0 cipher AWS with Pinkys placed inside approved client networks. View 02 Client-hosted Run Brain and internal Pinkys inside client-controlled infrastructure. View 03 MSSP-managed Partner HQ coordinates separate client Brains and their internal Pinkys. View 04 Air-gapped Keep Brain, local AI, evidence, and internal Pinkys entirely on-premises. View Managed deployment Managed Brain. Client-side reach. HQ, the client-specific Brain deployment, and External Pinky run in zer0 cipher -managed AWS. Internal Pinkys execute from approved client VLANs.
zer0 cipher -managed AWSControl plane zer0 cipher HQFleet + operations
State + evidence Brain + Darko Client-specific deployment
External Pinky Internet-facing execution
Client network boundary Corporate VLAN Pinky / 01 Pinky Internal execution
Restricted VLAN Pinky / 02 Pinky Internal execution
Secure VLAN Pinky / 03 Pinky Internal execution
Internal Pinkys do not bridge VLANs. Each agent reports the networks reachable from its placement and polls for matching engagement work.
Managed HQ + Brain External Pinky in AWS One Pinky per reachable segment
At a glance
Compare the four operating models. 01 SaaS
Operations Managed by the zer0 cipher team.
Connectivity HQ heartbeat, licensing, management, and approved telemetry paths.
Data boundary A client-specific Brain runs in zer0 cipher -managed AWS.
Best fit Teams that want a fully managed operating model. 02 Client-hosted
Operations Shared between the client and zer0 cipher .
Connectivity A documented outbound management path to HQ, not a blanket “no data leaves” claim.
Data boundary Brain and evidence run on client-controlled infrastructure.
Best fit Teams that require direct infrastructure ownership. 03 MSSP / partner
Operations Partner-operated from a single MSSP HQ.
Connectivity Partner HQ coordinates isolated per-client Brains and their Pinkys.
Data boundary A separate Brain and evidence store per client.
Best fit MSSPs managing multiple isolated client environments. 04 Air-gapped
Operations Client-operated, entirely offline.
Connectivity No runtime HQ connection; offline licensing and manual release handling.
Data boundary Brain, local AI, and evidence stay fully on-premises.
Best fit Environments with strict connectivity requirements. NEXT STEP
Choose the operating model before the engagement design. Book a focused walkthrough with our team.
Book a Demo 