> Falconer site index for agents: https://falconer.com/llms.txt. HTML version of this page: https://falconer.com/deployments/ # Deployments > Unlock all of Falconer from the hosting option that fits your compliance line or security goals: multi-tenant SaaS, managed single tenant, or self-hosted in your own cloud account. Deployments # Deployments for every team's needs Unlock all of Falconer from the hosting option that fits your compliance line or security goals: multi-tenant cloud to single-tenant in your own cloud account. [Sign up](https://falconer.com/auth/signin)[Get a demo](https://falconer.com/demo) ## Three ways to deploy Falconer ##### Multi-tenant SaaS Fully managed by Falconer on AWS. Encrypted at rest and in transit, isolated per organization. Best forTeams that want zero infra overhead ##### Managed single tenant Isolated single-tenant deployment in a dedicated Virtual Private Cloud (VPC), with complete network isolation, dedicated resources, and a branded subdomain. Falconer handles ops. Best forTeams needing data isolation without running the stack ##### Self-hosted Deploy as a single-tenant instance in your own cloud account, with infrastructure as code that's fully reviewable and auditable. You retain complete control, with private networking, no public ingress, and outbound traffic limited to the allowlist you write. Best forEnterprises that need full control over data privacy and compliance ## Security posture | Control | Multi-tenant | Single-tenant | Self-hosted | | --- | --- | --- | --- | | SOC 2 Type II | Included | Included | Included | | HIPAA Compliance | Included | Included | Included | | Encryption in transit and at rest | Included | Included | Included | | Social login, SSO, SAML authentication | Included | Included | Included | | Penetration testing | Included | Included | Included | | Single-tenant deployment. Complete data isolation. | –Not included | Included | Included | | Private networking. Outbound traffic limited to the allowlist you write. | –Not included | –Not included | Included | Full details on the [security page](https://falconer.com/security) and [trust center](https://trust.falconer.com/). ## Built for regulated teams We work with teams that can't compromise on security or compliance. Bring us your requirements; we'll match the deployment. What matters mostHow Falconer fits ##### Fintech and financial infrastructure What matters most The context agents read, risk models, fraud logic, ledger internals, can't leak to a vendor or land in a training set. How Falconer fits Single-tenant isolation plus bring-your-own-key. Your models see your context; no one else does. ##### Health tech and healthcare informatics What matters most PHI in your docs stays inside the compliance boundary, and the BAA has to cover what agents retrieve, not just the UI. How Falconer fits BAA extends to the MCP retrieval interface, not just the UI, on any hosting option. Every retrieval call is logged and permission-scoped. ##### Defense tech and public sector What matters most The knowledge agents read has to stay in the enclave, reachable by coding agents, and current with the code. How Falconer fits Same MCP server and passage retrieval run inside your own cloud account with private networking, updated on every merged PR. ##### Multinational teams under residency law What matters most Your context can't cross borders under GDPR, the EU AI Act, and localization rules in the US, India, Brazil, and Saudi Arabia. How Falconer fits Managed single tenant and self-hosted keep the platform and the context it processes inside the jurisdiction you're bound to. ##### Growth-stage AI companies What matters most Everyone has the same models. Your architecture decisions and incident history are the context that sets you apart. How Falconer fits Isolated deployment keeps that context yours, and it stays current instead of going stale. FAQ ## Frequently asked questions ##### Can I move between deployment models later? Yes. It's the same product in every mode, so migrations are configuration changes, not re-platforming. Most teams start on [multi-tenant SaaS](https://falconer.com/security) to prove value fast, then move to managed single tenant or self-hosted as compliance requirements tighten. Your documents, permissions, and integrations carry over. [Talk to us](https://falconer.com/demo) about a migration path. ##### Do self-hosted deployments lose any features? No. Freshness detection, passage-level retrieval, permission-aware access, and the read/write [MCP server](https://falconer.com/about/integrations) all run the same way in your own cloud account. All container images are mirrored into your own container registry, so nothing is pulled from a public registry for licensing, telemetry, or updates after install. Outbound traffic goes to the allowlist you write: your AI model provider and the cloud resources you connect, both under your own accounts and keys. The full [security posture](https://falconer.com/security) is published at our [Trust Center](https://trust.falconer.com/). ##### Can we use our own AI model keys? Yes. On every plan, bring-your-own-key lets you supply your own OpenAI, Anthropic, or other provider keys, so model inference stays under your control and billing. You choose which providers are approved and can revoke access. See the [security page](https://falconer.com/security) for details. ##### Which AI models does Falconer run on? Falconer is model-agnostic. On multi-tenant SaaS and managed single tenant we run frontier models out of the box; on self-hosted you point Falconer at the providers you've approved via bring-your-own-key, or at a model endpoint you run inside your own perimeter, including an open-weight model on your own GPUs. [Talk to us](https://falconer.com/demo) about your model requirements. ##### How is each deployment priced? Multi-tenant SaaS is self-serve; managed single tenant and self-hosted are enterprise deployments scoped to your environment. See [pricing](https://falconer.com/pricing) for plan details, or [talk to us](https://falconer.com/demo) to scope an isolated deployment. ##### Is a BAA available for HIPAA-covered environments? Yes, on any of the three hosting options, and coverage extends to the agent retrieval interface, not just the UI. Every retrieval call is logged and permission-scoped, so your security team can audit exactly what agents accessed. Full compliance detail lives in our [Trust Center](https://trust.falconer.com/). ##### How does Falconer keep our data private? Your content is never used to train external models, and there's no lock-in: you retain ownership at all times, with data export and clear deletion procedures on request. Each organization's data is isolated, encrypted in transit and at rest, and access is time-limited and fully logged. See the [security page](https://falconer.com/security) for the complete model. ##### Can I use my coding agent with Falconer? Yes, Falconer was built to work headless with your favorite agent. Use Claude, Codex, Cursor, or your custom agent to handle your docs work or pull context with Falconer. See the [Integrations page](https://falconer.com/about/integrations).