Deployment

Every Reagent environment is a single-tenant deployment: its own network, its own database, its own data lake, and its own encrypted credential store. Which account it runs in is your choice.

Zaun cloud

Reagent runs in infrastructure Zaun operates. This is the quickest path from decision to Reagent governing your AI: the environment is provisioned for you, upgrades roll out automatically, and you start on the Connections page.

• Private by default: personal data is masked in findings, and a reveal is a confirmed, audited action.
• Your data stays in your environment's own data lake and is never mixed with another customer's.

Your boundary

Reagent runs inside your own cloud account or on dedicated on-prem hardware, so traffic and data never leave your boundary.

• Your cloud or dedicated on-prem
• Air-gapped and segmented networks
• Built for sovereignty-sensitive organizations and US Government

In this model the Zaun Agent Gateway, the data lake, and every connector run inside your account. Connectors that pull from vendor APIs need egress to those vendors; connectors that receive telemetry need a reachable ingest endpoint on your side, which the Connections page generates for each tool.

What your Forward Deployed Engineer does

Wiring Reagent into a real environment, across many stakeholders and systems, is where cost and risk tend to run away. Your FDE:

• Wires Reagent into your environment without opening new risk on the way in
• Stands Reagent up inside your own boundary when that is the model you chose
• Tunes budgets and policy to how your teams actually use AI
• Works the edge cases that block production on site, alongside your team, until they ship

Connecting individual tools does not depend on your FDE. Every tile on the Connections page is self-serve and documented under Connect Your Stack.

Compliance and scope

• SOC 2 Type II
• Scope: the internal AI your organization uses, not the AI products you sell to your customers.