Private cloud
A private cloud deployment is a complete Hindsight installation that runs for one customer only, in a cloud account Vectorize owns and operates. You get your own cluster, database and storage, in the region you choose, without running any infrastructure yourself. This page is for teams that need single-tenant isolation and region control but would rather not host Hindsight in their own cloud account.
If you need Hindsight to run inside your own AWS, GCP or Azure account, see Bring your own cloud (BYOC). To compare all four options, see the deployment overview.
What you get
Each private cloud deployment is a self-contained Hindsight environment:
| Component | What it is |
|---|---|
| Cluster | A dedicated Kubernetes cluster in its own cloud project, spread across the availability zones of your chosen region. |
| Database | A dedicated PostgreSQL database with connection pooling. Nothing is shared with other customers. |
| Storage | Dedicated object storage for uploaded files, backups and, with Hindsight Memlake, your memory data. |
| Models | Embedding and reranking models served inside your deployment, plus the language model configured for it. |
| Sign-in | Your own identity service, so you can connect your identity provider through SSO. |
| Endpoints | Your own hostnames for the UI, API and sign-in, with TLS certificates issued and renewed automatically. |
Everything in the usage guides works the same way it does on Hindsight Cloud: memory banks, retain, recall, reflect, mental models, MCP, the SDKs and API keys.
Isolation
Your deployment shares no compute, database, storage or network with any other customer:
- Separate cloud project. Your environment lives in its own cloud project with its own network, so access policies and quotas apply to you alone.
- Separate database. Your memories are stored in a database that serves only your organization. There is no shared database to filter by tenant.
- Separate release schedule. Your deployment is upgraded on its own schedule, not as part of a fleet-wide rollout (see Upgrades).
Choosing a region
You choose the region your deployment runs in. Your database, uploaded files and memory data are stored in that region. Backup copies can be kept in a second region for disaster recovery; we agree the backup location with you, so it respects your data-residency requirements. Tell us your preferred region when you start, and we confirm capacity there before we build the environment.
Who does what
What Vectorize operates
- Infrastructure. The cloud project, cluster, network, database, storage, DNS records and TLS certificates.
- Upgrades. New Hindsight releases, applied on a coordinated schedule.
- Monitoring. Health, capacity and alerting for the cluster, the database and the application, watched by the Hindsight team.
- Backups. Scheduled database backups plus continuous write-ahead-log archiving for point-in-time recovery. Backups are kept for 30 days by default. See Operations for backup and disaster recovery details.
- Secrets. All application secrets are generated and stored by Vectorize. There's nothing for you to provision.
What you do
- Set up sign-in. Connect your identity provider with SSO so your people sign in with their existing accounts.
- Manage users and access. Invite members, assign roles and create API keys (see Team management and API keys).
- Configure connectivity. Decide how your applications and people reach the deployment: public endpoints with an IP allowlist, or private networking.
- Configure Enterprise features. Security policies, audit logs and other Enterprise features are set up in the UI by your organization owners.
Connectivity
By default your deployment has public HTTPS endpoints. You can keep traffic off the public internet, or limit who can reach it:
- Private networking. Connect from your own VPC with GCP Private Service Connect, AWS PrivateLink or Azure Private Link. Your applications reach Hindsight on a private IP address in your network.
- IP allowlisting. Restrict the public endpoints to the address ranges you specify, such as your corporate egress IPs.
You can combine the two, for example a private endpoint for application traffic and allowlisted public access for people using the UI from your corporate network. See Private networking for how setup works and what information we exchange.
Upgrades
Private cloud deployments run pinned, immutable builds. They never follow a floating "latest" version, so the software only changes when an upgrade is deliberately applied.
- Validated first. Every build we roll out to your deployment has already run on the multi-tenant Hindsight Cloud service. Your environment follows that service; it is never the first place a build runs.
- Coordinated. We agree an upgrade window with you and apply it then.
- Controlled migrations. Database schema changes run as a separate, supervised step before the new version rolls out, not automatically as application pods start.
- Rolling. The application runs multiple replicas and is updated with rolling restarts.
See Operations for more on how upgrades, monitoring and support work.
Accessing your deployment
When your environment is ready, we send you its UI and API addresses. The API
works exactly like Hindsight Cloud's, so the SDKs, MCP clients and curl
examples only need the base URL changed. See
Accessing your deployment.
Get started
Setting up a private cloud deployment takes a short working session to agree on:
- Region, including any data residency requirements.
- Connectivity: public with an IP allowlist, private networking, or both.
- Sign-in: which identity provider you'll connect through SSO.
- Sizing: expected users, agents and memory volume, so we size the cluster and database.
We then build the environment, validate it and hand you the addresses.
Book a call or contact your Hindsight representative to get started.