PromptQL Enterprise separates the platform into a Data Plane, where operational workloads and customer data live, and a Control Plane, which provides centralized identity, provisioning, billing, and lifecycle management. This boundary is consistent across all Enterprise deployment models.

Choose where the single-tenant Data Plane runs and who controls its encryption keys:

• Dedicated: PromptQL operates the Data Plane in dedicated infrastructure in a PromptQL-managed cloud account.
• BYOK: the Dedicated model, with encryption at rest controlled by a customer-managed KMS key.
• BYOC: PromptQL deploys and operates the Data Plane inside the customer's AWS, GCP, or Azure account.

An Enterprise agreement is required. Contact sales to select a deployment model and begin provisioning.

The Data Plane is the runtime and security boundary for each Enterprise deployment. It contains:

• PromptQL projects, conversations, wiki content, metadata, and indexes
• database credentials, OAuth credentials, API keys, and other integration secrets
• the PromptQL runtime, virtual SQL layer, connectors, and artifact storage
• authorization enforcement and all requests to connected databases and APIs

Customer information and secrets are encrypted at rest in the Data Plane. Runtime requests are served by the Data Plane; the Control Plane is not on the request path.

Each Data Plane is deployed in one cloud region and can span multiple availability zones for in-region high availability. Place it close to the systems it accesses and use private connectivity where required: AWS PrivateLink or VPC connectivity, GCP Private Service Connect or VPC connectivity, and Azure Private Endpoint or VNet connectivity.

The PromptQL-hosted Control Plane provides centralized services without storing project operational data:

• authentication and enterprise identity integration
• organization, subscription, and billing management
• software release and deployment coordination
• platform health and optional observability
• lifecycle orchestration for PromptQL-managed Data Plane components

The Data Plane communicates with the Control Plane only for defined control and management operations: receiving connector deployment specifications, optional OpenTelemetry export, and authorized BYOC workload management through the customer-approved cloud identity.

API responses, query results, conversations, wiki content, connected-system credentials, and integration secrets remain in the Data Plane.

You provide the target cloud and region, approved network ranges, and the network path to your data sources. PromptQL provisions and operates the isolated compute, network, database, and object storage resources in a PromptQL-managed cloud account.

You complete the following customer tasks:

1. Choose AWS or GCP and confirm the Data Plane region with PromptQL.
2. Create a customer-managed KMS key in that same region.
3. Apply the documented key policy or IAM binding so PromptQL can provision encrypted resources.
4. Provide the key ARN or resource name when you create the Data Plane.
5. Keep the key enabled and preserve the required policy or IAM access while the Data Plane is active.

PromptQL then provisions and operates the same managed, single-tenant infrastructure as Dedicated, encrypted with your key. You own the key's lifecycle, policy, and availability. Treat revoking access to, disabling, deleting, or destroying an in-use key as a non-recoverable action. BYOK is currently supported on AWS and GCP.

You complete the following customer tasks:

1. Prepare a dedicated AWS account, GCP project, or Azure subscription or approved resource groups.
2. Confirm the region, quotas, organization policies, network ranges, and private-connectivity plan.
3. Apply the cloud-specific bootstrap template to create the scoped identity and permissions used by PromptQL automation.
4. Provide the required cloud identifiers and deployment parameters to PromptQL.
5. Keep the cloud account, quotas, networking, and IAM trust available for ongoing management and upgrades.

PromptQL then uses the customer-approved cloud identity to provision and operate the Data Plane in your cloud account. You retain ownership of the account, network controls, audit logs, and the ability to revoke that identity. Availability is a shared responsibility.

Before provisioning, agree on:

1. Deployment model: Dedicated, BYOK, or BYOC.
2. Cloud and region: Data Planes are regional; choose the region nearest the connected systems and users.
3. Availability zones: use multiple zones for in-region high availability.
4. Network ranges: reserve non-overlapping VPC/VNet, Kubernetes service and, where applicable, pod CIDRs. Most deployments use a /16 to /20 VPC/VNet range.
5. Private connectivity: decide whether data sources will use peering, VPN, PrivateLink/Private Service Connect/Private Endpoint, or another cloud-native private path.
6. Encryption ownership: for BYOK, create the KMS key in the same region as the Data Plane and approve the required key policy.
7. BYOC trust: create the dedicated cloud boundary and scoped identity used by PromptQL automation.

Use the guide for your target cloud. Each guide covers Dedicated, BYOK where available, and BYOC:

• Create an Enterprise Data Plane on AWS
• Create an Enterprise Data Plane on GCP
• Create an Enterprise Data Plane on Azure