PromptQL Enterprise separates the platform into a Data Plane, where operational workloads and customer data live, and a Control Plane, which provides centralized identity, provisioning, billing, and lifecycle management. This boundary is consistent across all Enterprise deployment models.

Choose where the single-tenant Data Plane runs and who controls its encryption keys:

• Dedicated: PromptQL operates the Data Plane in dedicated infrastructure in a PromptQL-managed cloud account.
• BYOK: the Dedicated model, with encryption at rest controlled by a customer-managed KMS key.
• BYOC: PromptQL deploys and operates the Data Plane inside the customer's AWS, GCP, or Azure account.

An Enterprise agreement is required. Contact sales to select a deployment model and begin provisioning.

The Data Plane is the runtime and security boundary for each Enterprise deployment. It contains:

• PromptQL projects, conversations, wiki content, metadata, and indexes
• database credentials, OAuth credentials, API keys, and other integration secrets
• the PromptQL runtime, virtual SQL layer, connectors, and artifact storage
• authorization enforcement and all requests to connected databases and APIs

Customer information and secrets are encrypted at rest in the Data Plane. Runtime requests are served by the Data Plane; the Control Plane is not on the request path.

Each Data Plane is deployed in one cloud region and can span multiple availability zones for in-region high availability. Place it close to the systems it accesses and use private connectivity where required: AWS PrivateLink or VPC connectivity, GCP Private Service Connect or VPC connectivity, and Azure Private Endpoint or VNet connectivity.

The PromptQL-hosted Control Plane provides centralized services without storing project operational data:

• authentication and enterprise identity integration
• organization, subscription, and billing management
• software release and deployment coordination
• platform health and optional observability
• lifecycle orchestration for PromptQL-managed Data Plane components

The Data Plane communicates with the Control Plane only for defined control and management operations: receiving connector deployment specifications, optional OpenTelemetry export, and authorized BYOC workload management through the customer-approved cloud identity.

API responses, query results, conversations, wiki content, connected-system credentials, and integration secrets remain in the Data Plane.

Choose the guide for the deployment model. Each guide contains cloud-specific sections.

PromptQL-managed single-tenant infrastructure on AWS, GCP, or Azure. Create a Dedicated Data Plane.

PromptQL-managed infrastructure using your customer-managed encryption key on AWS or GCP. Create a BYOK Data Plane.

PromptQL-managed infrastructure deployed into your AWS account, GCP project, or Azure subscription. Create a BYOC Data Plane.

Before provisioning, agree on:

1. Deployment model: Dedicated, BYOK, or BYOC.
2. Cloud and region: Data Planes are regional; choose the region nearest the connected systems and users.
3. Availability zones: use multiple zones for in-region high availability.
4. Network ranges: reserve non-overlapping VPC/VNet, Kubernetes service and, where applicable, pod CIDRs. Most deployments use a /16 to /20 VPC/VNet range.
5. Private connectivity: decide whether data sources will use peering, VPN, PrivateLink/Private Service Connect/Private Endpoint, or another cloud-native private path.
6. Encryption ownership: for BYOK, create the KMS key in the same region as the Data Plane and approve the required key policy.
7. BYOC trust: create the dedicated cloud boundary and scoped identity used by PromptQL automation.

Start with the guide for your deployment model:

• Create a Dedicated Data Plane
• Create a BYOK Data Plane
• Create a BYOC Data Plane