the dominions — private vpc
Pantheon in your private VPC.
Run the full automation platform single-tenant inside your own AWS or GCP account. Agents, scripts, runtime, and audit log all live within your network boundary - Obsidura operates the software, your cloud account holds the data.
What a VPC deployment gives you
- Single-tenant: your deployment shares nothing with anyone else's.
- Your network boundary: connectors reach your databases and internal services over your network, not the public internet.
- Your cloud account: the deployment runs in AWS or GCP infrastructure you own and can inspect.
The same security model, inside your walls
Nothing about the platform relaxes in a private deployment. Task bodies still run in containers holding no credentials, reaching resources only through the run-scoped proxy. Grants are still enforced per call - a row filter for Postgres, a key prefix for object storage, a URL allowlist for HTTP - and every action still lands in the append-only run log.
Contract validation at every seam, the bounded repair loop when an agent emits something malformed, durable approval gates, and crash recovery from the run log all behave identically.
When to choose VPC
Choose a private VPC when your data governance requires that operational data stay inside infrastructure you control, but you still want a managed platform rather than hardware to run. If no external calls at all is the requirement, the on-premises deployment goes further.
Put Pantheon to work.
A 30-minute call. We map one job you already do by hand and show you the audit log by the end of it.