Cloud and VPC
Run it in our Canadian region, or in your own cloud account.
Cloud or VPC, on the same signed image. Your records leave with you either way.
Every capability on this page is a design commitment, and every record shown is an example on a fictional institution.
Product
GovernanceOS Cloud
A tenant under your own sign-in, in a Canadian region, with a per-tenant key. Records, packs and exports, with nothing to operate.
For regulated institutions, Cloud opens once SOC 2 Type 1 is attested. Until then every institution, in every jurisdiction, runs VPC in its own cloud account.
Product
GovernanceOS VPC
The same signed image in your own cloud account. You hold the keys, the region and the egress allow-list. It keeps running without updates if we stop.
Learn more about tested regions
Tested regions are named per provider (AWS, Azure or Google Cloud) before a pilot.
What runs where
Side by side.
Cloud
With GovernanceOS, in a Canadian region
- Your tenant, with its records, packs and exports
Proofs up, never payloads
With you, inside your boundary
- Your applications and models
- Every payload
- The Boundary Gateway, outbound-only
Keys: a per-tenant key, kept in Canada.
VPC
With GovernanceOS
- Signed releases
Pulled when you choose
With you, in your own cloud account
- The same signed image, in your region
- Your records
- The Boundary Gateway, outbound-only
- Your egress allow-list
- Nothing leaves your account but proofs
Keys: you hold them, in your key management service.
| Item | Cloud | VPC |
|---|---|---|
| Who runs it | GovernanceOS | You, in your own cloud account |
| Where records live |  A Canadian region | Your account and your region |
| Keys | A per-tenant key | Your key management service |
| Sign-in | Your identity provider | Your identity provider |
| Updates | Signed releases, pinned per tenant | You pull signed releases when you choose |
| Boundary Gateway | In your boundary, outbound-only | In your boundary, outbound-only |
| Attestation | Until SOC 2 Type 1 is attested, every institution, in every jurisdiction, runs VPC in its own cloud account | Your controls, our signed image |
| Terms | Institution terms, agreed on a call | Institution terms, agreed on a call |
Residency: records stay in the region you choose.
The exit covenant
Seven commitments, written into the agreement.
The institution can leave at any time with everything in a licensed schema and an open verifier.
- Perpetual license for your own records
A perpetual, irrevocable license to the schemas for your own records, surviving termination, extended to your examiners, auditors and a successor vendor.
- Two export forms, always
The GovernanceOS schema, and flat JSON and CSV with an embedded data dictionary.
- Schema set delivered at onboarding
A copy of the schema set and dictionary from day one, with escrow offered.
- Verifier under Apache 2.0
The offline chain verifier is published, so verification never needs our license.
- Reads and exports never stop
For any reason: no expiry, non-payment or termination ever disables read or export.
- Return, verify, then irreversible deletion
A full export in both forms, your verification with the open verifier, written confirmation, then destruction of the per-tenant key. A deletion attestation is the last declaration in the chain.
- Regulator read without us
A read-only, time-boxed, logged examiner key, and packs that verify offline.
Cloud or VPC: talk it through.
Thirty minutes on your regime, your gaps and which way to run it. Or see where you stand first: four questions, free, and your answers stay in your browser.