Bring your own cloud
BYOC for AI agents: what runs in your AWS account, and why it matters
BYOC (bring your own cloud) means the agent platform runs in a cloud account you own. With Agentifiers, the agent runtime, workflow state, memory, traces, and audit logs live in a dedicated AWS account in your AWS Organization, under your policies and encryption keys. Models are reached only through providers you approve, on your own keys.
Definition
BYOC, defined
Bring your own cloud is a deployment model, not a product. The software comes from a vendor, but it runs in infrastructure the customer owns: your cloud account, your policies, your logs, and your bill.
For AI agents, that matters more than for most software. An agent that does real work holds credentials to your systems, keeps memory about your customers and vendors, and produces a record of every decision it made and every action it took. That puts it in the same category as your ERP and your identity provider, and you would not let a vendor run those in an account you cannot see.
There are four common ways to run an agent platform. They differ in where agents run and who operates them.
| Comparison | A SaaS agent tool | Deployments.ai, hosted by us | Self-hosted (coming soon) | BYOC with Agentifiers |
|---|---|---|---|---|
| Where agents run | The vendor's cloud | Agentifiers' AWS account | Your AWS account | A dedicated AWS account in your AWS Organization |
| Who operates the platform | The vendor | We run, upgrade, and monitor it | Your team | We deploy and operate it with you, or hand it over |
| Who bills the infrastructure | The vendor, inside its price | We invoice platform access | AWS, on your account | AWS, on your account, with no markup from us |
| If you part ways | Start over | Export your tenants' data | Nothing to part with | Keep the platform, the agents as code, and your data |
| Effort to start | Sign up and start | No infrastructure to run | Your engineers deploy and run it | An AWS account, an OpenTofu apply, IAM review, and agreed model providers |
Inside the account
What runs in your AWS account
When we deploy the platform, the following runs on your AWS infrastructure:
- Runtime. The services that execute agents and workflows, built on Lambda, ECS on Fargate, SQS, and EventBridge.
- State. Workflow state, schedules, and agent memory, stored in DynamoDB and S3.
- Keys. Encryption keys managed in KMS under your account.
- Traces and audit trail. Every run, span, tool call, and approval.
- Channels. Agent email sent through SES on your own domain, and API Gateway endpoints under your control.
What leaves the account is model traffic. Agents send the content needed for each step only to the model providers you approve, through a model gateway that enforces your model policies, using your own provider keys. Traces show exactly what was sent where. Agents reach your business systems only through tools you allow.
Setup
How a BYOC engagement is set up
- You create a dedicated AWS account inside your AWS Organization. It inherits yourservice control policiesand lands on your consolidated bill with the rest of your AWS spend.
- You grant us a scoped role. Only the permissions the work requires, reviewed by your team before you grant them.
- We provision the platform with OpenTofu.It is wired into your IAM, your KMS keys, and your environment layout, and the OpenTofu state is stored in your account.
- We set it up under your brand. Your name, your domain, and the agent identities your people will see in Slack and email.
- We build your agents. We agree which model providers are allowed, then map your processes with the people who run them and ship supervised agents, with approvals wherever money, customers, or risk are involved.
This is how every internal agents engagement runs. Product teams can have usset the platform up in their AWS account the same way.
Access
How our access works
We need scoped roles in the dedicated AWS account, with only the permissions the work requires. Your team can review them before granting them, and our activity is logged in your account like any other.
You can revoke our access at any time. We remove it at the end of an engagement unless you ask us to keep operating the platform.
Environments
Separate AWS accounts for dev and prod
Owning the infrastructure means you can split environments the same way you split them for any other production system. Dev and prod can live in separate AWS accounts, with a model gateway policy for each environment.
Agents are defined as code and shipped as immutable, versioned releases. A new release is evaluated, rolled out to a canary, and promoted between environments only when it behaves as expected. An experiment in development cannot touch a live payment run, and a bad release can be rolled back to a known version.
Security review
What your security team can review
Because the platform runs in your account, your security team reviews it with the tools they already use:
- IAM policies, network boundaries, encryption settings, and logging, in your own AWS console.
- The OpenTofu configuration, so the whole footprint is code your team can read, diff, and approve.
- Our activity in the account, logged like any other.
- Model policies for each environment, and the model providers each environment may call.
- Retention, export, and erasure policies that you set, rather than features you request from a vendor.
- Audit logs exported with signatures, so a reviewer can verify they have not been altered.
Once the public source release is out (coming soon), your engineers can also read the platform code itself, under the Functional Source License (FSL-1.1-ALv2).
Trade-off
The trade-off, honestly
A hosted tool is faster to try: you sign up and start typing. BYOC takes a real deployment: an AWS account, an OpenTofu apply, some IAM review, and agreement on which model providers are allowed.
BYOC does not mean you have to staff a platform team. We deploy the platform, operate it during the engagement, and hand over runbooks written for your team. You can keep us on to run it. The extra effort happens once, up front, and the control lasts for as long as you run the system.
If we part ways
What you keep if we stop working together
In a BYOC setup, you keep everything. The platform keeps running in your account, and the work is yours:
- The agents, as code in your repository.
- The OpenTofu configuration, with its state in your account.
- The evaluation suites each agent must pass before a release is promoted.
- The runbooks for each process: who approves what, and what to do when something looks off.
- The traces and audit trail for every run.
You can operate it yourselves, extend it with your own engineers, or work with someone else. Seeinternal agents for everything an engagement hands over.
BYOC or hosted
How BYOC differs from hosted Deployments.ai
The platform is Deployments.ai. With BYOC, it runs in an AWS account in your AWS Organization. With the hosted Deployments.ai service, we run and manage it in Agentifiers' AWS account.
- BYOC. Your account, your policies, your keys, and your bill. We deploy the platform and can operate it, and you can take it over at any time. Every internal agents engagement runs this way.
- Hosted Deployments.ai. The same platform and API, with no infrastructure for you to run. We run, upgrade, and monitor it, and we invoice platform access. It is one of thethree ways to run the platform for agents in your product, and it is where we run AI agents for small businesses. You can export your tenants' data before you leave.
Choose BYOC when your security or audit requirements call for agents in your own cloud. Choose hosted Deployments.ai when you would rather not run infrastructure.
BYOC questions
No. In BYOC, the platform runs in an AWS account in your AWS Organization, and we deploy, configure, and can operate it for you. Self-hosting means your own engineers run the platform from its source, which is coming soon under FSL-1.1-ALv2 and will be free for your own use. Both keep the platform in your cloud.
Standard AWS services your team already knows: Lambda, ECS on Fargate, DynamoDB, S3, KMS, EventBridge, SQS, and API Gateway, plus SES for agent email on your own domain. They are provisioned with OpenTofu, and the OpenTofu state is stored in your account.
Model calls do. Agents send model providers the content needed for each step, and only to the providers you approve, through a model gateway that enforces your model policies with your own provider keys. Runtime, state, memory, traces, and the audit trail stay in your account, and traces show exactly what was sent to which provider.
You do, directly. AWS bills the infrastructure on your own account, with no markup from us, and model providers bill usage on your own keys. We invoice our fees separately, itemized against the scope we agreed. See pricing for how engagements are billed.
Plan it before you start. Hosted Deployments.ai is the same platform, with the same API, as BYOC, so agents defined as code carry over. Moving tenant data and configuration is a step we plan with you up front, not a one-click switch, so tell us if you expect to move.
More answers on cloud, security, and the license are in theFAQ.
Read next
- Blog
Why your agents belong in your own AWS account
The four reasons we deploy agents into your account, and what BYOC does not mean. - Platform
What the platform runs
Multi-tenancy, agents as code, approvals, durable workflows, traces, evaluations, and governance. - Compare
Building on Amazon Bedrock AgentCore vs working with Agentifiers
What AWS-managed building blocks give you, and what your team still builds. - Guide
What is agentification?
How we rebuild recurring work so supervised AI agents do the repetitive steps.
Bring your security team to the first call
We'll walk through what runs in your AWS account, what access we need, and how you take it back. A discovery call is a conversation about the work, not a demo.