Run Knowi where you want with multiple deployment options.
Managed cloud, your own VPC, on-premises, hybrid or air-gapped. The same platform and the same agents in every option. Your security team decides where it runs.
SOC 2 Type II attested controls. On-premises via Docker, Kubernetes or native install, with your own LLM.
The security review asks one question first.
Where does it run, and what leaves?
Everyone encrypts. The review turns on whether the platform can sit inside your boundary, and whether the AI that reads your data can too. Both are yes.
What actually moves when Knowi runs a query
Knowi generates a query, retrieves only the result, and holds it in a temporary cache. Raw tables are never copied into Knowi storage. This is the same in every deployment option.
MongoDB, Elasticsearch, SQL, APIs
Stay where they are, under your existing auth, firewall and encryption policies.
→Native protocol, read-only
Speaks each database's own language. Only query results leave the source, never raw tables or exports.
→Configurable, auto-expires
Results are held for the window you set, encrypted at rest with AES-256, then discarded.
→Browser, embedded app, Slack
Delivered over TLS 1.2+, scoped by role and row-level security to what each user is allowed to see.
Three places the platform can live
Nothing to install. Your databases still stay put.
Knowi's managed service connects to your sources over native protocols, through SSL or SSH tunnels when they sit behind a firewall, with IP whitelisting to restrict who can reach the platform. Knowi AI runs inside the Knowi boundary, so natural language questions are not routed to a third-party model unless you enable one per feature.
- SOC 2 Type II report prepared under AICPA and ISAE standards, available on request
- AES-256 for credentials and cached results at rest, TLS 1.2+ in transit
- SSL/SSH tunneling to databases behind your firewall, IP whitelisting
- Upgrades and maintenance handled by Knowi
The whole platform inside your boundary, AI included.
Install natively, or via Docker or Kubernetes. On-premises customers run the full platform, all agents and their own LLM, with the AI engine on your hardware including GPU support. In this deployment, data does not leave your environment.
- Native install, Docker or Kubernetes
- Full platform, every agent, Document AI and your own LLM, all local
- Private cloud VPC deployments for teams that want their own network without their own racks
- Meets strict data residency requirements without a separate architecture
For the two ends of the spectrum
Hybrid splits the deployment between Knowi's managed service and your own environment, scoped to your requirements on the call. Air-gapped puts everything, agents and model included, on a network with no outbound connection at all.
- Hybrid: managed components where convenient, sensitive components inside your network
- Air-gapped: full platform and LLM on an isolated network, no outbound calls
- Suitable for finance, government and healthcare environments
- HIPAA-aligned controls with a BAA available; GDPR data minimization and right-to-erasure support
What differs between the options
The features do not. Where things run, and what leaves your network, do.
The controls that come with the platform
Authentication
- SSO via SAML and OpenID Connect
- Two-factor authentication
- LDAP integration for directory-based auth
- Session management and automatic timeout policies
Access control
- Role-based access control
- Row-level security, users see only their authorized rows
- Multi-tenancy isolation with per-tenant data boundaries
- User activity auditing, login tracking, query history with rollback
Encryption and compliance
- AES-256 at rest for credentials and cached results, TLS 1.2+ in transit
- SOC 2 Type II attested controls, report on request
- HIPAA-aligned controls, BAA available, PHI never stored long-term
- GDPR: data minimization and right-to-erasure support
Related reading
What security teams ask about deployment
Does the on-premises version have the same features as Knowi's managed cloud?
Yes. Cloud, on-premises and hybrid deployments have full feature parity. On-premises customers run the full platform, all agents, Document AI and their own LLM via Docker, Kubernetes or a native install.
Can Knowi's managed cloud reach a database that sits behind our firewall?
Yes, through SSL or SSH tunneling to the database. IP whitelisting is also available to restrict access by network. Knowi connects over the database's native protocol and retrieves only query results, never raw tables or exports.
Where do query results get cached, and for how long?
Results are held in a temporary cache, encrypted at rest with AES-256, for a window you configure, then discarded. No sensitive data persists beyond that window, and raw source tables are not copied into Knowi storage in any deployment.
In the managed cloud, does the AI send our data to OpenAI or Anthropic?
Not by default. Knowi AI is the default model, and models, inference and vector search stay inside the Knowi boundary. OpenAI or Claude can be enabled per feature if you want them, and switched off again. On-premises and air-gapped deployments run your own LLM locally, so no external model is involved at all.
What compliance documentation can Knowi provide for our vendor review?
A SOC 2 Type II report prepared in accordance with AICPA attestation standards and ISAE international standards, available on request from support@knowi.com. For healthcare, Knowi operates HIPAA-aligned controls and can sign a BAA. For EU data, Knowi supports GDPR data minimization and right-to-erasure requirements.
Can we run a fully air-gapped installation with no internet access?
Yes. The full platform, every agent and your own LLM run on the isolated network, with no outbound calls required. Deployment is via Docker, Kubernetes or a native install, and your team handles installation and upgrades with Knowi's support.
Does a VPC deployment need our own hardware?
No. A private cloud VPC deployment runs the platform inside your own cloud network rather than on Knowi's shared infrastructure, without physical servers. On-premises is for teams that need it on their own hardware. Both give you the full platform inside your boundary.
Bring your security questionnaire to the demo.
We walk the data path end to end for the deployment you have in mind: what runs where, what leaves, and what the install looks like.
SOC 2 Type II report available on request. Vulnerability reports to support@knowi.com, answered within one business day.