Varolio DocsDedicated Cloud
Single-tenant Varolio environment in a dedicated, Varolio-operated AWS account
Dedicated Cloud
Dedicated Cloud is Varolio's single-tenant deployment model for customers who need a fully isolated environment and a choice of region, without owning or operating the underlying cloud account. The environment is dedicated to one customer, hosted in a separate AWS account that Varolio owns and operates — there are no other tenants and no shared services.
It sits between the other models: more isolated than Cloud SaaS, which is multi-tenant; lighter to adopt than Cloud-Prem, which runs inside the customer's own account. The software is functionally identical across all models — same services, same data layer, same AI surface.
Dedicated Amazon EKS cluster
Region and environment
Each Dedicated Cloud customer gets a separate AWS account with its own VPC, EKS cluster, S3 buckets, and secret store, plus dedicated Supabase (PostgreSQL), Elastic Cloud, Redis, and Temporal Cloud (workflow orchestration) instances. Nothing is shared with any other customer.
Unlike Cloud SaaS, which is hosted in Frankfurt, the customer chooses the region at deployment time, so data-residency requirements are met by where the environment is provisioned. Canada (ca-central-1) is validated and running in production today; other AWS regions are available on request.
Tenancy and isolation
The environment is single-tenant by construction: there is exactly one tenant in the account, and isolation comes from the account and VPC boundary rather than only from application-layer filtering.
- The operational database, search index, object storage, and message fabric are dedicated to the one customer. No data path crosses into another customer's environment because no other customer exists in the account.
- All the application-layer isolation controls from Cloud SaaS (workspace-scoped queries, namespaced object keys, per-tenant credentials, separate admin surface) still apply on top of the account boundary.
Public surface
| Hostname | Purpose |
|---|---|
app.{region}.varolio.io | Main user web application (Studio) |
{region}.api.varolio.io | Platform API (engine) |
mcp-{region}.varolio.io | MCP server for AI-tool access |
For example, the Canadian production environment is served at app.ca.varolio.io, ca.api.varolio.io, and mcp-ca.varolio.io. The edge uses the same AWS WAF + ALB (TLS 1.2+, ACM) configuration as Cloud SaaS, provisioned per environment.
Encryption
Identical to Cloud SaaS: AES-256 at rest across Supabase (PostgreSQL), Elastic Cloud, and S3 (SSE-S3); secrets in AWS Secrets Manager with CSI sync; TLS 1.2+ in transit at every external hop.
Operational ownership
| Area | Owner |
|---|---|
| AWS account, VPC, EKS, data stores | Varolio (dedicated account) |
| OS and node patching | Varolio (EKS-managed node groups) |
| Application code and releases | Varolio (same GitOps pipeline as Cloud SaaS) |
| Database backups | Varolio |
| Secret rotation | Varolio |
| Monitoring, alerting, on-call | Varolio |
| Cloud bill | Varolio (included in subscription) |
| Customer user accounts and roles | Customer |
| Customer SSO configuration | Shared — customer provides IdP (OIDC), Varolio configures |
| Integration credential authorization | Customer |
Upgrade cadence
Dedicated Cloud environments are configured in the same GitOps repository as Cloud SaaS, as a parallel environment tree. Every release flows through the same CI and review pipeline, then rolls out per environment — which means the upgrade window for a dedicated environment can be scheduled with the customer where contractually required.
AI and embedding providers
Same defaults as Cloud SaaS (Application Architecture — AI providers), with inference routed to regional provider endpoints where available. Customers who require inference against their own model deployment can combine Dedicated Cloud with BYO Data Store.
When to choose a different model
- Choose Cloud SaaS if EU (Frankfurt) residency is sufficient and you do not need single-tenant isolation.
- Choose BYO Data Store if the search index, LLM, or object storage must run on infrastructure you host.
- Choose Cloud-Prem if the environment must run inside a cloud account you own.