Three Topologies. One Governance Posture.
Forge runs hosted dedicated, inside your own cloud account, or air-gapped. There is no SaaS option and no multi-tenant option. The same audit-grade controls apply across every component (Governed Tooling Layer, Forge AI Substrate, Dark Factory), so your topology choice is determined by data residency and auditor acceptance, not by feature trade-offs.
Operating mission-critical regulated environments for enterprises across banking, capital markets, life sciences, semiconductor, and defense in North America and Europe.
Where your toolchain runs is a governance decision, not just an infrastructure one. Data residency, regulatory scope, and your security team's threat model all shape what "acceptable" looks like — and most platforms force a single answer.
Forge meets your environment where it is. Run it in the cloud for elasticity and speed, on-premises where data residency or control requirements demand it, or fully air-gapped for the most sensitive workloads. The governance model, identity integration, and evidence collection stay consistent across all three, so moving from one to another does not mean rebuilding your controls or retraining your teams.
For regulated enterprises, that consistency is the point: the same posture, the same audit trail, and the same operational model whether a workload sits in a public region or behind an air gap.
Deployment topology is a cross-cutting concern at iTmethods.
Whether you are buying the Governed Tooling Layer, the Forge AI Substrate, or Dark Factory, the three topologies are uniform and the governance posture is identical. Hosted Dedicated for single-tenant isolation under iTmethods operation, connected securely to your trust boundary. Customer Cloud for workloads that must remain inside your AWS, Azure, or GCP account. Air-Gapped for environments with no external network egress. The control plane, audit trail, and policy enforcement do not change. Only the boundary changes.
Choose your deployment model.
Each topology is fully supported with enterprise SLAs, security posture, and 24/7 Forge engineering.
Hosted Dedicated
Single-Tenant Forge Operated by iTmethods
Single-tenant Forge inside an isolated account, operated by iTmethods on a governed AWS foundation and connected securely to your trust boundary. The default for regulated software vendors, healthcare ISVs, and growth-stage fintechs.
Best for
- Regulated software vendors
- Healthcare ISVs
- Growth-stage fintechs
Key features
Considerations
- Data hosted in iTmethods infrastructure
- Network connectivity to iTmethods cloud
Customer Cloud
Forge Inside Your AWS, Azure, or GCP
Forge deployed inside the customer's own AWS, Azure, or GCP account. Operated by iTmethods. The standard topology for Tier 1 banks, insurance carriers, and federal civilian agencies.
Best for
- Tier 1 banks
- Insurance carriers
- Federal civilian agencies
Key features
Considerations
- Requires cloud account access
- Cloud infrastructure costs separate
Air-Gapped
No External Network Egress · In Development, Targeted 2027
Forge deployed inside environments with no external network egress. Defense, intelligence, sovereign-cloud regulators, and BioCompute customers operating Reign LS with intoDNA STRIDE under classified or export-controlled regimes.
Best for
- Defense and intelligence
- Sovereign-cloud regulators
- BioCompute customers operating Reign LS with intoDNA STRIDE under classified or export-controlled regimes
Key features
Considerations
- Requires infrastructure team
- Hardware and hosting responsibility
Side-by-side comparison.
| Feature | Hosted Dedicated | Customer Cloud | Air-Gapped |
|---|---|---|---|
| Setup Time | Days | 1-2 Weeks | 2-4 Weeks |
| Operational Overhead | None | Minimal | Moderate |
| Data Location | iTmethods Cloud | Your Cloud | Your Data Center |
| Updates | Automatic | Managed | Coordinated |
| Customization | Standard | High | Full |
| Security Control | Shared | Shared | Full |
| Compliance | SOC 2, ISO, HIPAA | SOC 2, ISO, HIPAA | All plus Custom |
| Support Model | 24/7 Full | 24/7 Full | 24/7 plus On-site |
Which is right for you?
Choose Hosted Dedicated if...
- You want zero operational burden
- Speed to value is critical
- Single-tenant isolation needed
- You prefer predictable costs
Choose Customer Cloud if...
- You have cloud commitments
- Data must stay in your account
- You need custom networking
- Integration with cloud services
Choose Air-Gapped if...
- Regulatory requirements demand it
- You have data center capacity
- Full infrastructure control needed
- Custom security configurations
Frequently asked questions
- What deployment models does Forge support?
- Three: hosted dedicated (operated by iTmethods, connected securely to your trust boundary), customer cloud (deployed and managed inside your own cloud account), and air-gapped (in development, targeted 2027). The same governance and evidence model applies across all three. There is no SaaS or multi-tenant option.
- Can we start in the cloud and move on-prem later?
- Yes. Because the control and identity model is consistent, changing deployment posture does not require rebuilding your governance.
- Is air-gapped genuinely isolated?
- Yes — air-gapped deployments run without external network dependencies for the most sensitive environments.
- How does deployment choice affect compliance evidence?
- It does not change what you can prove. Evidence is collected the same way regardless of where the workload runs.