From SCIF to public cloud: choosing where VisibleThread runs
The five deployment options
SCIF and air-gapped
Deployable into classified, fully disconnected settings for the most sensitive programs. No outbound connectivity and no dependency on our infrastructure. This is running today inside some of the largest defense contractors and aerospace enterprises in the world.
Best suited to: classified programs and environments where external connectivity is not permitted.
Managed by: your team, inside your own facility.
On-premises
Customer-managed deployment on Windows, Red Hat Enterprise Linux, or as a virtual appliance, running entirely inside your own firewalls. You keep total data sovereignty and full control over the upgrade cycle. We support your IT team with documented self-serve upgrade paths for underlying components so you can stay current on your own schedule, and we hold service level commitments for addressing critical and high severity vulnerabilities.
Best suited to: organizations whose contracts or internal policy require data to remain within their own infrastructure.
Managed by: your IT team, with our support.
Private Cloud: Azure GCC High and AWS GovCloud Deployment
A dedicated, isolated instance running in your own Azure GCC High or AWS GovCloud (US) environment. You get the isolation and regulatory boundaries of a single-tenant deployment while using cloud infrastructure your organization has already accredited.
Best suited to: teams that have already invested in a government cloud tenancy and want VisibleThread inside it.
Managed by: your team, in your own tenancy.
Secure GovCloud
Single-tenant and VisibleThread-managed, running in AWS GovCloud and now listed on the FedRAMP Marketplace with FedRAMP Equivalency. FedRAMP Equivalency means the hosting environment meets the same NIST 800-53 control baseline as a FedRAMP-authorized system, giving agencies a recognized path to authorize use without a full independent assessment. We handle the hosting, hardening, patching and updates. You get new releases as soon as they are available rather than waiting for an internal upgrade window, and the AI capability is wired in, so there is no LLM for your team to source, host or maintain.
Because we support single sign-on only, provisioning needs your identity provider details, typically Microsoft Entra or Okta. Once we have those, most environments are live within half a day to a day.
Best suited to: organizations working with CUI that would rather not carry the hosting load. CUI, or Controlled Unclassified Information, is federal data that requires safeguarding under NIST 800-171 and DFARS 252.204-7012, and is common in defense and civilian agency contracts.
Managed by: VisibleThread.
Public cloud
VisibleThread-managed multi-tenant cloud. Instant access with no setup and no infrastructure to maintain, plus continuous updates and high availability.
Best suited to: proposal and bid teams working outside regulated environments.
Managed by: VisibleThread.
What stays the same across all five
Whichever option you choose, you get the same platform and the same security posture. Workspaces partition data by sensitivity by design, so teams working on different programs stay separated regardless of where the platform runs. Our controls map to SOC 2, NIST and FIPS, and we handle data in line with GDPR.
What differs across the five is not how secure the environment is. It is who carries the operational load, and how quickly you can be up and running.
Where the FedRAMP listing fits
Our listing on the FedRAMP Marketplace applies to Secure GovCloud. It adds a certified cloud option for customers who want one.
That is worth stating plainly. Customer-hosted and on-premises deployment remains a core part of what we offer. More than 120 organizations run VisibleThread inside their own environment today, and for many of them that is a contractual requirement rather than a preference.
For customers who do have freedom to choose, GovCloud mainly removes work. No hosting, no patching cycle, no upgrade scheduling, and no AI infrastructure to stand up.
How to work out which one fits
A quick way to narrow it down:
- If your program cannot connect to anything, you are looking at SCIF or air-gapped.
- If your contract or policy requires data to stay inside your own infrastructure, on-premises or private cloud.
- If you work with CUI and would prefer the hosting handled for you, Secure GovCloud.
- If your work sits outside regulated environments, public cloud.
In practice, most conversations resolve quickly once the data classification and the contract obligations are on the table. If you are not sure which side of that line you fall on, it is worth working out early rather than late in an evaluation.
Verify it for yourself
You can check our marketplace listing and current certifications at our trust center, and read more about how we protect your data on our security page.
If you would like to talk through which deployment model fits your environment, schedule a demo and we will walk you through the options.
