Skip to main content
Traversal’s single-tenant SaaS deployment option provides a dedicated, isolated deployment of Traversal exclusively for your organization, running in its own dedicated cloud account — separate from Traversal’s multi-tenant SaaS environment and from every other customer’s deployment. Unlike multi-tenant SaaS, no infrastructure is shared with other customers. Unlike BYOC, that dedicated cloud account is owned and operated by Traversal, not yours — so there’s no cloud account for you to provision or maintain.

​
Architecture

The Traversal Cloud Environment runs in a dedicated, Traversal-owned AWS account — separate from the shared account that powers multi-tenant SaaS — isolated to your organization alone, and reachable at your own dedicated domain, which can be a domain you delegate to Traversal. Traversal Single-tenant SaaS Architecture Diagram

​
Networking

By default, connectivity to your single-tenant SaaS deployment is the same as multi-tenant SaaS: traffic travels over the public internet and is secured with mTLS — both sides authenticate with certificates, and all traffic is encrypted in transit. PrivateLink is available as an optional add-on, on request, for organizations that need private network paths to their dedicated deployment.

​
Compute

All compute powering your single-tenant SaaS deployment — services, data stores, data pipelines, agentic workflows, and applications — runs on dedicated cloud instances and managed cloud services, exclusively for your organization, within Traversal’s own AWS account(s).

​
AI Models and Inference

Traversal uses frontier AI models (LLMs) to power its AI SRE agent. As with Traversal’s other deployment options, LLM calls are routed through Traversal’s managed default, under zero-data-retention agreements with its LLM providers.

​
Access control

Access to your single-tenant SaaS deployment by your users is always secured and controlled by Single Sign-on (SSO) with your Identity Provider. Because your single-tenant SaaS deployment runs inside Traversal’s own cloud account rather than a customer network boundary, there’s no VPN or cross-account bridge for Traversal operators to cross. Operational and administrative access by Traversal is made directly to Traversal’s own cloud account, through Traversal’s normal internal access controls, secured by SSO with second-factor authentication and fully audited.

​
Telemetry

System telemetry used to monitor your single-tenant SaaS deployment, as well as usage data for billing purposes, flows to Traversal’s internal observability and usage metering solutions — the same as Traversal’s multi-tenant SaaS offering, since your deployment already runs within Traversal’s own environment. All telemetry data is always sent securely over HTTPS to authenticated endpoints.

​
Data security

All data stored by Traversal in databases, network-attached storage volumes, and cloud storage buckets for your single-tenant SaaS deployment is dedicated and exclusive to your organization — never shared with other customers. Data is always encrypted at rest and in-transit by best-in-class encryption (AES-256 and TLS1.3).

​
Network security

Within the Traversal platform, all service-to-service traffic is authenticated and encrypted in-transit with mTLS/TLS1.3, consistent with the rest of Traversal’s platform. Your single-tenant SaaS deployment has dedicated ingress at your own domain, isolated from other customers’ traffic.

​
Operations

Single-tenant SaaS deployments are fully managed and operated by Traversal, with the same operational rigor and high-availability guarantees as Traversal’s BYOC and multi-tenant SaaS offerings. Experienced Traversal operators continuously monitor, tune, and deploy updates to your deployment to ensure the highest quality of service.