> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rotascale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment

> Single-tenant in your environment: your cloud, your data centre, or airgapped. What that means and what it costs you.

RotaGrant runs inside your estate. There is no tenant of ours with a residency
label on it, and no payload reaches Rotascale on any code path.

## Three shapes

<CardGroup cols={3}>
  <Card title="Your cloud" icon="cloud">
    A VPC you own. The usual choice, and the one with the fewest trade-offs.
  </Card>

  <Card title="Your data centre" icon="server">
    On-premise, including inside an OT boundary.
  </Card>

  <Card title="Airgapped" icon="plug-circle-xmark">
    No egress at all. The deployment refuses to start if a setting selects a
    service outside your network.
  </Card>
</CardGroup>

## What airgapping costs, stated rather than hidden

A disconnected deployment gives up one evidence property: **external
anchoring**. Sealing, sequencing and inclusion proofs all still work, so
tampering remains detectable. What you lose is the independent attestation that
a record existed by a certain time, because that requires publishing a root
somewhere you do not control.

The deployment tells you this at start-up rather than letting you discover it in
an audit. A platform that quietly degrades a guarantee is worse than one that
cannot offer it.

## No outbound surprises

The platform calls no LLM anywhere. Not for summaries, not for classification.
A test fails the build if a model provider appears in the dependency graph, and
a second test fails the build if any module opens a network connection without
appearing in the egress inventory.

That inventory is enumerable and probed rather than described, which is the
difference between a claim and a control.

<Note>
  This section is about a **deployment**. rotascale.com itself runs Google
  Analytics and [says so](https://rotascale.com/privacy/). The two are separate,
  and conflating them would be the kind of thing this platform exists to catch.
</Note>

## Sizing and operations

The authorisation path is one call before a consequential action, with the gates
ordered so cheap structural checks run first. An action refused at gate 1 never
reaches policy evaluation, which is what makes the check affordable inline
rather than sampled.

Full deployment guidance, including database, key custody and upgrade
procedure, is in the operator handbook that ships with your deployment rather
than published here, because it describes your environment and not ours.