Bring Your Own Cloud

What BYOC means at Mycelium

Your data never leaves your network perimeter. Mycelium ships the runtime as a deployable artifact (Helm chart, Docker Compose, or Terraform module). You own the cloud account, the Kubernetes cluster, the storage layer, and the keys. Mycelium operates the artifact, not your environment.

Reference deployment paths

AWS VPC

Terraform module reference at docs.myceliumai.co/byoc/aws. Deploys to ECS Fargate or EKS. Uses customer-owned RDS for tenant metadata, S3 for vault storage, and KMS for keys.

Azure subscription

ARM template reference at docs.myceliumai.co/byoc/azure. Deploys to AKS. Uses customer-owned PostgreSQL Flexible Server, Blob Storage, and Key Vault.

GCP project

Terraform module reference at docs.myceliumai.co/byoc/gcp. Deploys to GKE. Uses customer-owned Cloud SQL, GCS, and Cloud KMS.

Network posture

• Ingress is HTTPS only, TLS 1.3.
• No outbound calls except customer-configured webhooks (Slack, GitHub, Notion, Linear, Gmail, Salesforce, Oracle, Jira, HubSpot, GitLab, Dropbox, Zoom, ADP).
• LLM compute is opt-in per tenant (Anthropic, OpenAI, OpenRouter, MiniMax). No default routing to a Mycelium-controlled model.
• No Mycelium telemetry by default. Logging is local until you wire a sink.

Storage

The per-tenant vault is filesystem-native. Mycelium operates over POSIX (EBS, Azure Disk, GCE PD) or any S3-compatible object store. You choose the storage layer. Mycelium does not impose a database vendor; tenant metadata is a flat file by default and a managed Postgres in the reference modules above.

Key management

Per-tenant encryption keys live in your KMS (AWS KMS, Azure Key Vault, GCP Cloud KMS, or HashiCorp Vault). Mycelium never stores keys. The runtime authenticates to your KMS via the cloud-native identity primitive (IAM role, managed identity, workload identity) provisioned by the reference module.

Air-gapped variant

For regulated customers (defense, intelligence, healthcare with HIPAA plus state retention), an air-gapped Dockerfile is published at github.com/adelaidasofia/memory-runtime-pro/deployment/airgapped. No outbound dependencies at runtime. Offline-friendly build pipeline. Customer-side webhooks are explicit per-tenant configuration; any subset can be disabled.

Engagement model

BYOC customers sign the engagement letter, receive the deployable artifact plus the ops runbook plus one pairing session with a Mycelium engineer. Ongoing support runs through a shared Slack channel. Updates are delivered as signed Helm chart upgrades; you choose the upgrade window.

What's not yet certified

Honest list, refreshed each quarter:

• SOC 2 Type II: engagement starting.
• HIPAA full attestation: in flight.
• FedRAMP Moderate: on roadmap.

Direct security and compliance questions to security@myceliumai.co.