Trust · Deployment

You choose the region, and whether anything is deployed at all

External and application testing need nothing inside your network. Internal network testing needs a position inside it, and that position can sit on your own infrastructure or in your own cloud tenancy — both available today.

Request a scoping call Compliance frameworks

Residency

Four regions, and the choice is yours

A region list is a commitment rather than a description, so these four are the four that can actually be chosen. The first row is the one with an instrument behind it.

Region	Why a buyer picks it
India	CERT-In Directions No. 20(3)/2022-CERT-In, issued 28 April 2022 and effective 27 June 2022, require 180 days of rolling ICT logs to be maintained within Indian jurisdiction. For an entity inside that scope the region is a compliance decision rather than a latency one.
European Union	Where the engagement touches personal data of people in the Union and the organisation has taken a position on transfers outside it.
United States	Where the estate, the team and the contracting entity are all there and there is no reason to place it elsewhere.
Singapore and Asia-Pacific	For regional entities outside India, and for groups that keep regional data regionally as a matter of policy.

India

Why a buyer picks it: CERT-In Directions No. 20(3)/2022-CERT-In, issued 28 April 2022 and effective 27 June 2022, require 180 days of rolling ICT logs to be maintained within Indian jurisdiction. For an entity inside that scope the region is a compliance decision rather than a latency one.

European Union

Why a buyer picks it: Where the engagement touches personal data of people in the Union and the organisation has taken a position on transfers outside it.

United States

Why a buyer picks it: Where the estate, the team and the contracting entity are all there and there is no reason to place it elsewhere.

Singapore and Asia-Pacific

Why a buyer picks it: For regional entities outside India, and for groups that keep regional data regionally as a matter of policy.

Deployment

Three shapes, and most engagements use the first

The shape follows the coverage class rather than a product tier. What decides it is whether the assessment has to start from a position inside your network.

01 External and application testing

Nothing deployed on your side

What it covers: External network and application testing need nothing inside your network. The targets are reachable from outside, which is the premise of the assessment.
What you provide: The scope, in writing. For an application class, a credential for each role whose boundary matters.
Why it matters: It is the difference between an engagement that starts this week and one that starts after a change-advisory board meets.

02 Available today

On-premise

Where it sits: Inside your own infrastructure, on hardware or virtualisation you operate.
When it is needed: Internal network testing needs a position inside the network — that is the premise of the class rather than a limitation of the platform.
What is agreed first: Which segment the position sits in and what it is routed to, because that decides what the assessment can honestly report afterwards.

03 Available today

Your own virtual private cloud

Where it sits: Inside your cloud tenancy, in the region you chose, under your own account controls.
When it is chosen: Where the estate is already cloud-resident and placing a physical appliance would be the harder of the two.
What is agreed first: The same as on-premise: the position, the routing, and the movement boundary for anything that travels from it.

What the position decides

Where it sits is the premise of everything the report says

An internal assessment starting in one segment and one starting in another produce different reports about the same estate, and neither is wrong. That is why the position and its routing are agreed at scoping and recorded with the engagement rather than settled by whichever host was easiest to provision. A finding without its starting position is a claim nobody can check.

The same logic runs through the classes that need nothing deployed. An external assessment is worked from outside because that is where the question is asked from, and the external network class sets out what it works the perimeter out from. Where an engagement spans both, they are scoped separately and run as one.

Tell us the estate, and the shape follows

Most engagements need nothing deployed. Where one does, the region and the position are both your decision, taken before anything starts.

Request a scoping call The trust overview