Your agents run in your cloud. Not ours.
Stackbone installs your agent on a VM inside your own AWS, GCP or Azure account — 1:1, provisioned by infrastructure-as-code. Your data, your model keys and your services stay in your perimeter. We bring the control plane and Studio; your cloud keeps everything that matters.
- IaC from day one
- your perimeter
- your bill
- no lock-in
Everything that matters stays
on your side of the line.
- The deep-agents runtime runs on a VM inside your VPC — Docker runs the image.
- Your Postgres holds the Workflow World — every run’s durable state.
- Storage, secrets and the vector index are your own native services.
- Untrusted tool code is sandboxed in the VM — the blast radius is your machine.
- The model call uses your key, or your cloud’s native LLM.
- A lightweight control plane orchestrates the deploy — no customer data at rest.
- Studio points at your VM: traces, logs and data explorers.
- Telemetry crosses the perimeter over a secure, signed channel.
- The CLI, the SDK and the HMAC contract — same code local and in your cloud.
The SDK you already write,
wired to your cloud’s own services.
Each sb.* surface maps to a managed service in your account — no new vendor, no data leaving your perimeter. The same code runs against the emulator locally and your cloud in production.
Infrastructure-as-code,
not artisanal setup.
Grant a scoped role
You create a minimal-privilege IAM role (AWS) or service principal (Azure / GCP). Stackbone never holds standing keys to your account.
IaC applies into your account
A versioned Terraform / Pulumi module provisions the VM and wires the native services — reproducible and reviewable, never hand-built.
The VM boots the deep-agents image
Docker runs the deep-agents image; your agents and workflows run on a durable World over your Postgres, inside your VPC.
Studio connects back
Point Studio at the VM and operate it like production — the same console you debug with locally under stackbone dev.
EC2 · RDS · S3 · Secrets Manager · Bedrock
VM · Azure DB · Blob · Key Vault · Azure OpenAI
GCE · Cloud SQL · GCS · Secret Manager · Vertex
The agent runs where your
data already lives.
Data residency by construction
Nothing at rest leaves your account. Residency and compliance are satisfied by where the agent runs — not by a promise.
Untrusted code, your perimeter
Tool execution is isolated in the VM (Docker / microVM). The blast radius is your own machine, behind your firewall.
Your keys, your bill
Your model key and your cloud invoices, billed to you directly. No Stackbone markup on compute or inference.
Reproducible, not artisanal
Every deploy is IaC from day one. Tear it down and stand it up again from the same module — no snowflake servers.
your cloud. your data. your bill. we just run the loop.
Deploy Stackbone into your own cloud.