> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment Overview

> Choose how and where to run Enclave — from a fully-managed SaaS to a fully air-gapped on-premise appliance. In every model, Kvelden never holds your keys.

Enclave runs the same platform across every deployment model. What changes is **where the infrastructure lives** and **who operates it** — not the encryption model. Pick the model that matches your compliance, data-residency, and network-isolation requirements.

<Info>
  Across all models, files are encrypted with keys you control, and
  **Zero-Knowledge / ZK-Strict rooms** are undecryptable by the server. In
  self-hosted / appliance models Kvelden operates nothing and has no access at
  all; in SaaS, Kvelden-operated servers can decrypt Envelope/personal files
  server-side to serve your downloads and enabled workflows. The deployment model
  changes where the servers, storage, and keys physically reside.
</Info>

## Choose a deployment model

<CardGroup cols={2}>
  <Card title="SaaS (Cloud)" icon="cloud" href="/deployment/saas">
    Kvelden-hosted and fully managed. Zero infrastructure to run — the fastest way to get started.
  </Card>

  <Card title="Private Cloud (VPC)" icon="network-wired" href="/deployment/private-cloud">
    Enclave deployed inside your own cloud account and VPC. Your network perimeter, your storage.
  </Card>

  <Card title="On-Premise" icon="server" href="/deployment/on-premise">
    Run Enclave entirely within your own data centre, under your operational control.
  </Card>

  <Card title="Air-Gapped" icon="shield-halved" href="/deployment/air-gapped">
    No external network connectivity — for classified, regulated, and sovereign environments.
  </Card>
</CardGroup>

## Comparison

| Model                   | Infrastructure operated by | Best for                                                            |
| ----------------------- | -------------------------- | ------------------------------------------------------------------- |
| **SaaS**                | Kvelden                    | Teams that want to start immediately with no infrastructure         |
| **Private Cloud (VPC)** | You (your cloud account)   | Cloud-first organisations that need data inside their own VPC       |
| **On-Premise**          | You (your data centre)     | Data-residency or regulatory requirements that mandate self-hosting |
| **Air-Gapped**          | You (isolated network)     | Classified / sovereign environments with no internet egress         |

<Note>
  On-premise and air-gapped deployments ship as the [Private Virtual Appliance (OVA)](/deployment/private-appliance) — a signed, pre-packaged image you import into your own virtualization platform.
</Note>

## The Private Virtual Appliance (OVA)

The self-hosted models are delivered as a hardened OVA you import into VMware, Hyper-V, or KVM. After importing, you complete a guided setup for networking, TLS, identity, licensing, keys, and storage.

<CardGroup cols={2}>
  <Card title="Appliance Overview" icon="box" href="/deployment/private-appliance">
    What the OVA contains, sizing, and the import process.
  </Card>

  <Card title="First-Run Setup" icon="wand-magic-sparkles" href="/deployment/appliance/first-run">
    The guided first-boot wizard: hostname, admin account, and initial configuration.
  </Card>

  <Card title="TLS Certificates" icon="lock" href="/deployment/appliance/tls">
    Install your own TLS certificate or use the built-in certificate authority.
  </Card>

  <Card title="LDAP / Active Directory" icon="users" href="/deployment/appliance/ldap">
    Connect the appliance to your directory for single sign-on.
  </Card>

  <Card title="Licensing" icon="key" href="/deployment/appliance/licensing">
    Activate the appliance with a signed offline license — no phone-home required.
  </Card>

  <Card title="Key Management" icon="shield-halved" href="/deployment/appliance/kms">
    Set the appliance-wide KMS: the built-in master key, or your own HSM via KMIP.
  </Card>
</CardGroup>

## Before you begin

Regardless of model, have the following ready:

* **Owner** access to complete the initial setup
* Your **identity provider** details (if using LDAP / Active Directory SSO)
* Your **KMS or HSM** connection details if you intend to bring your own keys — see [Key Management](/enclave/key-management)
* Your **object storage** details (bucket, region, credentials) for self-hosted models — see [Storage](/enclave/storage)

Once deployed, continue to the [Platform Guide](/enclave/overview) to configure secure rooms, encryption policies, and access control.