> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Private Cloud (VPC)

> Deploy Enclave inside your own cloud account — your VPC, your network perimeter.

## Overview

Private cloud deployment runs Enclave inside your AWS, Azure, or GCP account. Kvelden provides the software; you provide the infrastructure. Network traffic never leaves your VPC.

## Architecture

```
Your VPC
├── Load Balancer (ALB / Azure Front Door / Cloud Load Balancing)
├── Enclave application servers (ECS / AKS / GKE)
├── Managed database (RDS PostgreSQL / Azure Database / Cloud SQL)
├── Object storage (S3 / Azure Blob / GCS) — for ciphertext
└── KMS (your existing CMKs)
```

Kvelden provides a Terraform module that provisions all components.

## Prerequisites

* Cloud account with sufficient IAM permissions to deploy the Terraform module
* PostgreSQL 14+ compatible managed database (or let Terraform create one)
* Object storage bucket
* A KMS CMK for Enclave's DEK wrapping

The Terraform module configures the bucket's CORS policy for pre-signed
browser uploads automatically, using the `domain` variable as the allowed
origin. See [Object storage CORS](/deployment/on-premise#object-storage-cors)
if you need to adjust it manually (e.g. for a custom domain added after
deployment).

## Deployment steps

<Steps>
  <Step title="Clone the Terraform module">
    ```bash theme={null}
    git clone https://github.com/kveldentech/enclave-terraform
    cd enclave-terraform/aws  # or /azure or /gcp
    ```
  </Step>

  <Step title="Configure variables">
    ```hcl theme={null}
    # terraform.tfvars
    region          = "ap-south-1"
    domain          = "enclave.yourcompany.com"
    kms_key_arn     = "arn:aws:kms:ap-south-1:123456789:key/..."
    db_instance     = "db.r6g.large"
    app_instance    = "t3.medium"
    ```
  </Step>

  <Step title="Apply">
    ```bash theme={null}
    terraform init
    terraform plan
    terraform apply
    ```
  </Step>

  <Step title="Point your DNS">
    Add a CNAME record for `enclave.yourcompany.com` pointing to the load balancer output by Terraform.
  </Step>

  <Step title="Activate your licence">
    Contact [hello@kvelden.com](mailto:hello@kvelden.com) with your deployment ID (shown in Terraform output) to receive a licence key.
  </Step>
</Steps>

## Updates

Enclave releases are published to Kvelden's container registry. Update by pulling the latest image tag and redeploying:

```bash theme={null}
terraform apply -var="enclave_version=1.4.0"
```

Migrations run automatically on startup. Always back up the database before updating.