Private VPC deployment

A private VPC deployment is a way of buying software in which the vendor's application, databases and storage run inside the customer's own cloud account, within a virtual private cloud (VPC) the customer controls, rather than in the vendor's shared, multi-tenant environment. On AWS, a VPC lets you "launch AWS resources in a logically isolated virtual network that you've defined" (AWS, What is Amazon VPC?), so network rules, encryption keys, logging and backups follow the customer's own policies.

Regulated buyers choose it for control and evidence. Security and third-party risk teams can inspect the network boundary, apply their existing monitoring, and answer auditors' questions about where records are stored and who can reach them without relying only on a vendor's attestations. In return, the customer's platform team shares operational work such as capacity and upgrades, rollout takes longer than signing up for a hosted service, and the price reflects dedicated infrastructure.

"Private" does not mean disconnected. Many deployments still make outbound calls, for licensing, updates or AI model inference, and a buyer should get the list of outbound destinations in writing. RegWatch's Private VPC option, for example, runs the full data plane in the customer's own cloud account (on AWS, that is Amazon EKS; Azure, Google Cloud, IBM Cloud and Oracle Cloud work too) and still requires outbound HTTPS to model providers. Useful questions for any vendor: which components run in your account and which stay with the vendor; what data leaves the VPC, and why; who holds administrative access and how that access is logged; and how upgrades are delivered and tested. The answers belong in the vendor file next to the role-based access model and the audit log design. The tools comparison notes which regulatory intelligence vendors describe a private deployment on their public pages.