Choose Your Deployment Model
Find the perfect deployment for your needs in 3 minutes - SaaS, On-Premise, or Hybrid
🔍 Get deployment recommendation
Quick Deployment Selector
Estimated time: 3 minutes What you'll get: Personalized deployment recommendation Requirements: Answer 4 simple questions
Answer These Questions
Question 1: What's your data sovereignty requirement? - A: Cloud OK (data can be in vendor infrastructure) - B: Must be on-premise (regulatory or policy requirement) - C: Hybrid (some data cloud, some on-premise)
Question 2: What's your operational preference? - A: Zero-ops (vendor manages everything) - B: Full control (we manage infrastructure) - C: Mixed (vendor control plane, we manage data plane)
Question 3: What's your volume? - A: < 500K operations/month - B: 500K - 5M operations/month - C: > 5M operations/month
Question 4: What's your network environment? - A: Internet-connected (cloud-friendly) - B: Air-gapped (no internet, classified) - C: Restricted (internet via proxy/firewall)
Your Recommendation
If you answered A, A, A, A (Cloud OK, Zero-ops, Low volume, Internet):
Recommended: SaaS (Fully Managed)
Cost: $1,250/month
Time to deploy: 5 minutes
Signup: https://app.ankatech.co/signup
If you answered B, B, C, A (On-premise, Full control, High volume, Internet):
Recommended: On-Premise
Cost: $40,000/year (license + infrastructure)
Time to deploy: 30 minutes (automated installer)
Request: https://ankatech.co/trial-onpremise
If you answered C, C, B, C (Hybrid data, Mixed ops, Medium volume, Restricted):
Recommended: Hybrid (SaaS control + on-prem data)
Cost: Custom (based on split)
Time to deploy: 1 hour
Contact: [email protected]
🎯 Want detailed comparison? Continue reading
Deployment Models Explained
SaaS (Fully Managed)
What it is: AnkaSecure hosted and managed by us, you just use the API
Architecture:
Your Application (anywhere)
↓ HTTPS
AnkaSecure SaaS (app.ankatech.co)
• We manage infrastructure
• We manage updates
• We manage scaling
• We manage security
What you manage: Nothing (zero-ops)
What we manage: Everything (infrastructure, updates, monitoring, backups)
Time to start: 5 minutes (API key signup)
On-Premise (Self-Hosted)
What it is: AnkaSecure deployed in YOUR data center or cloud account
Architecture:
Your Data Center / Private Cloud
├─ AnkaSecure Platform (you deploy)
├─ Your Infrastructure (you manage)
└─ Your Network (you control)
What you manage: Infrastructure, updates, scaling, backups
What we provide: Software, installation automation, support
Time to deploy: 30 minutes (automated installer)
Hybrid (Split Architecture)
What it is: AnkaSecure control plane (SaaS) + data plane (on-premise)
Architecture:
Your Data Center AnkaSecure Cloud
┌─────────────────┐ ┌──────────────────┐
│ Data Processing │◄────►│ Key Management │
│ (on-premise) │ mTLS │ (SaaS) │
│ │ │ │
│ • Encrypt/decrypt│ │ • Generate keys │
│ • Data never │ │ • Audit logs │
│ leaves network│ │ • Analytics │
└─────────────────┘ └──────────────────┘
What you manage: Data processing infrastructure
What we manage: Key management, audit logs, updates
Time to deploy: 1 hour (configure both components)
Detailed Comparison
Feature Matrix
| Feature | SaaS | On-Premise | Hybrid |
|---|---|---|---|
| Setup time | 5 minutes | 30 minutes | 1 hour |
| Infrastructure | We manage | You manage | Split |
| Scaling | Automatic | Manual | Automatic (control), Manual (data) |
| Updates | Automatic | Manual | Automatic (control), Manual (data) |
| Data location | Our cloud | Your datacenter | Your datacenter |
| Internet required | Yes | No (offline mode) | Yes (control plane) |
| Customization | Limited | Full | Medium |
| Cost model | Usage-based | Flat annual | Mixed |
| Multi-region | ✅ Built-in | ✅ DIY | ✅ Built-in (control) |
Cost Comparison
Scenario: 1M operations/month
| Model | Monthly Cost | Annual Cost | Includes |
|---|---|---|---|
| SaaS | $1,250 | $15,000 | Infrastructure, updates, support, scaling |
| On-Premise | $3,333 | $40,000 | License ($25K) + infrastructure ($15K) |
| Hybrid | $2,000 | $24,000 | Control plane ($12K) + data plane ($12K) |
Break-even (SaaS vs On-Premise): - < 500K ops/month: SaaS cheaper - > 500K ops/month: On-premise cheaper
Use Case Fit
When to Choose SaaS
Perfect for: - ✅ Startups and small teams (< 10 developers) - ✅ Rapid prototyping (need to start TODAY) - ✅ Unpredictable workload (auto-scaling) - ✅ No DevOps resources (zero operational burden) - ✅ Multi-region deployment (US, EU, Asia) - ✅ Low-to-medium volume (< 5M ops/month)
Example: SaaS platform encrypting customer data
# Sign up in 5 minutes
https://app.ankatech.co/signup
# Start encrypting immediately
curl -X POST https://api.ankatech.co/encrypt \
-H "Authorization: Bearer $API_KEY" \
-d '{"algorithm":"ML_KEM_1024","plaintext":"..."}'
Cost: $1,250/month (up to 1M ops) - cheaper than hiring DevOps engineer
When to Choose On-Premise
Perfect for: - ✅ Federal/government (FISMA, FedRAMP, data residency) - ✅ Regulated industries (financial, healthcare, defense) - ✅ High-volume (> 5M ops/month) - cost optimization - ✅ Data sovereignty (must control infrastructure) - ✅ Air-gapped networks (classified, SCIF) - ✅ Custom HSMs (Luna, nShield integration)
Example: Defense contractor, classified data
# Deploy in air-gapped SCIF
# No internet required after initial download
sudo ankasecure-install --mode offline --domain classified.local
Cost: $40,000/year (unlimited operations) - cheaper than SaaS at scale
ROI: 10M ops/month = $360K SaaS vs $40K on-prem (save $320K/year)
When to Choose Hybrid
Perfect for: - ✅ Large enterprises (need both control and convenience) - ✅ Multi-datacenter (centralized key management) - ✅ Gradual cloud migration (keep data on-prem temporarily) - ✅ Compliance + agility (data residency + managed services) - ✅ Geographic distribution (global operations)
Example: Global bank with regional data centers
US Data Center → AnkaSecure Data Plane (on-prem)
EU Data Center → AnkaSecure Data Plane (on-prem)
Asia Data Center → AnkaSecure Data Plane (on-prem)
↓
All connect to → AnkaSecure Control Plane (SaaS)
• Centralized key management
• Unified audit logs
• Global analytics
Benefit: Data stays local (compliance), management centralized (efficiency)
Deployment Timeline
SaaS (5 Minutes)
Step 1: Sign up (2 minutes) - Email, company name, password - Email verification
Step 2: Get API key (1 minute) - Dashboard → API Keys → Generate
Step 3: Test encryption (2 minutes)
curl -X POST https://api.ankatech.co/encrypt \
-H "Authorization: Bearer $API_KEY" \
-d '{"algorithm":"ML_KEM_1024","plaintext":"test"}'
✅ Total: 5 minutes to first encryption
On-Premise (30 Minutes)
Step 1: Register for trial (5 minutes) - Email, company, use case - Receive installer download link
Step 2: Download installer (5 minutes)
Step 3: Run automated installation (15 minutes)
Step 4: Verify health (5 minutes)
✅ Total: 30 minutes to production-ready platform
Hybrid (1 Hour)
Step 1: Deploy on-premise data plane (30 minutes) - Follow on-premise installation above
Step 2: Connect to SaaS control plane (20 minutes)
# Configure mTLS connection to control plane
ankasecure-admin configure-hybrid \
--control-plane https://control.ankatech.co \
--tenant-id your-tenant-id \
--mtls-cert /path/to/client-cert.pem
Step 3: Verify hybrid communication (10 minutes)
# Test key generation (control plane)
curl -X POST https://control.ankatech.co/keys \
-H "Authorization: Bearer $TOKEN" \
-d '{"algorithm":"ML_KEM_1024"}'
# Test encryption (data plane, on-prem)
curl -X POST https://data.your-company.local/encrypt \
-d '{"keyId":"mlkem-001","plaintext":"test"}'
✅ Total: 1 hour to hybrid architecture
Compliance by Deployment
Federal Compliance
| Requirement | SaaS | On-Premise | Hybrid |
|---|---|---|---|
| FISMA | ⏳ FedRAMP pending | ✅ Yes (your ATO) | ⚠️ Depends |
| FIPS 140-2 | ✅ Yes | ✅ Yes | ✅ Yes |
| Data residency | ⚠️ Limited regions | ✅ Full control | ✅ Data on-prem |
| Air-gapped | ❌ No | ✅ Yes | ❌ No (needs internet) |
| CNSA 2.0 | ✅ Yes | ✅ Yes | ✅ Yes |
Recommendation for federal: On-premise (until FedRAMP authorized)
Industry Compliance
| Requirement | SaaS | On-Premise | Hybrid |
|---|---|---|---|
| PCI DSS | ✅ Yes | ✅ Yes | ✅ Yes |
| HIPAA | ✅ Yes (BAA required) | ✅ Yes | ✅ Yes |
| GDPR | ✅ Yes (EU region) | ✅ Yes | ✅ Yes |
| SOC 2 | ⏳ Q4 2026 | N/A (your controls) | Mixed |
Recommendation for regulated: SaaS (BAA for HIPAA) or On-premise (full control)
Migration Between Deployment Models
SaaS to On-Premise
Scenario: Started with SaaS, now need on-premise for compliance
Migration steps:
Step 1: Deploy on-premise instance (parallel)
Step 2: Export keys from SaaS
Step 3: Import keys to on-premise
curl -X POST https://onprem.your-company.local/keys/import-bulk \
-H "Authorization: Bearer $ONPREM_TOKEN" \
-F "[email protected]"
Step 4: Gradual traffic shift (2-4 weeks) - Week 1: 25% to on-prem - Week 2: 50% to on-prem - Week 3: 75% to on-prem - Week 4: 100% cutover, cancel SaaS
Zero data re-encryption needed (keys are portable!)
On-Premise to Hybrid
Scenario: Have on-premise, want centralized management
Migration steps:
Step 1: Enable hybrid mode (10 minutes)
Step 2: Migrate key management to control plane (30 minutes) - Keys stay on-premise (data plane) - Key generation/rotation moves to SaaS (control plane)
Step 3: Verify split (5 minutes)
# Key operations go to control plane
curl https://control.ankatech.co/keys
# Data operations stay on-premise
curl https://data.your-company.local/encrypt
Timeline: 1-2 hours total
Cost Optimization Guide
Find Your Break-Even Point
Cost comparison by volume:
| Operations/Month | SaaS Cost | On-Prem Cost | Cheaper Option | Savings |
|---|---|---|---|---|
| 100K | $1,250 | $3,333 | ✅ SaaS | $2,083/mo |
| 500K | $1,250 | $3,333 | ✅ SaaS | $2,083/mo |
| 1M | $1,250 | $3,333 | ✅ SaaS | $2,083/mo |
| 2M | $2,500 | $3,333 | ✅ SaaS | $833/mo |
| 5M | $3,500 | $3,333 | ✅ On-Prem | -$167/mo |
| 10M | $6,000 | $3,333 | ✅ On-Prem | -$2,667/mo |
| 50M | $15,000 | $3,333 | ✅ On-Prem | -$11,667/mo |
Break-even: ~3M operations/month
Rule of thumb: - < 3M ops/month → SaaS (lower cost + zero-ops) - > 3M ops/month → On-Premise (cost optimization)
Hidden Costs to Consider
SaaS hidden costs (or lack thereof): - ✅ $0 - Infrastructure (we manage) - ✅ $0 - DevOps time (zero-ops) - ✅ $0 - Updates (automatic) - ✅ $0 - Backups (included) - ✅ $0 - Monitoring (included)
Total SaaS cost: Transparent (what you see is what you pay)
On-Premise hidden costs: - ⚠️ $15,000/year - Infrastructure (servers, storage, network) - ⚠️ $24,000/year - DevOps time (20 hours/month @ $100/hour) - ⚠️ $5,000/year - Backups (storage, testing) - ⚠️ $3,000/year - Monitoring (tools, dashboards)
Total on-prem cost: $25K license + $47K operational = $72K/year
BUT: For high volume (10M ops/month), on-prem still cheaper ($72K vs $90K SaaS)
AND: Operational costs decrease with expertise (automation, optimization)
Decision Matrix
By Organization Size
Startup (< 20 employees): - ✅ SaaS - Zero DevOps burden, fast iteration, pay-as-you-grow
SMB (20-500 employees): - ✅ SaaS if low volume (< 5M ops/month) - ✅ On-Premise if compliance requires (HIPAA, ITAR)
Enterprise (500+ employees): - ✅ On-Premise if high volume (> 5M ops/month) - ✅ Hybrid if multi-datacenter (global operations)
Federal/Government: - ✅ On-Premise (data sovereignty, air-gapped) - ⏳ SaaS after FedRAMP (Q4 2027)
By Industry
Financial Services: - ✅ On-Premise (data sovereignty, cost at scale) - ✅ Hybrid (cloud control plane + on-prem data)
Healthcare: - ✅ SaaS with BAA (smaller practices) - ✅ On-Premise (large hospital systems)
Technology/SaaS: - ✅ SaaS (focus on product, not infrastructure)
Government/Defense: - ✅ On-Premise (classified, air-gapped)
Manufacturing/IoT: - ✅ Hybrid (edge data processing + cloud analytics)
Performance by Deployment
Latency Comparison
| Deployment | Encryption Latency | Notes |
|---|---|---|
| SaaS (same region) | 3ms crypto + 5ms network = 8ms | Typical |
| SaaS (cross-region) | 3ms crypto + 50ms network = 53ms | High latency |
| On-Premise (local) | 3ms crypto + 0.1ms network = 3.1ms | Fastest |
| Hybrid | 3ms crypto + 5ms control + 0.1ms data = 8.1ms | Moderate |
Winner for latency: On-premise (direct connection, no internet round-trip)
When latency matters: High-frequency trading, real-time APIs, interactive applications
Throughput Comparison
| Deployment | Max Throughput | Scaling |
|---|---|---|
| SaaS | 12,000 ops/sec (12 nodes) | Automatic (elastic) |
| On-Premise | Unlimited (add nodes) | Manual |
| Hybrid | Hybrid (control limited, data unlimited) | Mixed |
Winner for throughput: On-premise (no artificial limits)
When throughput matters: Batch processing, bulk encryption, high-volume SaaS
Deployment Specifications
SaaS Infrastructure (Managed by Us)
Regions: - 🇺🇸 US East (Virginia) - 🇺🇸 US West (California) - 🇪🇺 EU (Frankfurt) - 🇸🇬 Asia Pacific (Singapore)
Architecture (per region): - Load balancer (automatic failover) - 3-6 application nodes (auto-scaling) - PostgreSQL cluster (3 nodes, streaming replication) - Redis cluster (6 nodes, Sentinel HA) - Encrypted backups (daily, 30-day retention)
SLA: 99.9% uptime (8.7 hours downtime/year max)
On-Premise Requirements
Minimum (evaluation): - 1 server: 8 cores, 16 GB RAM, 100 GB SSD - Supports: ~1,000 ops/sec, 100 concurrent users
Recommended (production): - 3 servers: 16 cores each, 32 GB RAM, 200 GB NVMe SSD - Supports: ~10,000 ops/sec, 1,000 concurrent users - High availability (3-node cluster)
Enterprise (high-volume): - 10-50 servers: 32 cores each, 128 GB RAM, 500 GB NVMe - Supports: 100,000+ ops/sec, 10,000+ users - Multi-datacenter (geographic redundancy)
Data Sovereignty & Compliance
Data Location by Deployment
SaaS: - ✅ Choose region (US, EU, Asia) - ⚠️ Data stored in AnkaSecure infrastructure - ✅ Encrypted at rest (AES-256) - ⚠️ We have physical access (trusted vendor model)
On-Premise: - ✅ Data in YOUR datacenter (full control) - ✅ YOU have physical access (zero trust to vendor) - ✅ Custom storage (your SAN, NAS, cloud block storage)
Hybrid: - ✅ Data in YOUR datacenter (encrypted data never leaves) - ✅ Keys in AnkaSecure SaaS (managed by us) - ⚠️ We manage keys, you manage data (split trust)
Regulatory Alignment
GDPR (EU data protection): - SaaS: Use EU region (Frankfurt) - On-Premise: Deploy in EU datacenter - Hybrid: Data plane in EU
HIPAA (US healthcare): - SaaS: Business Associate Agreement (BAA) required - On-Premise: Your responsibility (no BAA needed) - Hybrid: BAA for control plane
FedRAMP (US federal): - SaaS: ⏳ Authorization in progress (Q4 2027) - On-Premise: ✅ Your ATO (we provide documentation) - Hybrid: Not applicable (on-prem recommended for federal)
What's Next?
Ready to choose your deployment? - 🔍 Interactive selector (3-minute quiz) - 📊 Cost calculator (compare all 3 options) - 📥 Download comparison guide (PDF, 15 pages) - 📧 Schedule architecture review (free 1-hour session)
Start your deployment: - 🚀 SaaS trial (5 minutes, no credit card) - 📥 On-premise trial (30 minutes, full features) - 📧 Hybrid setup (custom architecture)
Explore deployment details: - On-premise overview - Full deployment guide - SaaS overview - Managed service details - Performance by deployment - Latency comparison
Have questions? Email [email protected] or join our community forum
Last updated: 2026-01-07 | SaaS regions: US, EU, Asia | On-premise: Unlimited deployment