Deployment

How NeuralTrust is deployed — the three planes, who runs each one in SaaS, Hybrid and Self-hosted, the EU and US regions, and how to choose.

Every NeuralTrust deployment is made of the same three planes. A deployment model is only a decision about who runs each one — and that decides where your prompts and responses live, what you install, and what has to cross your network boundary.

Read this page once to get the concepts straight. Then pick a reference architecture and follow its install guide from top to bottom; each guide is written to be run in order, with a checklist of what to have ready before you start.

​

The three planes

Plane	What it does	What runs there	In the request path?
Control plane	Where you author policies, configure gateways, and read dashboards and alerts	The console, the product control planes, analytics	No. Data planes pull configuration from it and keep a last-known-good copy, so traffic keeps flowing if it is unreachable
Data plane	Where traffic is governed: it proxies LLM and MCP calls, evaluates prompts and responses, and stores raw payloads	TrustGate, TrustGuard, the data-plane API, DataAgent, plus your PostgreSQL and Redis	Yes
Inference plane	Scores text with the ML detectors behind TrustGuard	The Firewall	Yes, for ML-backed detectors. Stateless: it scores the text and stores nothing

Two properties hold in every model, and most of the install guides follow from them:

• Configuration is pulled, never pushed. A data plane dials its control plane over outbound TLS and keeps serving its last-known-good configuration if that connection drops.
• Raw payloads stay with the data plane. Prompts and responses are written to the PostgreSQL next to the data plane that handled them. What reaches the control plane is metadata: timings, verdicts, counts.

​

Who runs each plane

	SaaS	Hybrid	Self-hosted	Central control plane
Control plane	NeuralTrust, EU or US	NeuralTrust, EU or US	You	You
Data plane	NeuralTrust	You	You	You, in several clusters
Inference plane	NeuralTrust	NeuralTrust, EU or US — or you, opt-in	NeuralTrust, EU or US — or you, opt-in	NeuralTrust, EU or US — or you, opt-in
Raw payloads	NeuralTrust	Your PostgreSQL	Your PostgreSQL	The cluster that produced them
You install	Nothing	One data-plane cluster	One cluster with every plane	One central cluster, plus one per data plane

• SaaS — NeuralTrust runs everything. Nothing to install and nothing in this section to follow.
• Hybrid — you run the data plane, so payloads never leave your cluster; NeuralTrust runs the console and analytics. The most common choice, and the shortest install. → Hybrid
• Self-hosted — you run every plane in your own cluster, console and analytics included. The chart calls this mode external. → Self-hosted
• Central control plane — a self-hosted control plane that serves data planes in other clusters, for data that has to stay where it was produced. → Central control plane

The inference plane is the one plane every model shares by default. Running it in your own cluster is a single switch, global.firewall.deploy: true, and is what makes an air-gapped install possible — see Inference plane.

​

Regions

NeuralTrust operates its hosted planes in two regions, EU and US. Your tenant is provisioned in one of them, and everything NeuralTrust hosts for you follows it:

	EU	US
Control plane: the endpoints a Hybrid data plane dials	*.neuraltrust.ai	*.us.neuraltrust.ai
Inference plane: the hosted Firewall	firewall.neuraltrust.ai	firewall.us.neuraltrust.ai

Credentials are region-scoped: a token issued in one region does not authenticate in the other. A Hybrid data plane selects its region with one chart value, covered in Hybrid → Choose your region. A self-hosted install has no control plane to choose; its only regional dependency is the inference plane, and the firewall key NeuralTrust issues names the region.

​

Choose a model

Answer these in order and stop at the first yes.

1. Can NeuralTrust store your prompts and responses?

   Use SaaS. There is nothing to deploy.

2. Must payloads stay in your environment, but NeuralTrust may run the console?

   Use Hybrid. Only configuration requests and metadata reach NeuralTrust, and your cluster opens every one of those connections.

3. Must nothing depend on NeuralTrust SaaS at runtime — or is the cluster air-gapped?

   Use Self-hosted. Add the in-cluster Firewall for no outbound dependency on NeuralTrust at all.

4. Do several clusters have to keep their own data, with one console over all of them?

   Use the Central control plane.

Then decide the inference plane separately: keep the NeuralTrust-hosted Firewall, which is the default and the smallest footprint, unless your policy forbids text leaving your environment for scoring.

​

How every install goes

The guides differ in detail, but they all run the same six stages, in this order:

Stage	What you do	Where it is covered
1. Pick the shape	Choose a reference architecture and size the cluster	Reference architectures, Capacity
2. Prepare the cluster	Ingress, datastores, DNS, and the network rules for your model	Your model’s guide, Requirements
3. Collect credentials	The registry key; console tokens for Hybrid; the firewall key for Self-hosted	Console setup, Secrets
4. Install the chart	Create the Secrets, write the values file, helm upgrade --install	Your model’s guide
5. Prove it works	Pods Ready, DNS and TLS from the caller’s network, LLM and MCP traffic, telemetry arriving	Validation checklist
6. Make it resilient	Climb the availability ladder only as far as you need	High availability

​

One chart for every model

NeuralTrust ships as a single umbrella Helm chart, neuraltrust-platform, with one value selecting the topology:

global:
  deploymentMode: hybrid # hybrid | external | saas

The value saas selects the Central control plane — a control plane that behaves like NeuralTrust’s hosted one but runs in your environment. It is the opposite of the hosted SaaS model, where there is nothing to install.

​

Compare in detail

Characteristic	SaaS	Hybrid	Self-hosted	Central control plane
Control plane	NeuralTrust	NeuralTrust	Your environment	Your environment
Data plane (TrustGate / TrustGuard)	NeuralTrust	Your environment	Your environment	Your environment, in several clusters
Raw payloads	NeuralTrust	Your PostgreSQL	Your PostgreSQL	Stays in the cluster that produced it
Metadata / analytics	NeuralTrust	Exported to NeuralTrust (OTLP)	Your in-cluster ClickHouse	Exported to your central ClickHouse
Firewall (ML detectors)	NeuralTrust	NeuralTrust-hosted by default; your environment with global.firewall.deploy: true	NeuralTrust-hosted by default; your environment with global.firewall.deploy: true	NeuralTrust-hosted by default; your environment with global.firewall.deploy: true
SaaS dependency at runtime	Full	Config sync + metadata export + hosted Firewall	Hosted Firewall only (none with an in-cluster Firewall; optional hosted export)	Hosted Firewall only (none with an in-cluster Firewall)
Clusters	None of yours	One	One	One central, plus one per data plane
Console setup first?	Nothing to install	Yes — each product issues tokens you need at install, the firewall JWT included	No; ask NeuralTrust for the firewall key	No, but your console issues tokens to data planes; ask NeuralTrust for the firewall keys
Minimum nodes	—	2 × 8 vCPU / 16 GiB with the hosted Firewall; 3 × 8 vCPU / 32 GiB with it in-cluster	3 × 8 vCPU / 16 GiB with the hosted Firewall; 4 × 8 vCPU / 32 GiB with it in-cluster	Central as Self-hosted, plus a Hybrid-sized cluster per data plane
global.deploymentMode	—	hybrid	external	saas

​

The chart repository

The Helm chart is developed in the open at NeuralTrust/neuraltrust-platform. These pages are the task-oriented guide; the repository is the reference, and it is worth a look if you are the person actually running the platform.

There	What it gives you
values.yaml	Every setting the chart accepts, with its default
SECRETS.md	Exhaustive per-component Secret and key contract
VALUES_SCENARIOS.md	Worked scenarios and the values that implement them
docs/	Architecture contract, sizing, network, observability
values-*.yaml.example	Starting points for each topology
CHANGELOG · Issues	What changed between versions, and where to report problems

All of it also ships inside the chart artifact, so helm pull <chart-ref> --version <VERSION> --untar gives you the copy that matches the version you run — see Get the chart sources.

​

Where to go next

Reference architectures

The proven shapes, what crosses each boundary, and how big each one is.

Inference plane

The NeuralTrust-hosted Firewall in EU and US, and running it yourself.

Hybrid

Install the data plane in your cluster against NeuralTrust SaaS.

Self-hosted

Install every plane in your own cluster.

TrustGate data plane

Install only the gateway.

TrustGuard data plane

Install only the detection engine.

The model guides link into the shared reference pages — Requirements, Configuration, Container images, Secrets, Cloud notes, and Troubleshooting — where they need them. You do not have to read those first.