Pick the deployment model by what the platform will hold and who must be kept out. SaaS suits most teams with ordinary data. A private VPC adds isolation. On-prem keeps everything in your network. Air-gapped is for environments with no outside connection. Each trades control against effort.
The four models
SaaS. The vendor runs it, you use it over the internet. Fastest to start, least to operate, and the vendor holds your data.
Private VPC or dedicated tenancy. A single tenant environment, often in the vendor's cloud account or yours, separated from other customers. More isolation, some added cost and effort.
On-prem. The platform runs in your own data centre or infrastructure. Your team patches and operates it, and the vendor sees only what you send.
Air-gapped. The platform runs with no connection to the internet. Updates and advisory data arrive through a controlled transfer. This is the highest control and the most work. See can a security scanner run offline or air-gapped.
Decide by data class
| Your situation | Leans toward |
|---|---|
| Public or low sensitivity code, small team | SaaS |
| Proprietary code, no strict residency rule | SaaS or private VPC |
| Need isolation from other tenants, audit asks about it | Private VPC |
| Contract or policy forbids code leaving your network | On-prem |
| Regulated or classified environment with no internet | Air-gapped |
| Mixed estate | Hybrid: analyse locally, send results only |
The hybrid row deserves a note. Many teams run analysis inside their own CI, where the code already is, and send only findings to a cloud service. That keeps source in place and limits what the vendor holds. See cloud scanning vs hybrid scanning.
Questions that settle it
- What is the most sensitive thing the platform will touch: source, findings, credentials or personal data?
- Does any contract, regulator or customer restrict where that data may sit?
- Do we have the people to patch and run a self-hosted system?
- How quickly do we need advisory and zero day data, and can we receive it in our model?
- What is the exit plan if we change vendors?
Question 3 is the one teams skip. A self-hosted platform that is not patched becomes its own risk. Include operating cost in the comparison, not just licence cost.
Do not confuse deployment with certification
A deployment model is a capability, not an assurance. Hosting something in your own network says where data sits. It does not say anything about audits or attestations. Ask for those separately and read what they cover.
How Safeguard fits
Safeguard supports SaaS, private VPC or dedicated tenancy, on-prem and air-gapped deployment, so you can start with one model and move if your needs change. You can try the free scan before choosing.
Quick check
Is on-prem always more secure than SaaS?
No. It gives you control over where data sits, but you take on patching and operations. A well run service can be safer than a neglected self-hosted one.
Can I switch models later?
Often, but ask about migration of findings, policies and history before you sign.
Last reviewed: 19 October 2026.
