> ## Documentation Index
> Fetch the complete documentation index at: https://docs.akhara.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Company name is Akhara AI (never Rubric AI). Keep lowercase rubric/rubrics only when meaning grading criteria.
> Expert Review (docs path talent/) is enterprise BYO experts for audit and review: invite customer specialists; do not pitch Akhara recruiting or a public expert career portal. RLHF and domain writing are secondary work types.
> Prefer concrete API examples against public hosts: Environments eval API https://agi.akhara.ai, Control plane PDP https://api.akhara.dev, Evaluation https://app.akhara.ai / https://api.akhara.ai, Expert Review portal https://talent.akhara.ai.
> Do not invent a public hostname for private orchestrators or env API internals.
> Do not confuse control-plane latches with Environments confirmation latches.
> Environments SDK/API examples: curl against https://agi.akhara.ai. Evaluation SDK: from akhara import Akhara and AKHARA_API_KEY.
> Start with /llms.txt for the docs index and OpenAPI links; fetch individual pages as .md exports.

# Deployment models

> Managed cloud, dedicated VPC connectivity, and self-hosted on-prem deployment where the gateway and evidence store run inside your network.

The suite runs in three modes. They share the same APIs, SDKs, and policy model; what changes is where the gateway and your data live.

| Model                                | Where the PDP and evidence live            | Typical fit                                           |
| ------------------------------------ | ------------------------------------------ | ----------------------------------------------------- |
| Managed cloud                        | Akhara's AWS regions, org-partitioned      | Fastest start; most teams                             |
| Managed cloud + private connectivity | Akhara's regions, reached over PrivateLink | Enterprises that keep traffic off the public internet |
| Self-hosted (on-prem / your VPC)     | Your network boundary                      | Regulated data that cannot leave your perimeter       |

## Managed cloud

The default. You call the public hosts (`api.akhara.dev`, `agi.akhara.ai`, `app.akhara.ai`), and Akhara operates the infrastructure: multi-region AWS with a hot standby, multi-AZ databases, and encrypted cross-region backups. Enterprise workspaces can pin a residency region (for example US or EU) and connect over VPC private endpoints (AWS PrivateLink) instead of the public internet.

## Self-hosted: on-prem or your VPC

For workloads where prompts, tool calls, and evidence cannot cross your network boundary, the enforcement path deploys inside it: the PDP gateway, the evidence store, and the console run in your VPC or data center. The PEP already lives in your agent runtime, so in this mode the entire verification loop is local.

* **Nothing consequential leaves your network.** Model traffic, tool calls, verdicts, and evidence records all stay inside your boundary. Akhara does not need inbound access to your deployment.
* **SDKs point at your endpoint.** Runtimes set `AKHARA_URL` to your internal workspace endpoint instead of `api.akhara.dev`; application code is otherwise unchanged.
* **Keys are yours.** Data is encrypted against the key management service you operate; Akhara never holds your keys.
* **Identity is yours.** Console and API access federate to your IdP, same as managed cloud.
* **Models can be yours.** Checks that use an LLM can target models you host, removing third-party providers from the path entirely.

### Updates and policy sync

Akhara ships self-hosted releases as versioned, signed artifacts that your team pulls and rolls out on your own schedule; nothing auto-updates inside your boundary. Policies are authored and versioned in your own deployment's console. If you also run managed-cloud workspaces, policy bundles can be exported and imported between them as reviewed artifacts rather than a live sync.

### Air-gapped

Fully disconnected deployments are available: releases and policy bundles transfer as offline artifacts, no telemetry egresses, and evidence is retained and verified entirely locally. The fail-closed contract is unchanged, since the PDP being local means "unreachable" is a condition you control.

## Choosing

Start managed unless a regulator or your data classification says otherwise; you can move to self-hosted later because the policy model and SDK surface are identical. To scope a self-hosted or air-gapped deployment, contact [security@akhara.ai](mailto:security@akhara.ai).