Skip to main content

Every NeuralTrust deployment is made of the same three planes. A deployment model is only a decision about who runs each one — and that decides where your prompts and responses live, what you install, and what has to cross your network boundary.

Read this page once to get the concepts straight. Then pick a reference architecture and follow its install guide from top to bottom; each guide is written to be run in order, with a checklist of what to have ready before you start.

​
The three planes

Two properties hold in every model, and most of the install guides follow from them:
  • Configuration is pulled, never pushed. A data plane dials its control plane over outbound TLS and keeps serving its last-known-good configuration if that connection drops.
  • Raw payloads stay with the data plane. Prompts and responses are written to the PostgreSQL next to the data plane that handled them. What reaches the control plane is metadata: timings, verdicts, counts.

​
Who runs each plane

  • SaaS — NeuralTrust runs everything. Nothing to install and nothing in this section to follow.
  • Hybrid — you run the data plane, so payloads never leave your cluster; NeuralTrust runs the console and analytics. The most common choice, and the shortest install. → Hybrid
  • Self-hosted — you run every plane in your own cluster, console and analytics included. The chart calls this mode external. → Self-hosted
  • Central control plane — a self-hosted control plane that serves data planes in other clusters, for data that has to stay where it was produced. → Central control plane
The inference plane is the one plane every model shares by default. Running it in your own cluster is a single switch, global.firewall.deploy: true, and is what makes an air-gapped install possible — see Inference plane.

​
Regions

NeuralTrust operates its hosted planes in two regions, EU and US. Your tenant is provisioned in one of them, and everything NeuralTrust hosts for you follows it: Credentials are region-scoped: a token issued in one region does not authenticate in the other. A Hybrid data plane selects its region with one chart value, covered in Hybrid → Choose your region. A self-hosted install has no control plane to choose; its only regional dependency is the inference plane, and the firewall key NeuralTrust issues names the region.

​
Choose a model

Answer these in order and stop at the first yes.
1

Can NeuralTrust store your prompts and responses?

Use SaaS. There is nothing to deploy.
2

Must payloads stay in your environment, but NeuralTrust may run the console?

Use Hybrid. Only configuration requests and metadata reach NeuralTrust, and your cluster opens every one of those connections.
3

Must nothing depend on NeuralTrust SaaS at runtime — or is the cluster air-gapped?

Use Self-hosted. Add the in-cluster Firewall for no outbound dependency on NeuralTrust at all.
4

Do several clusters have to keep their own data, with one console over all of them?

Use the Central control plane.
Then decide the inference plane separately: keep the NeuralTrust-hosted Firewall, which is the default and the smallest footprint, unless your policy forbids text leaving your environment for scoring.

​
How every install goes

The guides differ in detail, but they all run the same six stages, in this order:

​
One chart for every model

NeuralTrust ships as a single umbrella Helm chart, neuraltrust-platform, with one value selecting the topology:
The value saas selects the Central control plane — a control plane that behaves like NeuralTrust’s hosted one but runs in your environment. It is the opposite of the hosted SaaS model, where there is nothing to install.

​
Compare in detail

​
The chart repository

The Helm chart is developed in the open at NeuralTrust/neuraltrust-platform. These pages are the task-oriented guide; the repository is the reference, and it is worth a look if you are the person actually running the platform. All of it also ships inside the chart artifact, so helm pull <chart-ref> --version <VERSION> --untar gives you the copy that matches the version you run — see Get the chart sources.

​
Where to go next

Reference architectures

The proven shapes, what crosses each boundary, and how big each one is.

Inference plane

The NeuralTrust-hosted Firewall in EU and US, and running it yourself.

Hybrid

Install the data plane in your cluster against NeuralTrust SaaS.

Self-hosted

Install every plane in your own cluster.

TrustGate data plane

Install only the gateway.

TrustGuard data plane

Install only the detection engine.
The model guides link into the shared reference pages — Requirements, Configuration, Container images, Secrets, Cloud notes, and Troubleshooting — where they need them. You do not have to read those first.