Deployment models: SaaS, PaaS, on-premise
ZEUS is deployed in three models. The choice depends on data sovereignty, the scope of compliance, and operational capacity — not on feature parity. Each model has the same 22 studios and the same connectors.
Comparison
| Criterion | Cloud SaaS | Managed PaaS | On-Premise |
|---|---|---|---|
| Hosting | shared ProfessNet cloud | dedicated ProfessNet VMs | the client's DC |
| Time-to-value | < 30 min | 1-3 business days | 1-2 business days |
| Updates | continuous CI/CD | coordinated window | quarterly signed tarball |
| DB isolation | shared (Postgres RLS) | dedicated DB instance | 100% sovereignty |
| Source code | none | none | available for audit |
| Who it's for | SMEs, cloud-first startups | banks, healthcare | critical infra, air-gapped |
Cloud SaaS — multi-tenant
ProfessNet hosts the central services; each client has a stateless, read-only
connector. Tenants share one hardened backend — data is isolated by
Postgres Row-Level Security on every table. Per-tenant subdomains
(acme.studio.zeus.io).
Managed PaaS — single-tenant
A dedicated VM cluster per client (backend/frontend/db/redis + separate VMs for the CNAPP scanners). Full isolation: a separate database, backup vault, DNS, Resource Group. Ideal for banks, healthcare, and sovereignty requirements.
On-Premise — air-gapped
The full platform on the client's hardware (Linux + Kubernetes). No outgoing telemetry, no inbound and outbound to ProfessNet. Updates via a quarterly, cryptographically verified tarball. The "Glass Box" model — code available for audit, no lock-in.
Seven layers of isolation (multi-tenant)
In the SaaS model, data isolation is "by construction" — seven independent
layers (each self-sufficient): the database (tenant_id filter), the cache (a Redis prefix),
secrets (per-tenant Key Vault), the API (a claim in the JWT), studio routing,
the ARQ task queue, and a per-tenant hash-chain audit log.
Sales tip: most of the competition is "SaaS only". Our differentiator is on-prem with code audit — crucial for regulated industries and the public sector.
This closes the ZEUS track. After these ten lessons you can explain the platform, run a demo, and operate it as an operator — in each of the three models.