Name: iShield Link
Brand: iShield

Question 1

What is the difference between SaaS, Hybrid and On-Prem at iShield?

Accepted Answer

Managed SaaS runs entirely in iShield's cloud with logical tenant isolation and region pinning. Hybrid splits the architecture: the control plane (orchestration, UI, metadata) stays in iShield cloud, while the data plane (your records, files, processing) runs inside your own VPC. On-Prem deploys the same binary into your datacenter — including fully air-gapped environments with no outbound connectivity. All three share the same code, APIs and upgrade path.

Question 2

How does region pinning work, and can it be enforced per record or per flow?

Accepted Answer

Region pinning is set at tenant creation (e.g. EU only) and enforced at the storage, processing and AI-inference layers. For multi-region tenants, pinning can be applied per record, per workflow or per AI route — for example, EU customer records processed only by EU inference endpoints. Cross-region replication is opt-in and audit-logged.

Question 3

Where is my data physically stored, and who can access it?

Accepted Answer

Data is stored in the region you pin at provisioning time. On SaaS, infrastructure is operated by iShield personnel cleared for the region (EU operators for EU tenants, in-country operators for GCC). On Hybrid and On-Prem, only your staff hold production data access — iShield support uses break-glass, time-bound, audit-logged tooling that you approve per session.

Question 4

Can I bring my own encryption keys (BYOK / HYOK)?

Accepted Answer

Yes. SaaS supports BYOK via AWS KMS, Azure Key Vault and GCP KMS. Hybrid uses customer-managed CMKs — iShield never holds plaintext data keys. On-Prem supports HSM-backed keys (Thales, Entrust, AWS CloudHSM) and full Hold-Your-Own-Key (HYOK) configurations where iShield has no access to key material under any circumstance.

Question 5

Do I get the same features across all deployment models?

Accepted Answer

Yes. iShield ships one codebase. Every product — Nexus ITSM, Connect CRM, One ERP, and Link Integration & API Gateway — runs identically on SaaS, Hybrid and On-Prem. Air-gapped deployments may have AI features that require local model hosting (provided via offline bundles), but functional parity is maintained.

Question 6

How are upgrades handled on Hybrid and On-Prem?

Accepted Answer

Hybrid upgrades follow customer-approved windows with blue/green deployment; max version drift is 90 days from current. On-Prem customers receive signed offline upgrade bundles and choose their cadence; LTS releases are supported for 24 months. All upgrades preserve API and data-model compatibility within a major version.

Question 7

What about cross-border data transfers?

Accepted Answer

Cross-border transfers are off by default. Where required (e.g. global support tickets in a single Connect tenant), transfers use Standard Contractual Clauses, regional sub-processor restrictions and per-flow customer approval. Schrems II Transfer Impact Assessments are available on request.

Question 8

Which certifications and frameworks does iShield meet?

Accepted Answer

We are compiling a verified list of iShield's certifications and attestations, including the issuing body, scope and validity of each. Until it is published, please contact our team for the current status.

Question 9

Can I migrate between deployment models later?

Accepted Answer

Yes. Because the codebase is identical, migration is a data-and-config move, not a re-implementation. Common paths: SaaS → Hybrid for compliance escalation, On-Prem → SaaS for modernization. iShield provides scripted exporters and a managed migration service.

Question 10

What happens if I want to leave the platform?

Accepted Answer

Customers own their data. Full schema-aware exports are available in standard formats (Parquet, JSON, CSV) at any time, with no exit fees. For On-Prem, the binary remains operational under your last paid license window to allow orderly transition.

Dimension	Managed SaaS	Hybrid	On-Prem & Air-Gapped
Best for	Fastest time-to-value, no infra to operate, standard enterprise compliance.	Regulated industries, data sovereignty, cloud-of-record workloads.	Defense, intelligence, critical national infrastructure, no-internet environments.
Control plane location	iShield cloud	iShield cloud (orchestration, UI, metadata)	Customer datacenter (Kubernetes / OpenShift)
Data plane location	iShield cloud (pinned region)	Customer VPC on AWS, Azure, GCP or OCI	Customer datacenter, same cluster or segregated
Tenant isolation	Logical tenant isolation, per-tenant keys, quotas, audit	Single-tenant data plane, customer-owned subnets and keys	Dedicated cluster, no shared services, hardware-rooted trust optional
Network model	TLS 1.3 in transit, AES-256 at rest, public endpoints + IP allow-listing	Private link / VPC peering, no public data egress, customer-managed firewall	Fully disconnected supported; no outbound calls required
Residency control	EU, US, UK, GCC, APAC — chosen at tenant creation	Any region the customer cloud offers; per-flow pinning supported	100% on customer premises — no data leaves the facility
Identity & SSO	SAML 2.0, OIDC, SCIM 2.0, MFA, just-in-time provisioning	Federated SSO to customer IdP, optional private OIDC	Active Directory, LDAP, PIV/CAC, FIDO2 hardware keys
Key management	BYOK via AWS KMS / Azure Key Vault / GCP KMS	Customer-managed CMK; iShield never holds plaintext data keys	HSM-backed (Thales, Entrust, AWS CloudHSM)
Observability	Tenant-scoped metrics, audit log streaming to SIEM	Logs, metrics and traces stream to customer SIEM/APM	Local Prometheus / Grafana / OpenSearch, optional export
Upgrade cadence	Weekly minor, monthly feature, quarterly major	Customer-scheduled, max 90-day version drift	Customer-controlled, LTS releases supported 24 months
Air-gapped support	No	No	Yes

SaaS, Hybrid, or On-Prem — pinned to the region you require

Three ways to deploy. Zero functional drift.

SaaS vs Hybrid vs On-Prem at a glance

Pin tenants, workflows and AI routes to a specific region

The questions security, compliance and architecture ask

Need a deployment decision in writing?

Your privacy choices