Loading…
Security & trust
Deploy lab358 into your own AWS account and it runs entirely inside your perimeter: your data, your documents, and your indices never leave it — which is exactly what your security team needs to hear.
The guarantees below describe that self-hosted deployment. On lab358 Cloud, your workspace is hosted by lab358 and encrypted per workspace.
Indexing, storage, and serving all happen inside your own VPC — not on our infrastructure.
Prompts, documents, indices, and outputs stay in your account. No content is sent to a third-party inference API.
Because inference runs in your cloud, there's no metered third-party endpoint seeing your content.
The listing is not live yet. Today lab358 installs as a Helm chart into your own EKS cluster; when the listing is live it will deploy into your account under your existing AWS agreement.
You control the IAM roles, networking, and the KMS keys on the AWS-provisioned storage layer. GPU node size and count are chart values you can widen; the accelerator families are fixed in the chart template (g5, g6, g6e), so changing those is a chart edit rather than a values override. Per-tenant encryption and BYOK are a separate, Cloud-only feature.
We're honest about where we are. Here's the current status — which deployment each row holds on, and for the planned items, what has not happened yet.
A deployment diagram, supported instance types, and a one-page security brief your team can take into review — including the short list of what we do not claim yet.
We'll walk through the architecture and answer the review questions directly.
Request a security review