Bring Your Own Cloud to Replit

Enterprise teams want to build apps connected to their company’s systems and data. But strict security requirements often mean development and production must stay within the isolation and control of their own cloud.

Replit has steadily expanded its governance and isolation posture with many governance tools, separate development and production databases and a single-tenant Replit offering for enterprises.

Now, we’re introducing Bring Your Own Cloud (BYOC) for Replit, with options for development and production in your cloud, whether you use Microsoft Azure, Google Cloud, or Amazon Web Services. Our approach gives security and platform teams greater isolation and control while preserving the familiar Replit experience.

• Full BYOC offers the full Replit platform in your own cloud tenant.
• BYOC for Published Apps guarantees published Replit projects are hosted in your own cloud tenant.
• Image Exports let your team self-host Replit-built apps in your own cloud.

Each option gives your team a different level of responsibility for deployment and operations. Here’s how they work.

Full BYOC: Replit in your cloud

Full BYOC brings both the Replit platform and published project hosting into your cloud tenant. This lets you safely develop with core company data without any of it ever leaving your premises.

The Replit platform includes compute, storage, the file system, integrations, and the Agent harness. This powers project building, connectors, scheduled agents, publishing, all knowledge work, and more.

Replit’s cellular architecture groups infrastructure into isolated units called cells, supporting reliability, security, and a consistent product experience. By deploying cells in your cloud, we bring the same familiar Replit experience to your own infrastructure.

Replit’s agent harness is included as part of the cell. This was a huge undertaking for Replit, and offers important advantages:

1. This ensures your security team can govern which internal resources it reaches, and apply controls to outbound connections.
2. This guarantees colocation between the agent harness and compute resources, eliminating network latency.

Full BYOC is our most comprehensive option, bringing the Replit platform and all published project hosting into your cloud. It requires the most involved upfront setup to preserve the familiar Replit experience for builders. We’re introducing Full BYOC as a private preview to our enterprise customers.

BYOC for Published Apps: publish to your cloud

With BYOC for Published Apps, published projects are hosted in your cloud tenant. Replit manages the Replit Platform, so there’s less operational overhead for your team. This lets your end users safely leverage published project hosting without any core company data ever leaving your premises.

Administrators have full control over the publishing destination for each Replit Workspace. For builders, nothing changes: they click “Publish” just as they do today.

This configuration supports practical enterprise requirements. A production app can connect to private databases within the customer environment. All of the infrastructure backing your projects have private endpoints, and can be configured to be accessed through your company network or VPN. Security teams can use their existing cloud security tools to inspect deployed workloads and dependencies. Under the hood, Replit publishes and manages the infrastructure for your chosen configuration using infrastructure as code (IaC). This provides the Replit Agent and users with flexible primitives for building complex applications, that can include object storage, caching, message queues, and scheduled jobs.

Secure tunnels connect Replit to infrastructure resources in your cloud tenant over private networking. Tunnels include two layers of encryption on all traffic (mTLS on the tunnel itself plus mTLS between the services that communicate with each other), ensuring neither Replit nor your tenant can ever share data with an untrusted recipient. Tunnels only communicate outwards from your infrastructure, so there is no need to have a publicly-accessible ingress.

Replit transparently encrypts all types of storage: from file systems, disks, databases. Customer-managed encryption keys (CMEK) ensure the contents of files are fully controlled by your team. Your organization manages the key and grants Replit permission to use it, retaining the ability to revoke that access at any point in time. CMEK is available for customers who have an agreement including full physical isolation of the Replit Cell.

BYOC for Published Apps is our intermediate option, offering strong security guarantees with a smaller setup and infrastructure footprint. BYOC for Published Apps is in early access for enterprise customers.

Image Exports: Self-host Replit-built apps in your cloud

Projects configured to use Image Exports provide a Docker image,a Terraform file, and an SBOM that your infrastructure team can use to deploy Replit-built applications into your own cloud. To the builder, all they do is hit the “Publish” button, as per usual. This kicks off a customizable process for your team to review the new or updated app for security and compliance. The published app does not dial back out to the Replit platform, as this is intended for customers in restricted environments.

When using Image Exports, your team deploys and operates the application using its own infrastructure tools and processes. In this working model, you must provide some of the building blocks typically provided by Replit, such as managed auth, and connectors. Image Exports are a good fit for customers with highly specialized requirements for software, who do not require the typical ease of use of Replit. Replit’s Agent can be fully customized using Skills and Project Memory to accomplish this.

Image Exports provides maximum customizability for project hosting. It can be combined with BYOC for Published Apps, giving admins control over how any given project is published. Image Exports are available in early access for enterprise customers.

Different environments for different business units

Large organizations often have different requirements across regions and business units. A European business unit and a US business unit may need separate cells. A research team working with sensitive systems may require a cell in the company’s cloud, while another team continues working in a Replit-managed environment.

Cellular architecture gives us a foundation for supporting those differences within Replit. One cell could be dedicated to a canary or staging environment for additional reliability when desired.

The following example outlines an architecture where one workspace runs in a cell managed by Replit (with customer-managed encryption keys), while another runs in your cloud.

Explore BYOC for your organization

Our goal is to give enterprise security and platform teams the isolation and control their organizations require while preserving the experience that helps people build with Replit. We’re introducing Full BYOC as a private preview and BYOC for Published Apps and Image Exports as an early access program.

Explore BYOC with Replit. Talk to our enterprise team to find the right deployment option for your organization.