Platform vs Self-Hosted

Choosing between the managed sovseal Platform and a Self-Hosted edge function depends on your operational priorities. Because both paths enforce client-side encryption, your choice does not affect the zero-knowledge guarantees: the server remains blind to your plaintext regardless of hosting.

Feature Matrix

Compliance & Security Decision Tree

Use this guide to align your choice with regulatory and security mandates:

                  Do your security policies prohibit 
              external cloud storage of ciphertext?
                           /          \
                          /            \
                       [Yes]           [No]
                        /                \
                       ▼                  ▼
             Use Self-Hosted        Does your app fall under
            (Fully sovereign)       strict regulatory frameworks?
                                           /          \
                                          /            \
                                       [Yes]           [No]
                                        /                \
                                       ▼                  ▼
                               Which one?          Use Platform
                             /           \        (Fastest setup)
                            /             \
                   [GDPR / SOC 2]     [FedRAMP / HIPAA]
                          /                   \
                         ▼                     ▼
                  Use Platform           Use Self-Hosted
               (ZK structure makes     (Ensures strict VPC/
                compliance simple)      GovCloud isolation)

GDPR Compatibility

Under GDPR, sovseal's Platform tier is compliant by construction. Because the managed server only stores client-side AES-256-GCM ciphertext and SHA-256 path hashes:

• Plaintext personal data (PII) is never processed or held on our servers.
• Right to erasure (forgetting) is handled deterministically via client-side rollback or local deletion tombstones.
• No cross-border data transfer concerns exist since the plaintext never leaves the host machine.

HIPAA & FedRAMP Alignment

If you operate in environments where company policy dictates that even encrypted payloads cannot reside on third-party SaaS servers, the Self-Hosted deployment allows you to run the edge replication endpoint directly inside your private VPC or GovCloud environment.

Cost & Resource Comparison

Migration Paths

Moving between the managed Platform and Self-Hosted tiers requires no source code modification beyond updating the SDK configuration block.

Platform to Self-Hosted

1. Deploy the Deno Edge Function schema to your infrastructure.
2. Export your local LanceDB snapshot directory or allow the in-flight write-behind queue to drain.
3. Update the SDK client configuration to point the replicationUrl to your new endpoint:

import { sovseal } from "@sovseal/sdk";

const memory = new sovseal({
  replicationUrl: "https://your-domain.com/v1/v2-agent-state",
  apiKey: process.env.MY_SELF_HOSTED_TOKEN,
});

Self-Hosted to Platform

1. Register for a managed project at sovseal.com/dashboard and generate a sov_live_ API key.
2. Re-point your SDK client configuration:

const memory = new sovseal({
  replicationUrl: "https://api.sovseal.com/v2/agent-state",
  apiKey: process.env.SOVSEAL_API_KEY, // sov_live_...
});

3. The client background worker will automatically synchronize existing local LanceDB records to the Platform.