Four ways to
run Recall Racoon
Choose the model that matches your security posture, compliance requirements, and operational capacity. All models run the same code.
Compare
options
Cloud Managed
Fully hosted multi-tenant with namespace isolation. We operate the Control Plane and Data Plane. Fastest time to value.
Key Features
- Managed infrastructure & scaling
- Automatic updates & patches
- Multi-region availability
- 99.9% SLA (Business tier)
- Per-namespace encryption keys
- SOC 2 controls (in progress)
Responsibility Split
- We manage: infrastructure, scaling, updates, backups
- You manage: namespace config, policies, data
Best for: Teams wanting fastest time-to-value with managed operations
Private VPC
Dedicated Control Plane + Data Plane deployed in your AWS/GCP/Azure VPC. You control network, we manage operations.
Key Features
- Your VPC, your network topology
- Dedicated compute resources
- VPC Peering / PrivateLink / Transit Gateway
- Custom security groups & NACLs
- Customer-managed KMS keys (BYOK)
- Private DNS zones
Responsibility Split
- We manage: application ops, updates, monitoring
- You manage: VPC, networking, IAM, compliance
Best for: Organizations with VPC requirements and dedicated security teams
On-Premise
Single binary or container deployment on your Kubernetes or VMs. SQLite or Postgres backend. Full data sovereignty.
Key Features
- Your hardware, your data center
- Kubernetes (Helm) or Docker Compose
- SQLite (default) or PostgreSQL backend
- sqlite-vec or pgvector for embeddings
- License-key activation (30-day grace)
- Air-gapped capable
Responsibility Split
- You manage: all infrastructure, OS, network, storage
- We provide: binary, Helm charts, docs, support
Best for: Regulated environments requiring full infrastructure control
Air-Gapped
Completely network-isolated deployment. License-key validation with 30-day grace. No outbound calls ever.
Key Features
- Zero network egress required
- Offline license validation
- USB/air-gapped update mechanism
- FIPS 140-2 compatible crypto
- Signed artifacts with SBOM
- Long-term support branches
Responsibility Split
- You manage: all infrastructure, air-gap procedures
- We provide: signed binaries, SBOM, offline license keys
Best for: Classified, defense, or highly regulated environments
Where components
run
| Deployment Model | Control Plane | Data Plane | Network |
|---|---|---|---|
| Cloud Managed | Our Infrastructure (Multi-tenant) | Our Infrastructure (Multi-tenant) | Public Internet / PrivateLink |
| Private VPC | Your VPC (Dedicated) | Your VPC (Dedicated) | VPC Peering / PrivateLink |
| On-Premise | Your Kubernetes / VMs | Your Kubernetes / VMs (SQLite/Postgres) | Your Internal Network |
| Air-Gapped | Your Air-Gapped Network | Your Air-Gapped Network | No External Connectivity |
What you need
to know
Artifact Delivery
Signed container images (ghcr.io), standalone Linux binaries, Helm charts, Docker Compose files. SBOM and provenance attestations with every release.
Licensing
License-key activation for Private/Enterprise. 30-day grace window. No phone-home after activation. Offline validation via signed license file.
Updates
Monthly patch releases, quarterly minor releases. Air-gapped: USB-delivered signed packages. Rolling updates with zero-downtime for stateless Control Plane.
Monitoring
Prometheus metrics endpoint (/metrics), health checks (/health), structured JSON logs. Grafana dashboards included. Alert rules for quota, errors, latency.
Backup & Recovery
Point-in-time recovery from WAL. Automated snapshots (configurable interval). Cross-region replication on Business/Enterprise. RPO < 5 min, RTO < 30 min.
Scaling
Control Plane: horizontal (stateless). Data Plane: vertical (SQLite) or horizontal (Postgres/Qdrant). Auto-scaling on Cloud Managed. Manual on Self-Hosted.