> ## Documentation Index > Fetch the complete documentation index at: https://docs.neo.projectdiscovery.io/llms.txt > Use this file to discover all available pages before exploring further. # Bring Your Own VPC (On-Prem) > Run Neo entirely inside your own infrastructure Bring Your Own VPC is an enterprise-only deployment model. Contact your account team to scope and onboard a deployment. Bring Your Own VPC runs Neo entirely inside your own cloud account or data center, rather than connecting a ProjectDiscovery-hosted instance out to your network. The control plane, task orchestration, and execution all run on infrastructure you operate. ## How this differs from SaaS On the standard SaaS product, Neo's control plane runs in ProjectDiscovery's cloud and reaches your internal systems through a connection you configure — [VPN](/platform/settings/vpn), [SSH](/concepts/ssh-connections), or [BYOS](/concepts/sandboxes). Under Bring Your Own VPC, that connection isn't needed: Neo already runs inside your network, so it reaches internal applications natively, with no tunnel and no inbound exposure. | Aspect | SaaS | Bring Your Own VPC | | ---------------------------------- | -------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | | **Where Neo runs** | ProjectDiscovery's cloud | Entirely inside your infrastructure | | **Reaches your internal apps via** | A connection you configure: VPN, SSH, or BYOS | Natively — no tunnel required | | **Where task and scan data lives** | ProjectDiscovery's cloud | Your infrastructure | | **Who operates it** | ProjectDiscovery | Your team, with ProjectDiscovery support | | **Best fit when** | You want minimal infrastructure to run and operate | Regulatory or compliance requirements, data residency, or full infrastructure control are non-negotiable | The only traffic that leaves your VPC is outbound: image pulls to keep Neo updated, model calls (unless routed entirely through your own provider keys — see [Model access](#model-access-hosted-models-or-byok) below), and a small set of external tooling the agent draws on. The specific outbound allowlist is confirmed during onboarding so it can go straight into your firewall and proxy policy. For most enterprise teams that choose this model, the driver is regulatory or compliance requirements — a data residency mandate, an industry regulation, or a contractual commitment that only a self-hosted deployment satisfies — rather than a general preference for running more infrastructure. ## What you provide A Bring Your Own VPC deployment runs on infrastructure you provision and operate in your own cloud account or data center — typically a Kubernetes cluster plus managed database, cache, and object storage. ProjectDiscovery provides the container images, deployment manifests, and onboarding support to bring it up. Exact sizing depends on your expected user count and scan volume, and is worked out with your account team rather than fixed in advance. ## The sandbox is part of what you deploy On SaaS, a Neo-managed cloud sandbox is included by default, and adding BYOS is optional — something you connect on top when a task needs a specific network position or local files and tools. Under Bring Your Own VPC, there's no separate cloud-hosted sandbox tier to fall back on. Since the whole platform runs on your infrastructure, the execution/sandbox environment is one of the components you provision as part of the deployment, not an optional add-on. See [Sandboxes](/concepts/sandboxes) for what that execution tier does. ## Model access: hosted models or BYOK A Bring Your Own VPC deployment can be configured either way: | Aspect | On-Prem + Hosted models | On-Prem + BYOK | | ----------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | | **Model calls route through** | ProjectDiscovery | Your own provider account | | **Billing** | Your Neo model usage | Directly with your provider, at their published rates | | **Best fit when** | You want ProjectDiscovery's pooled rate limits and model fallback without managing provider relationships | You already hold a provider agreement, or need model traffic to stay under your own account and contracts | See [BYOK](/platform/settings/byok) for how bringing your own provider keys works, and [Models](/platform/settings/models) for which providers and models Neo supports. ## Deciding whether this is the right fit A few things are worth settling with your account team while scoping a deployment: * **Regulatory or compliance requirements** — industry regulations, government or public-sector mandates, or contractual terms that require data residency and infrastructure control are the most common reason teams choose Bring Your Own VPC over SaaS. Worth surfacing early, since it often settles the decision on its own. * **Scanning scope** — whether you need Neo to test internal-only targets, internet-facing targets, or both. This is often the deciding factor between SaaS and Bring Your Own VPC. * **Model strategy** — hosted models routed through ProjectDiscovery versus BYOK, and any compliance constraints on what may leave your network. * **Sizing** — infrastructure sizing scales with expected users and scan volume and is confirmed jointly during onboarding. For how Neo handles data more generally, see [Security & Privacy](/concepts/security-privacy).