> ## Documentation Index
> Fetch the complete documentation index at: https://docs.genloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment Options and SSO Configuration

> Deploy Genloop in the cloud, inside your VPC, or fully air-gapped. Configure SSO and SAML for Enterprise workspaces with your identity provider.

Genloop supports three deployment modes to meet different infrastructure and compliance requirements. You can start with the cloud deployment and migrate to a private deployment as your needs evolve. SSO and SAML authentication are available on the Enterprise plan for all deployment modes.

## Deployment modes

<Tabs>
  <Tab title="Cloud (SaaS)">
    **The default deployment.** Genloop is hosted and managed by the Genloop team. You connect your data sources, and Genloop handles infrastructure, updates, and scaling.

    **Best for:** Teams that want to get started immediately without infrastructure overhead.

    **Data handling:** Genloop queries your data sources directly. No enterprise data is copied or stored in Genloop's cloud. Connections use TLS-encrypted credentials stored in Genloop's secrets manager.

    No setup is required. Create your account at [app.genloop.ai](https://app.genloop.ai) and connect your first data source.
  </Tab>

  <Tab title="VPC">
    **Genloop runs inside your cloud account.** The application is deployed into a Virtual Private Cloud (VPC) in your AWS, GCP, or Azure environment. Your data never leaves your cloud boundary.

    **Best for:** Organizations with strict data residency requirements or policies that prohibit third-party SaaS access to production databases.

    **Data handling:** All queries run within your VPC. Genloop's application layer, context graph, and conversation history are hosted in your environment. LLM API calls are made outbound from your VPC to the configured model provider.

    <Steps>
      <Step title="Contact the Genloop team">
        Reach out at [https://cal.com/ayush-genloop](https://cal.com/ayush-genloop) or contact your Solutions Architect to start the VPC deployment process.
      </Step>

      <Step title="Provision your environment">
        The Genloop team will provide infrastructure-as-code templates (Terraform or CloudFormation) and guide you through provisioning the required resources in your cloud account.
      </Step>

      <Step title="Configure data source connections">
        Once deployed, configure your data source connections from within your VPC. Credentials remain inside your environment.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Air-gapped">
    **No external LLM calls.** All inference runs on-premises. The Genloop application and the underlying language model are deployed entirely within your environment — no traffic leaves your network.

    **Best for:** Government, defense, financial services, and other organizations with strict controls on external network egress or LLM data processing.

    **Data handling:** All data stays on-premises. You bring your own model (see [Model agnosticism](#model-agnosticism)).

    <Warning>Air-gapped deployment requires Enterprise plan. Contact your Solutions Architect to discuss hardware requirements and deployment timelines.</Warning>

    <Steps>
      <Step title="Contact your Solutions Architect">
        Air-gapped deployments are scoped individually. Reach out at [https://cal.com/ayush-genloop](https://cal.com/ayush-genloop) to begin the process.
      </Step>

      <Step title="Select your model">
        Choose the on-premises model you want Genloop to use. Genloop supports open-weight models compatible with standard inference runtimes. Your Solutions Architect will advise on tested and supported options.
      </Step>

      <Step title="Deploy Genloop on-premises">
        The Genloop team will provide deployment packages and work with your infrastructure team to install and configure the application within your environment.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Model agnosticism

Genloop is not tied to a single AI provider. Depending on your deployment mode, you can configure which underlying language model powers Genloop's analysis:

* **Cloud (SaaS):** Genloop uses its default hosted model. Contact the team to discuss model options.
* **VPC:** You can configure outbound LLM API calls to any supported provider (e.g., OpenAI, Anthropic, Azure OpenAI).
* **Air-gapped:** You bring your own model. Genloop supports open-weight models served via standard inference APIs. Your Solutions Architect will confirm which runtimes and models are supported.

<Note>Model selection does not affect Genloop's context graph, data access controls, or RBAC configuration. These are Genloop-layer features that work the same regardless of the underlying model.</Note>

## SSO and SAML

<Info>SSO and SAML are available on the **Enterprise** plan for all deployment modes.</Info>

Genloop supports SAML 2.0-based single sign-on, which lets your team log in with your existing identity provider instead of managing separate Genloop credentials.

**Supported identity providers include:**

* Okta
* Microsoft Entra ID (formerly Azure AD)
* Google Workspace
* OneLogin
* Any SAML 2.0-compliant provider

### Configure SSO

<Steps>
  <Step title="Contact Genloop to enable SSO">
    SSO configuration is handled by the Genloop team during Enterprise onboarding. Contact your Solutions Architect or reach out at [https://cal.com/ayush-genloop](https://cal.com/ayush-genloop) to request activation.
  </Step>

  <Step title="Provide your IdP metadata">
    Share your identity provider's SAML metadata URL or XML file with the Genloop team. This includes your issuer URI, SSO URL, and public certificate.
  </Step>

  <Step title="Configure your IdP">
    In your identity provider, create a new SAML application for Genloop. The Genloop team will provide the required **Entity ID**, **ACS URL** (Assertion Consumer Service), and attribute mapping requirements.
  </Step>

  <Step title="Test the integration">
    Once configuration is complete, test the login flow with a non-admin account before rolling out to your full team.
  </Step>

  <Step title="Enforce SSO for your workspace">
    After a successful test, you can enforce SSO for all workspace members — disabling password-based login entirely.
  </Step>
</Steps>

### Role auto-sync with SSO

<Info>Role auto-sync is available on **Enterprise** only.</Info>

On Enterprise, Genloop can sync roles from your identity provider automatically. When a member's group membership changes in your IdP (for example, they're added to a `data-team` group), their Genloop role updates automatically at next login.

This eliminates manual role management and ensures access controls stay in sync with your directory. Configure the group-to-role mapping in **Settings > Security > SSO** after your SSO integration is live.

## Requesting a private deployment

To discuss VPC or air-gapped deployment:

* Book a call with the team: [https://cal.com/ayush-genloop](https://cal.com/ayush-genloop)
* Or contact your dedicated Solutions Architect if you're an existing Enterprise customer