Deployment
Deploy on your terms.
Run TAP where it makes sense — our cloud, your cloud, or fully on-premise, including air-gapped installations that never touch the internet.
Three ways to run it
One platform. Three deployment models.
The same TAP — the choice is where it lives and who runs the infrastructure.
TAP Cloud
We host it.
Multi-tenant SaaS. Instant activation, zero infrastructure to manage.
- Multi-tenant SaaS — nothing to install
- Instant activation, zero infrastructure to run
- We patch, back up, and scale it for you
Your Cloud
Your AWS / Azure / GCP.
We deploy and manage TAP inside your own cloud account and network.
- Runs inside your AWS, Azure, or GCP account
- Stays in your network and your VPC
- We deploy and manage it — you keep the keys
On-Premise
Your server room.
Fully offline-capable, including air-gapped installs via signed offline bundles. Run the entire stack on your own server, behind your own firewall — or on an OT network with no route to the internet at all.
- Runs on your own server, in your own building
- Fully offline-capable — no internet dependency
- Air-gap installs via signed offline bundles
Signed offline bundle
Every release ships as a cryptographically signed bundle. Verify it, then install with no package registry, no license server, no phone-home.
USB-install capable
Carry the bundle across the air gap on removable media. TAP installs and updates without ever reaching the public internet.
No internet dependency
The full stack — broker, database, realtime, UI, and Copilot — runs self-contained. Disconnect the uplink and nothing degrades.
Data sovereignty
Your process data never leaves the plant. Meets the strictest OT-network and regulated-environment isolation requirements.
Right-sized
Infrastructure profiles.
TAP scales from a 512MB edge box to a multi-tenant fleet server. Pick the profile that matches the site — the platform is the same.
| What it runs | Profile A 512MB Single-site, light | Profile B 2GB Small-to-mid site | Profile C 6–8GB Multi-tenant / fleet |
|---|---|---|---|
| TAP Gateway (edge) | |||
| Edge buffering / store-forward | |||
| TimescaleDB (time-series) | |||
| EMQX broker + Ingest | |||
| Realtime + UI + Core | |||
| Analytics engine | Basic | ||
| TAP Copilot (on-prem AI) | Optional | ||
| Multi-tenant hosting | |||
| Larger fleets & history | Limited |
Security
Secure by construction.
Isolation, encryption, and access control are built into every deployment model — hardest by default on-premise, where your data never leaves the plant.
On-prem data sovereignty
Keep every reading inside your network — up to fully air-gapped, no data ever leaves the plant.
TLS everywhere
Gateway, broker, API, and browser links are encrypted in transit on every hop.
Role-based access
RBAC gates who can view dashboards, acknowledge alarms, or write to equipment.
Audit logging
Every command and configuration change is recorded — who did what, when, and the result.
Tenant isolation
Data is partitioned per tenant end to end — from broker topics to database rows to realtime subscriptions.
JWT auth
Short-lived signed tokens carry identity and claims across every service in the stack.
SSO ready
Front TAP with your identity provider so access follows your existing directory and policies.
Minimum edge footprint
Typical time to deploy
Deployment models to choose from
Fully offline install capable
Cloud, your cloud, or air-gapped.
Tell us your constraints — network, compliance, footprint — and we'll show the right way to run TAP.