Skip to content
PromptGlassDocs

SaaS deployment

PromptGlass SaaS is the fastest way to start. We run the control plane, analytics and storage in the region you choose, and you deploy only the sensors you need: the browser extension, the endpoint agent and, optionally, a gateway close to your users. Tenants are isolated per region, and data never moves between regions.

Regions

Section titled “Regions”
Region Tenant URL Hosting
United States https://<tenant>.us.promptglass.ai US data centers
European Union https://<tenant>.eu.promptglass.ai EU data centers
Canada https://<tenant>.ca.promptglass.ai Canadian data centers

You pick the region when the tenant is created, and it can’t be changed in place. To move regions, export your data and re-provision. See data residency and retention.

What runs where

Section titled “What runs where”
Component SaaS Your environment
Console, API, policy engine, analytics ✓
Detector workers for connector events ✓
Browser extension, endpoint agent ✓
Gateway (forward proxy / API) Optional hosted edge Recommended: run it in your network
SaaS connectors ✓ (pull from vendor APIs)

Hybrid gateway

Section titled “Hybrid gateway”

Most SaaS customers run the gateway themselves, usually as a container on Kubernetes or a VM next to their existing proxy. Inline detection and redaction then happen inside your network, and only event metadata and (optionally) redacted content go to the SaaS control plane.

Terminal window
docker run -d --name pg-gateway -p 3128:3128 -p 8443:8443 \
  -e PROMPTGLASS_TENANT=acme.eu \
  -e PROMPTGLASS_GATEWAY_TOKEN=$TOKEN \
  -v /etc/promptglass/ca:/ca:ro \
  registry.promptglass.ai/promptglass/gateway:2026.11

Network requirements

Section titled “Network requirements”

Sensors need outbound HTTPS (443) to:

  • <tenant>.<region>.promptglass.ai: API and console
  • ingest.<region>.promptglass.ai: event ingestion (gRPC over TLS 1.3)
  • updates.promptglass.ai: AI app catalog and detector model updates

Private connectivity over AWS PrivateLink or Azure Private Link is available on request.

Encryption keys

Section titled “Encryption keys”

Content is encrypted at rest with envelope encryption. By default PromptGlass manages the key-encryption key. With bring your own key (BYOK) you grant PromptGlass permission to wrap and unwrap data keys with a key in your AWS KMS or Azure Key Vault. If you revoke the grant, stored content can no longer be read.

Next

Section titled “Next”