Control Over Location
Run security infrastructure in your data centre, private cloud or a cloud region you choose.
Self-hosted deploymentIn-country control
Keep security infrastructure and data in-country, under your control
Customer problem
Security Data Is Sensitive Data
Security tools see who accessed which system, from where, and what traffic passed through. When they are delivered only from a vendor's cloud, that data is processed in infrastructure you do not operate.
Regulation, contracts or internal policy can require you to know exactly where security infrastructure runs and where its data is kept.
For some organisations, a vendor-hosted service is a reasonable trade-off. For others, it is not.
- Meeting data residency expectations for security logs
- Honouring contract limits on where data can go
- Security tools running only in vendor-hosted regions
- Governance rules requiring in-house operation
- Critical access controls depending on an external service
- Unclear answers when auditors ask where data lives
The COSGrid solution
Security Infrastructure Deployed in Your Environment
COSGrid products can be deployed in your own environment instead of being consumed only as a vendor-hosted service. SwiftZAccess runs self-hosted in your infrastructure, while NexusShield, API QShield and Z3 SASE offer on-premises, virtual or hybrid deployment options.
With COSGrid, organisations can
- Run Zero Trust access in your own infrastructure
- Keep SwiftZAccess policies, decisions and logs in your environment
- Send logs to your own SIEM
- Choose self-hosted, cloud or hybrid deployment for each product
- Decide upgrade timing, configuration and monitoring
How It Works
Define the Requirement
Decide which security functions must stay in your environment and where they will run, such as a data centre, private cloud or a cloud region you choose.
Choose the Deployment
Select self-hosted, appliance, virtual, cloud or hybrid deployment for each product based on its supported deployment options.
Deploy and Connect
Install the security infrastructure in an environment you control, connect your identity provider and send logs to your own SIEM.
Operate Under Your Governance
Control upgrades, configuration and monitoring while maintaining your own records to demonstrate where the infrastructure runs and where security data is kept.
Key Benefits
Data Stays With You
Keep SwiftZAccess policies, decisions and logs in your environment and stream them to your own SIEM.
Less Vendor Dependence
Reduce reliance on an external cloud service for critical access and protection controls.
Choice Per Product
Self-host what must stay in-country and consume other services as needed. Choose the deployment model independently for each product.
Flexible Deployment Models
Choose appliance, virtual appliance, Kubernetes ingress, sidecar, cloud or hybrid deployment depending on the product.
Clearer Residency Answers
Show auditors and risk teams exactly where security infrastructure runs and where its data is kept.
Vendor Cloud-Managed vs COSGrid Self-Controlled
Vendor Cloud-Managed
- Vendor's cloud regions
- Operated by the vendor
- Vendor-controlled data storage
- Upgrade timing set by the vendor
- External service required to operate
- Lower effort for you
- Same model for every function
- Suits organisations without residency limits
COSGrid Self-Controlled
- Your data centre, private cloud or chosen region
- Operated by your team
- Your environment and your SIEM
- Upgrade timing set by you
- Reduced external dependency
- Higher effort because you run the infrastructure
- Deployment chosen independently per product
- Suits residency, contractual or governance needs
Use cases
Built for every access scenario
Keep third-party access within your environment
Run third-party access to internal web applications through self-hosted SwiftZAccess in your own data centre, with access decisions logged to your SIEM.
Inspect API traffic within your own cloud
Run API QShield at the Kubernetes ingress inside your own cloud environment, so API traffic can be inspected without leaving your environment.
Operate firewall infrastructure across sites
Run NexusShield as virtual appliances across your data centre and private cloud environments under the control of your own operations team.
Choose where each security function runs
Self-host the components that handle your most sensitive data and consume the remaining services as a managed offering, allowing deployment decisions to be made based on your requirements.
Who Is This For
Need secure third-party application access? See "Agentless access for contractors and partners"
- CISOs & Security Architects
- CIOs & Infrastructure Leads
- Risk & Compliance Teams
- Data Protection Officers
- Regulated Enterprises
FAQs
Have a question about COSGrid deployment and data residency?
Does deploying COSGrid make us compliant with data residency regulations?
No product can make an organisation compliant on its own. COSGrid's deployment options give you control over where security infrastructure runs and where its data is kept. That supports your compliance programme, but meeting each requirement remains your organisation's responsibility.
Where is our security data stored in a self-hosted deployment? In the environment you deploy into. For SwiftZAccess, policies, access decisions and logs stay in your environment and can be sent to your own SIEM.
Do we have to self-host every product? No. Deployment is chosen per product. Many organisations self-host the components that handle sensitive data and use others as a service.
