SaaS and BYOC

Lerian supports two deployment models: SaaS and BYOC (Bring Your Own Cloud). Both give you access to the full product portfolio — the difference is who operates the infrastructure. Choose the model that fits your operational maturity, compliance requirements, and team structure. You can also combine models across products if needed.

​

SaaS — Fully managed by Lerian

---

In the SaaS model, Lerian hosts and operates the entire platform for you. Your team focuses on building financial products. We handle everything underneath. What Lerian manages:

• Cloud infrastructure (compute, storage, networking)
• Database provisioning, backups, and scaling
• Security patches and OS-level updates
• Application upgrades and version management
• Monitoring, alerting, and incident response
• High availability and disaster recovery

What you manage:

• Business configuration (organizations, ledgers, accounts, rules)
• API integrations with your systems
• User access and permissions within the platform
• Compliance obligations specific to your institution

​

BYOC — Bring Your Own Cloud

---

In the BYOC model, you deploy and operate Lerian in your own infrastructure — whether that’s a public cloud (AWS, GCP, Azure), a private cloud, or on-premises. You have full control over the environment. Lerian provides the software, , , and tooling to make deployment and lifecycle management straightforward. What Lerian provides:

• Application software (container images, Helm Charts)
• Terraform templates for infrastructure provisioning
• Lifecycle Management for deployment orchestration and version tracking
• Security patches and application updates (delivered by Lerian, applied by you)
• Technical support (Enterprise)

What you manage:

• Cloud infrastructure and clusters
• Database administration, backups, and scaling
• Network security (firewall rules, network isolation, and traffic routing)
• OS and container-level patching
• Monitoring and observability pipelines
• Encryption, secrets management, and access control

​

Why Helm for BYOC deployments

Lerian publishes official for every product. Helm is the recommended way to deploy, configure, and manage the platform in your infrastructure. Here’s why it matters:

• Reproducibility — Every deployment from the same chart version produces the same result. No “it works on my cluster” surprises across staging, production, or disaster recovery environments.
• Rollback — Helm keeps a history of every release. Rolling back to a previous version is a single command — no need to reconstruct the previous state manually.
• Reduced operational risk — Charts encode all configuration details (environment variables, ports, dependencies), so your team doesn’t have to remember them. Manual deployments are error-prone; Helm deployments are not.
• Faster time to production — Instead of writing Kubernetes manifests from scratch, start with Lerian’s official charts and adjust a single values file. Days of YAML editing become an afternoon of parameter tuning.
• GitOps-ready — Charts integrate naturally with GitOps workflows (ArgoCD, Flux). Deployment configuration lives in version control, changes go through pull requests, and every deployment is traceable to a specific commit.

For the full version compatibility matrix, see Version compatibility. For step-by-step installation instructions, start with the Helm overview in the Platform section.

​

BYOC variations

Depending on your architecture, BYOC supports two configurations:

​

How your deployment model affects API integration

---

The API surface is identical across all deployment models — same endpoints, same payloads, same responses. The difference is in how authentication and tenant scoping work. SaaS and BYOC Multi-Tenant Your tenant context is established automatically through your authentication token. There is no tenant header to pass and no tenant ID to manage manually.

• You authenticate via Access Manager and receive a JWT.
• That token includes your tenant context.
• Every API call is automatically scoped to your tenant — organizations, ledgers, accounts, and transactions are all isolated.
• You never interact with data from other tenants, and they never interact with yours.

BYOC Single-Tenant Authentication is optional (controlled by the PLUGIN_AUTH_ENABLED environment variable). When disabled, API calls work without a token — this is the default experience in local development and the Getting Started guide.

​

At a glance

---

​

Comparing the models

---

​

Which model is right for you?

---

Choose SaaS if:

• You want to go live quickly without provisioning infrastructure
• Your team prefers to focus on product and integration, not operations
• You don’t have strict requirements for data to remain in your own environment

Choose BYOC if:

• Regulatory or compliance rules require data to stay in your infrastructure
• You need full control over networking, encryption, and access policies
• Your organization has a platform or DevOps team ready to operate Kubernetes workloads
• You want to integrate Lerian into an existing cloud environment with specific architectural constraints

​

Deployment model and licensing

---

Lerian’s deployment models (SaaS and BYOC) are independent from the licensing models (Community and Enterprise).

• Community + BYOC: You deploy and manage Midaz yourself using the source-available Midaz Helm Charts and documentation. Community support via GitHub and Discord. Other Lerian products are available to licensed customers under the Enterprise model.
• Enterprise + BYOC: Full BYOC with Lifecycle Management, dedicated support, SLA, onboarding, and access to plugins.
• Enterprise + SaaS: Lerian manages everything. You get the full platform without infrastructure responsibilities.

​

What’s next

---