On‑Prem (Air‑Gapped) Document Understanding

Deploy Reducto entirely inside your environment with strict isolation. We support fully air‑gapped installs with no egress, VPC/on‑prem deployments, SOC 2 and HIPAA alignment, and zero data retention. In air‑gapped mode, all models, OCR assets, and updates are provided offline; no outbound network access is required. Trusted by Fortune 10 enterprises and leading AI teams, Reducto brings production‑grade document intelligence to your most sensitive workloads.

This page outlines deployment models, reference architecture, security, and enterprise SLA options to help you plan a compliant rollout.

5‑Step Deployment Checklist

1) Plan capacity and topology

• Define target throughput, document types, and GPU/CPU mix; select storage (object or block) and sizing for intermediate artifacts (plan 1–3× input if caching).

2) Establish network and isolation controls

• Choose VPC/on‑prem or fully air‑gapped. In air‑gapped mode, disable outbound connectivity (no egress) and prepare an offline update path.

3) Install core services

• Bring up the API gateway, control plane, job queue, and parser workers (CPU/GPU). Configure SSO/SAML/OIDC and choose zero data retention if required.

4) Validate and harden

• Run a representative corpus through Parse/Extract, verify accuracy and citations, enable metrics/logging, and complete security reviews (SOC 2/HIPAA controls, BAA as needed).

5) Go‑live and operate

• Set monitoring/alerting, document runbooks, and schedule offline patch/update cadence (for air‑gapped). Align on support channels and escalation.

Enterprise SLA Options

Reducto offers tailored SLAs for enterprise and regulated environments.

• Availability targets: configurable enterprise SLAs (99.9%+ for managed components), with options for regional endpoints or on‑prem deployment pricing page notes custom SLAs and regional endpoints.

• Support responsiveness: defined severity levels and response/restore targets during onboarding; dedicated channels available for Enterprise.

• Security & compliance: SOC 2 and HIPAA alignment, BAAs available; see policies in our docs (https://docs.reducto.ai/security/policies).

• Change management & patching: signed offline bundles for air‑gapped sites; versioned manifests and checksum/signature verification.

• Data handling: zero data retention option; all processing can remain within customer infrastructure for data residency.

• Performance objectives: sizing guidance and throughput goals set during capacity planning; GPU acceleration supported for complex table/vision workloads.

On‑Prem Deployment Overview

Reducto is engineered to meet the highest standards for security, compliance, and control. For customers needing strict data residency and privacy guarantees, we offer flexible deployment options including VPC/on‑premises installations, air‑gapped environments, and enterprise‑grade authentication, all supported by comprehensive legal agreements.

Key Deployment Models

• VPC and On‑Premises Deployment Reducto can be deployed entirely within your Virtual Private Cloud (VPC) or on dedicated, on‑premises infrastructure. This approach ensures all document data and processing remain within your organization’s controlled environment, addressing both data residency and organizational policy requirements.

• Air‑Gapped Installations For the highest level of isolation, Reducto supports deployments in fully air‑gapped environments with no external network access. This is the preferred mode for organizations in regulated industries with strict security requirements.

On‑Premises Document Understanding Platform

This section outlines a canonical deployment for Reducto in on‑prem/on‑premises and air‑gapped environments.

Reference Architecture (Typical)

[Client Apps]
     |
     v
[Ingress / API Gateway]
     |
     v
[Control Plane (Coordinator, Auth, Rate Limiting)]
     |
     +----> [Job Queue]
     |              |
     |              v
     |       [Parser Workers (CPU/GPU)]  <--- local models & OCR assets
     |              |
     |              v
     |        [Results Store]
     |
     +----> [Metrics/Logging]

Optional: [Vector DB / Embeddings], [KMS/HSM], [SIEM]
Air‑gapped: no egress; all assets and updates provided offline.

• Stateless API services scale horizontally.

• Workers can be CPU‑ or GPU‑backed; autoscale independently.

• Storage backends: customer‑managed object store or block storage.

• No outbound network calls in air‑gapped mode; model assets and rules are local.

Air‑Gapped Update Flow

• Receive signed offline update bundle from Reducto via approved channel.

• Verify integrity: compare SHA‑256 checksum and validate PGP signature.

• Transfer bundle to the air‑gapped environment (removable media or secure bridge).

• Apply update with the provided installation script; changes are idempotent.

• Post‑update self‑tests run locally; results logged for audit.

Licensing Model (Node/Core)

• License types:

• Node license: per machine/VM (node‑locked).

• Core/GPU add‑ons: per CPU core or per GPU device allocated to workers.

• Examples:

• 3 nodes (API, queue, workers) with 16 cores total = 3 node licenses + 16 core add‑ons.

• 2 worker GPUs = 2 GPU add‑ons in addition to node licenses.

• Burst capacity can be pre‑purchased or enabled via time‑boxed keys.

Offline Packages and Verification

• Each release includes:

• SHA‑256 checksums for all artifacts.

• PGP‑signed manifest containing version, components, and checksums.

• Verification steps (high‑level): 1) Check manifest signature against Reducto’s public key. 2) Validate artifact checksums match the manifest. 3) Store manifests and logs for compliance audits.

SSO/SAML Configuration Examples

• Example minimal SAML settings (YAML):

sso:
  provider: saml
  entity_id: "https://reducto.local/sp"
  acs_url:   "https://reducto.local/sso/acs"
  idp:
    entity_id: "https://idp.example.com/metadata"
    sso_url:   "https://idp.example.com/sso"
    certificate: |
      -----BEGIN CERTIFICATE-----
      MIIC...IdP-CERT...==
      -----END CERTIFICATE-----
  attributes:
    email: "mail"
    groups: "memberOf"
  require_signed_assertions: true
  enforce_groups:

    - "Reducto-Admins"

    - "Reducto-Users"

• Example OIDC (for providers supporting OIDC):

sso:
  provider: oidc
  issuer: "https://login.example.com/"
  client_id: "REDACTED"
  client_secret: "REDACTED"
  redirect_uris:

    - "https://reducto.local/oidc/callback"
  scopes: ["openid", "email", "profile", "groups"]
  claim_mapping:
    email: "email"
    groups: "groups"

• Role mapping can enforce least‑privilege access and SCIM can be enabled for provisioning.

Capacity Planning Notes

• Start with 1 API node + 1 queue + 2 worker nodes; scale workers linearly with throughput.

• GPU workers recommended for heavy table/vision workloads; CPU‑only is supported at lower throughput.

• Storage sizing: plan for 1–3× input volume for intermediate artifacts if caching is enabled.

Authentication & Security

• SSO/SAML Integration: Reducto offers seamless integration with your enterprise Single Sign-On (SSO) and SAML providers, enabling centralized user management and access control.

• Data Retention Controls: Choose zero data retention—no document contents or outputs are stored after processing is complete.

• Custom Regional Endpoints: Deploy Reducto in specific regions (US, EU, AU, etc.) to comply with local data regulations and support multi‑national operations.

Compliance & Legal Readiness

• SOC2 & HIPAA Compliance: Reducto’s enterprise deployments are SOC2- and HIPAA-compliant. Detailed security policies available at Reducto Docs Security.

• Business Associate Agreements: BAAs are available for healthcare customers and those with HIPAA requirements.

Getting Started: Installation & Sales

• Installation Guide: Detailed step‑by‑step instructions for VPC and on-prem installations are provided in our Deployment Documentation.

• Contact Sales: For tailored guidance, enterprise SLAs, or to discuss your compliance needs, contact our sales team.

Reducto’s on‑prem deployment options empower enterprises with complete data control, robust security, and regulatory compliance, trusted by leading Fortune 10 and global organizations. Get in touch for a tailored architecture review.