Tenancy and locality
Define tenant isolation, approved regions, infrastructure ownership, operator location, and service dependencies.
Customer-scopedBeyond the six-tier ladder
Bee Enclave
Private, regulated, and sovereign deployment-defined precisely.
Enclave is not a seventh or larger model. It is the customer-scoped deployment mode for Hive- and Swarm-class workloads that require stronger tenancy, infrastructure, cryptographic, network, data, and operating boundaries.
Enclave engagements are arranged customer by customer. Broader self-hosted and air-gapped availability remains on the roadmap. No deployment capability is implied until it is recorded in an executed contract and customer deployment manifest.
- Intelligence
- Hive and Swarm class
- Commercial model
- Customer-scoped engagement
- Public transport
- TLS 1.3
- Sovereign path
- FIPS 203 / 204 / 205
Deployment comparison
Choose a boundary, not a buzzword.
The table separates the live hosted service from customer-scoped deployment designs. Final controls always come from the contract and deployment manifest.
Last reviewed: 22 July 2026
| Deployment | Availability | Best fit | Tenancy | Infrastructure | Key control | Network | Governance |
|---|---|---|---|---|---|---|---|
| Bee hosted cloud | Live | Public access, professional work, builders, and standard team adoption | Multi-tenant service with logical tenant isolation | Operated by HEOSSI | Service-managed per-tenant key hierarchy | Public service endpoints protected by TLS 1.3 | Published terms, privacy, DPA, security practices, and TrustHub evidence |
| Bee Regulated Cloud | Customer-scoped | Organisations that need a regulated operating posture before single tenancy | Regulated multi-tenant deployment boundary | Placement and controls defined contractually | Contract-specific key and audit arrangements | Approved access and regional requirements captured in the engagement | Order Form, DPA, security schedule, support scope, and evidence package |
| Bee Enclave Private Cloud | Customer-scoped | Private Hive- and Swarm-class workloads requiring dedicated boundaries | Single-customer deployment design | Target environment fixed in the customer deployment manifest | Key ownership and operating roles agreed per engagement | Private connectivity and ingress/egress policy scoped per customer | Contractual deployment, change, support, logging, and release controls |
| Bee Enclave Regulated | Customer-scoped | Regulated and high-assurance workloads needing stricter customer controls | Single-customer regulated deployment design | Region, services, and operators approved in the deployment manifest | Customer-controlled key arrangements available when separately contracted | Restricted network policy and auditable administrative access | Customer-specific control mapping, evidence, retention, and incident terms |
| Bee Enclave Sovereign | Customer-scoped | Sovereign and mission-critical environments requiring the strongest boundary | Dedicated sovereign deployment design | Ownership, locality, and operator boundary fixed contractually | Customer-controlled HSM and root-key patterns can be scoped | Post-quantum transport path; broader air-gapped availability is roadmap | Sovereign release approval, deployment manifest, and bespoke operating model |
Control domains
Six boundaries are designed together.
A private endpoint alone does not create a sovereign system. Enclave engagements define the technical, organisational, contractual, and operational boundary as one design.
Cryptographic control
Agree key ownership, rotation, HSM integration, certificate policy, recovery roles, and cryptographic evidence.
Network boundary
Scope ingress, egress, private connectivity, administrative paths, allowlists, and disconnected-operation requirements.
Data governance
Fix permitted data classes, processing purposes, retention, deletion, backups, retrieval indexes, and subprocessor terms.
Assurance and audit
Map required controls to evidence, logs, review cadence, release approvals, vulnerability handling, and customer reporting.
Operations and support
Contract availability, support hours, escalation, maintenance, incident response, recovery, and change-management terms.
Customer deployment manifest
The deployment boundary becomes a controlled record.
Marketing language does not set the production boundary. The manifest records the approved design and connects technical configuration to contractual obligations, release evidence, and operating ownership.
- 01Customer and workload scope
- 02Approved Bee release identities
- 03Deployment region and infrastructure owner
- 04Tenant, network, and administrative boundaries
- 05Key, HSM, certificate, and recovery ownership
- 06Permitted data classes and processing purposes
- 07Retention, deletion, backup, and export policy
- 08Logging, audit evidence, and review cadence
- 09Support, maintenance, incident, and escalation terms
- 10Release, rollback, acceptance, and change-control process
Engagement lifecycle
From workload qualification to controlled operation.
- 01
Qualify the workload
Identify users, data classes, use cases, required intelligence class, integrations, risk, and regulatory obligations.
- 02
Design the boundary
Select tenancy, region, infrastructure, identity, keys, network, storage, logging, and operational ownership.
- 03
Agree the evidence
Map controls, validation records, audit exports, testing, reporting, acceptance criteria, and review cadence.
- 04
Contract the service
Execute the Order Form, DPA, security schedule, support terms, and customer deployment manifest.
- 05
Validate before production
Complete deployment verification, access review, data-boundary tests, release acceptance, and operational readiness.
- 06
Operate under change control
Monitor the service, manage releases, review access and evidence, test response paths, and record approved changes.
Common questions
Procurement answers.
Is Bee Enclave a seventh intelligence tier?+
No. Bee has six intelligence tiers: Cell, Brood, Comb, Buzz, Hive, and Swarm. Enclave is a customer-scoped deployment mode for Hive- and Swarm-class workloads that require private, regulated, or sovereign boundaries.
Is Bee Enclave generally self-hosted or air-gapped today?+
No. Enclave engagements are scoped customer by customer. Broader self-hosted and air-gapped availability remains on the roadmap and must not be assumed from an Enclave plan name.
What fixes the final Enclave security and data boundary?+
The executed Order Form, Data Processing Addendum, security schedule, and customer deployment manifest define the approved region, infrastructure, operators, keys, network policy, retention, release identity, support, evidence, and incident terms.
Is post-quantum transport enabled on public Bee tiers?+
Public Bee uses TLS 1.3. The NIST FIPS 203, 204, and 205 post-quantum transport path is scoped to separately contracted Enclave Sovereign environments and is not claimed for public-tier transport.
Start with the boundary
Bring the workload, data classes, regions, and control requirements.
HEOSSI will determine whether hosted Bee, Regulated Cloud, or a customer-scoped Enclave design is the honest fit-and identify roadmap requirements before contracting.