Enterprise Reference Architecture on FPT Cloud

CloudThinker Enterprise can run single-tenant in an FPT Cloud tenant your organization owns, reachable only from your private network. This page shows the reference design that security and platform teams review before a self-hosted deployment.

CloudThinker Enterprise in a customer FPT Cloud tenant: a private VPC across three zones with FPT Kubernetes Engine platform and sandbox worker groups, managed PostgreSQL and Redis, and FPT Cloud services on the private network, connected to the on-premises data centre over a private connection. — CloudThinker Enterprise reference architecture on FPT Cloud

Reference design. Self-hosted deployments are in early access. Components, sizing, and supported services are confirmed during onboarding and can vary by release. FPT Cloud services are shown by function; the exact services are confirmed with FPT Cloud for each deployment. See Deployment options.

Layers

Layer	FPT Cloud services	What it does
Connectivity	Private connection (leased line or VPN), virtual router, private DNS	Users and connections reach the deployment over your private network. There’s no internet ingress.
Ingress	Internal load balancer	Serves the web console and API over TLS 1.2 or later.
Compute	FPT Kubernetes Engine with a private API endpoint, two worker groups	The platform worker group runs the web console, API, agent workers, and vector store. The sandbox worker group runs agent-generated code and connection commands.
Data	Managed PostgreSQL, managed Redis, S3-compatible object storage, file storage	Holds conversations, findings, the task queue, documents, and shared files, encrypted at rest.
AI models	FPT AI Factory, or your own FPT Cloud account through BYOK	Model calls stay with the provider account you choose.
Platform services	Container registry, secrets vault, key management, monitoring	Workloads reach FPT Cloud services on the tenant’s private network.
Security and audit	Threat detection, image scanning, audit logging, configuration baseline	Your security team keeps full visibility, and logs flow to your SIEM.
Recovery	Backups copied to a second region	Daily backups are copied to a second region.

How a request flows

A user opens the web console over the private connection. The virtual router routes the request to the internal load balancer.
The API checks the user’s role and queues the task for an agent worker.
CloudThinker plans each step with the model you configured. Reads run, and every write goes through Approvals, which can wait for a person or refuse it.
Commands run in a sandbox on the sandbox worker group. Connections reach on-premises systems through the private connection, and other systems through read-only accounts you create.
Data, secrets, and logs stay in your environment. Backups are copied to the recovery region.

Design principles

Principle	How the design applies it
Private network only	No public IP address or public load balancer.
No long-lived credentials	Each system CloudThinker connects to uses a dedicated, read-only account you create and can revoke.
Keys you manage	Storage, databases, and backups are encrypted at rest, with keys you manage where FPT Cloud offers them.
Isolated agent code	Agent-generated code runs only in sandboxes, on nodes kept apart from the platform.
Approval for changes	Writes pass Approvals before they run. A read-only credential can’t write at all.
Read-only by default	Connected systems get least-privilege read access. Add change access only where you approve it.

What you provide

An FPT Cloud tenant with a dedicated project for CloudThinker.
A private connection (leased line or VPN) from your data centre.
An identity provider that supports SAML 2.0 or OIDC. See Single sign-on.
An FPT AI Factory account with approved models.

To start a self-hosted deployment, follow Request a private deployment.

Deployment options

Compare the hosted cloud, Workers, and private deployments.

Security and trust

Answer a vendor security review.

Approvals

Control which agent writes run, wait, or are refused.

BYOK

Bring your own LLM provider credentials.

Security and trust

Identity and access

Governance

Deployment

Enterprise Reference Architecture on FPT Cloud

Layers

How a request flows

Design principles

What you provide

Deployment options

Security and trust

Approvals

BYOK

​Layers

​How a request flows

​Design principles

​What you provide

​Related

Deployment options

Security and trust

Approvals

BYOK

Layers

How a request flows

Design principles

What you provide

Related