> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise Reference Architecture on FPT Cloud

> Review how a self-hosted CloudThinker Enterprise deployment is laid out in your own FPT Cloud tenant, from network to data.

CloudThinker Enterprise can run single-tenant in an FPT Cloud tenant your organization owns, reachable only from your private network. This page shows the reference design that security and platform teams review before a self-hosted deployment.

![CloudThinker Enterprise in a customer FPT Cloud tenant: a private VPC across three zones with FPT Kubernetes Engine platform and sandbox worker groups, managed PostgreSQL and Redis, and FPT Cloud services on the private network, connected to the on-premises data centre over a private connection.](https://mintcdn.com/cloudthinker/8X2SdQwL-M_9PX3m/images/deployment/enterprise-reference-architecture-fpt-cloud.png?fit=max\&auto=format\&n=8X2SdQwL-M_9PX3m\&q=85\&s=311f0b869df493094c53a275986dddc2)

CloudThinker Enterprise reference architecture on FPT Cloud

> [!NOTE]
>
> **Reference design.** Self-hosted deployments are in early access. Components, sizing, and supported services are confirmed during onboarding and can vary by release. FPT Cloud services are shown by function; the exact services are confirmed with FPT Cloud for each deployment. See [Deployment options](https://docs.cloudthinker.io/guide/deployment/overview.md).

## Layers

| Layer | FPT Cloud services | What it does |
| - | - | - |
| Connectivity | Private connection (leased line or VPN), virtual router, private DNS | Users and connections reach the deployment over your private network. There's no internet ingress. |
| Ingress | Internal load balancer | Serves the web console and API over TLS 1.2 or later. |
| Compute | FPT Kubernetes Engine with a private API endpoint, two worker groups | The platform worker group runs the web console, API, agent workers, and vector store. The sandbox worker group runs agent-generated code and connection commands. |
| Data | Managed PostgreSQL, managed Redis, S3-compatible object storage, file storage | Holds conversations, findings, the task queue, documents, and shared files, encrypted at rest. |
| AI models | FPT AI Factory, or your own FPT Cloud account through [BYOK](https://docs.cloudthinker.io/guide/byok.md) | Model calls stay with the provider account you choose. |
| Platform services | Container registry, secrets vault, key management, monitoring | Workloads reach FPT Cloud services on the tenant's private network. |
| Security and audit | Threat detection, image scanning, audit logging, configuration baseline | Your security team keeps full visibility, and logs flow to your SIEM. |
| Recovery | Backups copied to a second region | Daily backups are copied to a second region. |

## How a request flows

1. A user opens the web console over the private connection. The virtual router routes the request to the internal load balancer.
2. The API checks the user's [role](https://docs.cloudthinker.io/guide/security/roles.md) and queues the task for an agent worker.
3. CloudThinker plans each step with the model you configured. Reads run, and every write goes through [Approvals](https://docs.cloudthinker.io/guide/approvals/overview.md), which can wait for a person or refuse it.
4. Commands run in a sandbox on the sandbox worker group. Connections reach on-premises systems through the private connection, and other systems through read-only accounts you create.
5. Data, secrets, and logs stay in your environment. Backups are copied to the recovery region.

## Design principles

| Principle | How the design applies it |
| - | - |
| Private network only | No public IP address or public load balancer. |
| No long-lived credentials | Each system CloudThinker connects to uses a dedicated, read-only account you create and can revoke. |
| Keys you manage | Storage, databases, and backups are encrypted at rest, with keys you manage where FPT Cloud offers them. |
| Isolated agent code | Agent-generated code runs only in sandboxes, on nodes kept apart from the platform. |
| Approval for changes | Writes pass Approvals before they run. A read-only credential can't write at all. |
| Read-only by default | Connected systems get least-privilege read access. Add change access only where you approve it. |

## What you provide

* An FPT Cloud tenant with a dedicated project for CloudThinker.
* A private connection (leased line or VPN) from your data centre.
* An identity provider that supports SAML 2.0 or OIDC. See [Single sign-on](https://docs.cloudthinker.io/guide/security/sso.md).
* An FPT AI Factory account with approved models.

To start a self-hosted deployment, follow [Request a private deployment](https://docs.cloudthinker.io/guide/deployment/overview.md#request-a-private-deployment).

## Related

> **[Deployment options](https://docs.cloudthinker.io/guide/deployment/overview.md)**
>
> Compare the hosted cloud, Workers, and private deployments.

> **[Security and trust](https://docs.cloudthinker.io/guide/security/overview.md)**
>
> Answer a vendor security review.

> **[Approvals](https://docs.cloudthinker.io/guide/approvals/overview.md)**
>
> Control which agent writes run, wait, or are refused.

> **[BYOK](https://docs.cloudthinker.io/guide/byok.md)**
>
> Bring your own LLM provider credentials.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.