Enterprise Reference Architecture on Google Cloud

CloudThinker Enterprise can run single-tenant in Google Cloud projects your organization owns, reachable only from your private network. This page shows the reference design that security and platform teams review before a self-hosted deployment.

CloudThinker Enterprise in a customer Google Cloud organization: a private VPC across three zones with GKE platform and sandbox node pools, Cloud SQL for PostgreSQL, Memorystore, and Google Cloud services reached through Private Service Connect, connected to the on-premises data centre over Cloud Interconnect. — CloudThinker Enterprise reference architecture on Google Cloud

Reference design. Self-hosted deployments are in early access. Components, sizing, and supported services are confirmed during onboarding and can vary by release. See Deployment options.

Layers

Layer	Google Cloud services	What it does
Connectivity	Cloud Interconnect or Cloud VPN, Cloud Router, Cloud DNS	Users and connections reach the deployment over your private network. There’s no internet ingress.
Ingress	Internal load balancer	Serves the web console and API over TLS 1.2 or later.
Compute	Google Kubernetes Engine as a private cluster, two node pools across three zones	The platform node pool runs the web console, API, agent workers, and vector store. The sandbox node pool runs agent-generated code and connection commands.
Data	Cloud SQL for PostgreSQL, Memorystore, Cloud Storage, Filestore	Holds conversations, findings, the task queue, documents, and shared files, encrypted with keys you manage.
AI models	Vertex AI	Model calls stay in the project and region you choose.
Google Cloud APIs	Private Service Connect and Private Google Access for Artifact Registry, Secret Manager, Cloud KMS, and Cloud Storage	Workloads call Google Cloud without leaving the private network.
Security and audit	Security Command Center, VPC Service Controls, Cloud Audit Logs, Organization Policy	Your security project keeps full visibility, and logs flow to your SIEM.
Recovery	Backup and DR with a vault in a recovery region	Daily backups are copied to a second region.

How a request flows

A user opens the web console over Cloud Interconnect or VPN. Cloud Router routes the request to the internal load balancer.
The API checks the user’s role and queues the task for an agent worker.
CloudThinker plans each step with the model you configured. Reads run, and every write goes through Approvals, which can wait for a person or refuse it.
Commands run in a sandbox on the sandbox node pool. Connections reach on-premises systems through the Shared VPC, and other projects through a read-only role granted to CloudThinker’s service account.
Data, secrets, and logs stay in your environment. Backups are copied to the recovery region.

Design principles

Principle	How the design applies it
Private network only	No public IP address or public load balancer.
No long-lived credentials	Each workload uses its own service account through Workload Identity. Other projects are reached through roles you grant and can revoke.
Keys you manage	Cloud KMS keys in your project encrypt the database, cache, storage, and logs.
Isolated agent code	Agent-generated code runs only in sandboxes, on nodes kept apart from the platform.
Approval for changes	Writes pass Approvals before they run. A read-only credential can’t write at all.
Read-only by default	Connected systems get least-privilege read access. Add change access only where you approve it.

What you provide

A Google Cloud organization with a Shared VPC host project and separate security and workload projects.
Cloud Interconnect or Cloud VPN from your data centre.
An identity provider that supports SAML 2.0 or OIDC. See Single sign-on.
Access to approved Vertex AI models in your region.

To start a self-hosted deployment, follow Request a private deployment.

Deployment options

Compare the hosted cloud, Workers, and private deployments.

Security and trust

Answer a vendor security review.

Approvals

Control which agent writes run, wait, or are refused.

BYOK

Bring your own LLM provider credentials.

Security and trust

Identity and access

Governance

Deployment

Enterprise Reference Architecture on Google Cloud

Layers

How a request flows

Design principles

What you provide

Deployment options

Security and trust

Approvals

BYOK

​Layers

​How a request flows

​Design principles

​What you provide

​Related

Deployment options

Security and trust

Approvals

BYOK

Layers

How a request flows

Design principles

What you provide

Related