# Private Cloud: custom enterprise private cloud deployments

Orchestrapay Private Cloud is your own single-tenant Orchestrapay, deployed in a
private cloud in any AWS region and the availability zones you choose. It runs
on infrastructure dedicated to you, scales with your volume, keeps your payment
data in the region you pick, and exposes the same API as the shared platform.

Page: https://www.orchestrapay.com/products/private-cloud

## What it does

- **Single tenant.** Your deployment runs on its own network, compute, database
  and message queue. No other merchant shares a server.
- **Data residency by region.** Pick the AWS region your regulator or your
  customers expect. Payment data, logs and backups stay in that region.
- **Your AWS account or ours.** We deploy into a dedicated AWS account, one you
  own and can audit directly, or one we run for you.
- **Scales with your volume.** The API and workers run as container services
  spread across availability zones, scaled out as volume grows.
- **Encrypted with your keys.** Databases, secrets and logs are encrypted with
  customer-managed keys that rotate automatically.
- **Built to PCI DSS controls.** Private subnets, a web application firewall,
  TLS 1.2 or higher, tamper-proof audit logs and continuous security monitoring.

## Inside a deployment

- Edge: load balancer, web application firewall, TLS 1.2+.
- Compute: containers across availability zones, in private subnets.
- Data: MySQL with a standby in a second availability zone, encrypted, TLS-only,
  with automated backups.
- Messaging: a dedicated message broker for webhooks, retries and jobs.
- Audit: immutable, write-once logs of API activity and network flows.
- Monitoring: threat detection, vulnerability scanning and configuration checks
  against the PCI DSS standard.

## How it works

1. **Scope.** Choose the region, the availability zones, the AWS account and the
   volume to plan for.
2. **Provision.** We build the environment from reviewed infrastructure as code.
3. **Go live.** Connect your processors, migrate saved cards if you have them,
   and move traffic over. The API is the same one you integrate today.

## FAQ

- **Which regions can I deploy in?** Any AWS commercial region, in the
  availability zones you choose.
- **Does it run in my AWS account or yours?** Either: a dedicated account you
  own, or a dedicated account we operate for you.
- **How does it stay up if an availability zone fails?** The API runs in several
  zones behind a load balancer, and the database fails over to a standby in a
  second zone.
- **Is it PCI DSS compliant?** It is built to PCI DSS controls, and AWS's PCI
  DSS attestation covers the underlying host layer.
- **Do I still get new features?** Yes, on the same release as the shared
  platform, rolled out on a schedule you agree with us.
- **How is it priced?** Per deployment, based on region, redundancy and volume.

Contact: https://www.orchestrapay.com/contact