Bring your own cloud
Your software. Your account. Your infrastructure.
Get a simpler way to deploy and operate applications while keeping the infrastructure in your own cloud account. Kapten’s control plane coordinates the work; your account holds the resources.
Kapten MCPWith Bosun, Warden and KaptenDiagram: Kapten’s control plane holds plans, approvals and the audit log. It reaches your cloud account only through a scoped role, in sessions of 900 seconds. Your account holds the cluster, the databases, storage, secrets and the bill.
- Workloads
- In your account and region
- Access
- One scoped role, 900 s sessions
- Billing
- Direct with your cloud provider
- Exit
- Revoke the role; resources stay
Inside the product
Ownership is part of the architecture.
Interface previews
Illustrative · sample data · Early access
Your account is the starting point
The infrastructure belongs to your organisation. Your team keeps control of the account and its relationship with the cloud provider.
See the deployment boundary
Understand what the platform coordinates and where the application runs. Make that boundary clear to engineering and security teams.
Choose where the app lives
Agree the account and deployment region alongside the team’s requirements. Include operational data flows in the review too.
Review the access you grant
Confirm the exact permissions and connection method for your setup. Give someone in your team ownership of the access lifecycle.
Bring your SaaS to customers
Plan deployments for customers who need your software in their account. Start with one repeatable pattern and a clearly scoped pilot.
Have an exit you can explain
Keep an inventory and an operating handover plan. Ownership means your team can take responsibility for the resources after Kapten.
See it in context
The boundary, made visible.
Your cloud account and deployment region define where your application infrastructure lives. Make that choice alongside your team’s data and operational requirements.
Your agent
Kapten
Your cloud
- Apps
- Databases
- Network
- Secrets
The exit, rehearsed
Revoke one role.
The cluster keeps serving.
Leaving Kapten is not a migration. Your workloads were never on our infrastructure, so the exit is an access change in your own account. Try it on the right.
- 1
Agree the handover
Decide who on your team, or which partner, takes over deployments, upgrades, backups and monitoring, before anything is disconnected.
- 2
Revoke the role
Delete the scoped role in your account. Kapten’s next request is denied by your cloud provider, not by a promise.
- 3
Keep running
The cluster, the databases and the buckets are standard resources in your account. They keep serving; your team operates them from here.
- kaptensts:AssumeRole → ok · session 900 s
- webGET / 200 · 41 ms
Who holds what
| What | Your account | Kapten control plane | After you leave |
|---|---|---|---|
| Application data | Your databases and buckets, in your region | Not needed to run your app | Stays where it is |
| Cluster & services | Run in your account | Orchestrated through the scoped role | Keep serving; your team operates them |
| Secrets | Your provider’s secret store | Written without echoing values | Stay in your account |
| Cloud bill | Your provider account, credits and commitments | Read for cost reports | Unchanged |
| Plans, approvals, audit log | n/a | Held by the control plane | Agree an export in the handover |
With your crew · Kapten MCP
Agents that work in your account, through a role you control.
Kapten MCP puts a crew of specialists inside the coding agent you already use. On Bring your own cloud, these are the ones on watch. They read and plan freely; anything that changes your infrastructure waits for your approval.
Meet the whole crewBosunInfrastructureLeads
Acts only through the scoped role in your account, on resources it created and tagged.
WardenSecurity review
Reviews the access you grant, the exposure and the data flows.
KaptenOrchestration
Keeps every change behind a plan and a named approver.
Try asking
List every resource Kapten has created in our AWS account, and show me the role and permissions it uses to reach them.
- Kapten splits the request between Bosun and Warden.
- Bosun acts only through the scoped role in your account, on resources it created and tagged.
- Warden reviews the access you grant, the exposure and the data flows.
- Plan ready. Nothing changes until you approve it.
Observe & Plan · no approvalAct · your approvalIllustrative run · early access
Workflows that use it
How it works
Agree the boundary. Then build inside it.
Each station names the crew member that owns it. Diamonds are gates: the run stops there until a person decides.
- Choose the accountBosunAgree ownership and deployment location with your team or customer.
- Gate: Access approvedReview the accessWardenConfirm the connection, permissions and operational data flows.
- Plan the operating modelKaptenAssign responsibility for releases, maintenance and recovery.
Deep dive
The ideas behind it.
Choose where workloads run
Your cloud account and deployment region define where your application infrastructure lives. Make that choice alongside your team’s data and operational requirements.
Keep the direct cloud relationship
Infrastructure usage remains on your provider’s bill. Review your existing cloud credits, commitments and discounts with the provider as you size the deployment.
Plan for the whole lifecycle
Standard infrastructure makes ownership meaningful. Keep an inventory, understand the access Kapten needs, and plan who will operate the resources if you leave.
Good to know
A little more
before you start.
Have a particular application or setup in mind? Bring it to the early-access conversation.
Talk through your setupIs BYOC the same as self-hosting Kapten?
No. BYOC describes where your workloads run. Kapten provides the management experience, while the underlying application infrastructure belongs to your account.
What happens if I stop using Kapten?
The infrastructure remains in your account. Your team takes over operations, including deployments, maintenance, backups and monitoring. Agree the handover process before disconnecting.
What access does Kapten need?
A role in your account that Kapten assumes for short sessions, scoped to the resources it manages. The exact permissions and the access model are reviewed with you during onboarding, before anything is connected.
Can I deploy in my customer’s account?
That is a core use case for SaaS vendors. Each customer deployment needs an agreed access model and operating responsibilities. Explore the SaaS vendor solution to plan a pilot.
Build with Kapten
Start with one service.
Build from there.
Tell us what you want to deploy. We review each request and follow up about fit and onboarding on your preferred cloud.
Free during early access. No card required. Cloud usage billed separately.