Deployment

D23 runs where your data governance requires. Two deployment models, one control plane.

Fully managed (D23 Cloud)

D23 hosts and operates your Superset instance on its own infrastructure. You get:

• Instant provisioning — live in minutes, no infra to configure.
• Automatic upgrades — D23 upgrades Superset and applies security patches without downtime.
• Managed backups — daily snapshots with point-in-time restore.
• 99.9% uptime SLA — monitored 24/7.

Your database credentials stay in your databases. D23 only stores the connection strings (encrypted). Data in flight goes directly from your database to the user's browser — it does not transit D23 servers unless you enable query caching.

Bring Your Own Cloud (BYOC)

Deploy the full D23 stack into your own cloud account so Superset, the query cache, and the metadata store all run inside your VPC. Best for regulated industries or strict data residency requirements.

AWS

• Compute: ECS Fargate or EKS, in your VPC.
• Networking: PrivateLink into your data warehouses; no public internet exposure.
• IAM: fine-grained role scoping for each service.
• Observability: CloudTrail for audit, CloudWatch for logs and metrics.

Google Cloud

• Compute: Cloud Run or GKE, in your VPC.
• Networking: Private Service Connect to BigQuery and other GCP services.
• IAM: Workload Identity Federation.
• Observability: Cloud Logging and Cloud Monitoring.

Azure

• Compute: Azure Container Apps or AKS, in your VNet.
• Networking: Private Endpoints to Azure Synapse and other services.
• Identity: Entra ID (Azure AD) integration.
• Observability: Azure Monitor and Log Analytics.

Blueprints

For ready-made, deployable architecture patterns, see the architecture blueprints. Each blueprint covers the deployment cloud, the data sources, the Superset configuration, and the security controls for a specific use case (e.g., embedded multi-tenant, private-equity portfolio analytics).