Choose a deployment
Every System9 capability is designed to hold across the full deployment matrix, not a corner of it. Choosing a deployment means fixing four decisions: your posture, your scale, your connectivity, and, where you run at the edge, your device profile. This page is the decision guide; each decision maps to a real platform preset or default.
The four decisions at a glance
| Decision | Options | Default |
|---|---|---|
| Posture | Commercial · Sovereign · Tactical | Commercial (deployment presets default to Sovereign) |
| Scale | Single cell · Multi-cell fleet (elastic in and out) | Single cell |
| Connectivity | Cloud-enabled · Sovereign / on-premises · Fully air-gapped | Sovereign / on-premises |
| Edge profile | Sensor · Agent · Operator · Tactical | Agent |
These axes are independent. Single-cell air-gapped and multi-cell cloud are both first-class product configurations, not a "corner" you compromise into.
How a cell is delivered
Before the four decisions, one fact that constrains all of them: System9 ships as machine images, not containers. A cell is a complete instance baked into a bootable cloud image or on-premises VM image. There is no container to compose, no registry to reach at boot, and no self-serve download. Both licence tiers are sales-negotiated, so the image and licence come from your System9 account team.
The Edge Agent is the exception, and deliberately so: it is a single statically linked binary, because a field device is not a place you deploy an image to.
Decision 1: Posture
The deployment posture drives licensing, phone-home defaults, and export (ITAR) gates. It is the highest-order choice because it changes what the platform will refuse to do.
| Posture | Who it is for | What changes |
|---|---|---|
| Commercial | Standard cloud and enterprise deployments | The default; phone-home support is available (still off unless enabled) |
| Sovereign | Government, defense, healthcare, finance: data, identity, and keys must stay inside a controlled boundary | Phone-home telemetry is redacted; export/ITAR gates engage; the profile resolver tightens defaults |
| Tactical | Forward-edge, disconnected, and air-gapped operation | The most restrictive: air-gap assumed, outbound egress fails closed, compiled-in classification red lines that no update can override |
Turnkey deployment presets, the versioned bundles that pre-select feature groups, cell profile, AI profile, and sizing, default the deployment profile to Sovereign, not Commercial. The sovereign, air-gapped case is the deployment the product is built for; the cloud case is the convenience, not the baseline.
Decision 2. Scale: single cell or a fleet
A cell is a complete instance of the platform with its own local databases, the unit of deployment, not a worker node. You can run exactly one, or many.
- Single cell. The whole platform on one instance. Everything works here; you scale out later without changing the model.
- Multi-cell fleet. Cells group into service groups and nodes, join a self-registering fabric, and scale elastically in and out. Cells are either permanent or ephemeral, ephemeral cells are launched in large batches for a single job and decommissioned with an expedited purge, so per-cell startup cost matters at a hundred-at-a-time scale.
Any capability that holds single-cell must also hold multi-cell; see The cell model and Deployment topology.
Decision 3: Connectivity
Connectivity is independent of posture and scale. The platform is built so that nothing requires a round trip to decide, offline authorization, signature verification, and classification all evaluate locally.
| Connectivity | What it means | How System9 handles it |
|---|---|---|
| Cloud-enabled | Continuous reachback | Online key provisioning and relay are conveniences, not requirements |
| Sovereign / on-premises | Inside a controlled boundary, intermittent or no internet | The default; the full platform runs with no external dependency |
| Fully air-gapped | No network path off the premises at all | A first-class path: signed bundles cross on removable media, verified offline against trust roots the device already holds; work done while dark is spooled and rides home when a link returns |
The air-gapped case is not a degraded mode. Enrollment, model provisioning,
catalog updates, field-manual briefings, certificate revocations, fleet releases,
and Data Exchange listings all have a verified, offline courier route, the
apply-bundle / apply-object / apply family of commands. See
Enroll an edge device and operate it air-gapped.
Decision 4: The edge device profile
If you are deploying the Edge Agent, its profile sets the security floor for the device class.
| Profile | Typical device | Character |
|---|---|---|
| Sensor | Constrained capture device | Minimal surface; capture and forward |
| Agent | Workstation / gateway (default) | The general on-device operator agent |
| Operator | Trusted operator workstation | Also mints presence delegations and signs release material |
| Tactical | Forward-edge kit | FIPS, mesh, TPM, radio, zeroize; the air-gapped posture disables the s9 run daemon's heartbeats and bounds local ticks; compiled-in red lines |
The tactical profile's zeroize is software-only and is not capture-resistant. Where physical capture is in the threat model, pair it with hardware key custody; do not rely on software zeroize alone.
Core and edge are one product
A cell is a full System9 instance. The Edge Agent is the on-device agent that reads from a cell, or runs sovereign with no cell at all. An edge deployment can also deploy one or more cells at the site, in the same rack or zone as the devices, so the complete data platform runs locally with no cloud in the loop. The Edge Agent is verify-and-operate; the site cell is the local data plane. A cell does not run on the device itself. See Core and edge.
Worked choices
| If you are… | Posture | Scale | Connectivity | Edge profile |
|---|---|---|---|---|
| A commercial team evaluating on one cloud host | Commercial | Single cell | Cloud-enabled | None (or Agent) |
| A regulated enterprise on-premises | Sovereign | Multi-cell | Sovereign / on-prem | Agent / Operator |
| A field unit with intermittent links | Tactical | Multi-cell | Fully air-gapped | Tactical |
| A consultant assessing a customer estate from a laptop | Sovereign | Single cell | Sovereign / on-prem | Agent |
Next steps
- Quickstart: your first cell, launch a cell and confirm it is serving.
- Quickstart: your first device, attach an Edge Agent to it.
- Tutorials, end-to-end runnable walkthroughs.
- Deployment topology, reference topologies, including cells placed at an edge site.
- The cell model, the instance model behind single- and multi-cell.