Deployment

Declaw Cloud

The fastest way to start. Sign up at declaw.ai, grab an API key, and point the SDK at the production endpoint:

export DECLAW_API_KEY=<your-key>
export DECLAW_DOMAIN=api.declaw.ai

from declaw import Sandbox

sbx = Sandbox.create()
print(sbx.commands.run("echo hello").stdout)
sbx.kill()

No infrastructure to manage. sandbox microVMs, the security proxy, guardrails, and all control-plane services run inside Declaw’s environment. Billing is per-sandbox-hour with a per-API-key wallet — see Quickstart for details.

Enterprise on-prem

For teams with data-residency, compliance, or network-isolation requirements, Declaw can be deployed inside your own cloud account or data center. The Declaw team handles the install, upgrades, and ongoing operations — you get a dedicated control plane and orchestrator nodes that never leave your perimeter.

On-prem is a white-glove engagement and is not self-service. If you need it, contact sales to start the conversation.

Talk to sales

Discuss on-prem deployment, compliance (SOC 2, HIPAA), and custom SLAs.

What you get either way

Regardless of whether you run on cloud or on-prem, every Declaw deployment includes:

Component	Role
Sandbox Manager	REST API for sandbox + template lifecycle
Orchestrator	sandbox VM lifecycle, network isolation, per-sandbox security proxy
Guardrails	ML scanner service — PII, prompt injection, toxicity, code security
envd	In-VM daemon for filesystem, process, and PTY access
PostgreSQL + Redis	Sandbox state, routing, sessions

The full request flow, security pipeline, and isolation model are documented under Architecture.

Getting Started

Core Features

CLI

Security

Platform

Architecture

Deployment

Declaw Cloud

Enterprise on-prem

Talk to sales

What you get either way

​Declaw Cloud

​Enterprise on-prem

Talk to sales

​What you get either way

Declaw Cloud

Enterprise on-prem

What you get either way