> ## Documentation Index
> Fetch the complete documentation index at: https://docs.declaw.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment

> How to run Declaw: managed cloud at api.declaw.ai or on-prem via the enterprise team.

Declaw is available as a managed cloud service and, for enterprise customers, as an on-prem deployment operated by the Declaw team.

## Declaw Cloud

The fastest way to start. Sign up at [declaw.ai](https://declaw.ai), grab an API key, and point the SDK at the production endpoint:

```bash theme={null}
export DECLAW_API_KEY=<your-key>
export DECLAW_DOMAIN=api.declaw.ai
```

```python theme={null}
from declaw import Sandbox

sbx = Sandbox.create()
print(sbx.commands.run("echo hello").stdout)
sbx.kill()
```

No infrastructure to manage. sandbox microVMs, the security proxy, guardrails, and all control-plane services run inside Declaw's environment. Billing is per-sandbox-hour with a per-API-key wallet — see [Quickstart](/quickstart) for details.

## Enterprise on-prem

For teams with data-residency, compliance, or network-isolation requirements, Declaw can be deployed inside your own cloud account or data center. The Declaw team handles the install, upgrades, and ongoing operations — you get a dedicated control plane and orchestrator nodes that never leave your perimeter.

On-prem is a white-glove engagement and is not self-service. If you need it, [contact sales](mailto:team@declaw.ai) to start the conversation.

<Card title="Talk to sales" icon="envelope" href="mailto:team@declaw.ai">
  Discuss on-prem deployment, compliance (SOC 2, HIPAA), and custom SLAs.
</Card>

## What you get either way

Regardless of whether you run on cloud or on-prem, every Declaw deployment includes:

| Component          | Role                                                                |
| ------------------ | ------------------------------------------------------------------- |
| Sandbox Manager    | REST API for sandbox + template lifecycle                           |
| Orchestrator       | sandbox VM lifecycle, network isolation, per-sandbox security proxy |
| Guardrails         | ML scanner service — PII, prompt injection, toxicity, code security |
| envd               | In-VM daemon for filesystem, process, and PTY access                |
| PostgreSQL + Redis | Sandbox state, routing, sessions                                    |

The full request flow, security pipeline, and isolation model are documented under [Architecture](/architecture/overview).