Skip to main content
By default, Enclave runs code analysis in sandboxes it operates. With BYOC (bring your own cloud), those sandboxes run in your own cloud account instead. Repository checkouts and the tools that read them stay inside your account, and are destroyed when each job ends. Enclave still receives the findings, the code excerpts its agents read, and the analysis results, so the app works the same way.

​
Before you start

  • BYOC must be turned on for your organization. Email support@enclave.ai to enable it.
  • You need the Owner or Admin role in Enclave.
  • BYOC runs on AWS. You need permission to create a CloudFormation stack, including IAM resources, in the account that will run the sandboxes. Google Cloud and Azure aren’t supported yet.

​
Set up BYOC

1

Start setup

Open Settings → API Keys and click Set up BYOC in the BYOC section. Enclave opens a deployment portal in a new tab.
2

Deploy in your account

Follow the portal to launch the CloudFormation stack in your AWS account. The BYOC section shows Waiting for your deployment until it’s running.
3

Verify

Click Check now. Enclave starts and stops a real sandbox in your account. When the check passes, BYOC shows Active with your account, region, and when it was last verified.
Nothing changes for your analyses until the check passes.

​
Good to know

  • No fallback. If your deployment stops answering, BYOC shows Not reachable and analyses fail until you fix it. Enclave never moves them back to its own sandboxes on its own.
  • File uploads in Research aren’t available with BYOC.
  • Penetration tests run in separate sandboxes that Enclave hosts. BYOC doesn’t change them.

​
Turn off BYOC

In the BYOC section, click Turn off and confirm. New analyses run in Enclave-hosted sandboxes again. Resources already deployed in your cloud account aren’t deleted, so remove them from your cloud provider.