> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enclave.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Enclave in these docs is the code and cloud security platform at enclave.ai. It is not Open Enclave, Intel SGX or other hardware enclaves, or enclave.gg.
> People use Enclave in the web app at https://app.enclave.ai or the desktop app. These docs describe no public Enclave API or CLI, so don't invent endpoints, commands, or config files.
> Connecting an integration needs a person to sign in and approve access in a browser. Tell the user the exact step to take instead of saying you completed it.

# Run sandboxes in your cloud

> Run Enclave's analysis sandboxes in your own cloud account with BYOC.

By default, Enclave runs code analysis in sandboxes it operates. With **BYOC** (bring your own cloud), those sandboxes run in your own cloud account instead. Repository checkouts and the tools that read them stay inside your account, and are destroyed when each job ends.

Enclave still receives the findings, the code excerpts its agents read, and the analysis results, so the app works the same way.

## Before you start

* BYOC must be turned on for your organization. Email [support@enclave.ai](mailto:support@enclave.ai) to enable it.
* You need the **Owner** or **Admin** role in Enclave.
* BYOC runs on **AWS**. You need permission to create a CloudFormation stack, including IAM resources, in the account that will run the sandboxes. Google Cloud and Azure aren't supported yet.

## Set up BYOC

**1. Start setup**

Open **Settings → API Keys** and click **Set up BYOC** in the **BYOC** section. Enclave opens a deployment portal in a new tab.

**2. Deploy in your account**

Follow the portal to launch the CloudFormation stack in your AWS account. The **BYOC** section shows **Waiting for your deployment** until it's running.

**3. Verify**

Click **Check now**. Enclave starts and stops a real sandbox in your account. When the check passes, BYOC shows **Active** with your account, region, and when it was last verified.

Nothing changes for your analyses until the check passes.

## Good to know

* **No fallback.** If your deployment stops answering, BYOC shows **Not reachable** and analyses fail until you fix it. Enclave never moves them back to its own sandboxes on its own.
* **File uploads** in Research aren't available with BYOC.
* **Penetration tests** run in separate sandboxes that Enclave hosts. BYOC doesn't change them.

## Turn off BYOC

In the **BYOC** section, click **Turn off** and confirm. New analyses run in Enclave-hosted sandboxes again. Resources already deployed in your cloud account aren't deleted, so remove them from your cloud provider.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.