Platform hub: modern secure AI-first architecture

One AI-first architecture, from multi-tenant SaaS to fully air-gapped

BigID is cloud native from the ground up and portable to cloud VPCs and data centers, with AI models decoupled from the platform and APIs built as MCP interfaces, so agents and headless operation are part of the design. The result is one BigID software build that runs anywhere from multi-tenant SaaS to a fully air-gapped deployment, with equivalent discovery, classification, remediation, and AI governance in each.

Book an architecture walkthrough ▶Watch it work Take a tour

Deployment

One build, every deployment

Multi-tenant SaaS through fully air-gapped on-premises, with equivalent capability in each mode

Data and AI residency

30+ countries

Data ringfenced inside the country or region your regulator names, on the same platform

Programmatic surface

API and MCP

Reach the platform through APIs and MCP tools, with fine grained RBAC on each service

Why architecture became the buying question

Residency, model choice, and isolation requirements are all answered by how the software is built

Data security platforms used to be judged on features and scan coverage. That judgement has moved down a layer: regulators started naming the country data has to sit in, boards started treating dependence on a single model provider as concentration risk, and federal and defense programs started requiring isolation beyond what a SaaS control plane offers. Each one is answered by how the software is built.

BigID runs in full inside your boundary

Governance stays yours when it runs on your approved model and keeps its logs in your boundary. That is why BigID in an air-gapped deployment delivers the same discovery, classification, remediation, and AI governance as BigID SaaS.

Agents operate the platform

APIs became MCP interfaces with tools that go past reporting into operations, which lets an agent work the platform under a scoped identity.

Capacity follows the workload

Outposts became ephemeral and Kubernetes native, hundreds to a cluster. Capacity follows the workload, so a bursty quarter-end scan is paid for when it runs.

See how it is built

Watch it work

BigID's API-First Architecture and MCP

How the API layer, with its role-based access controls and audit logging, underpins MCP support: cloud and local MCP servers, documentation and sample prompts, extensibility for partners and customers, and an agentic risk assessment run through MCP.

Architecture

Watch next

Prefer to click through it yourself?

See BigID's APIs and MCP server in use, then connect your own AI tool and run an assessment from one prompt.

Take a tour

From multi-tenant SaaS to fully air-gapped, BigID delivers equivalent capability in each deployment

BigID separates where the software runs from what the software does, so each deployment runs the same product.

BigID air-gapped runs the same software as BigID SaaS, so every deployment gets the current product.

BigID keeps telemetry, logs, and model calls inside your boundary, so governance runs on your terms.

Outposts spin up for the scan and down afterward, so capacity follows the workload instead of the peak.

The left column is what BigID ships, once: a cloud native build with decoupled AI models, so classification and analysis can run on a model you have already approved, interfaces exposed as MCP and API, and outposts that do the processing where the data already is. The middle column is where that runs, from multi-tenant SaaS to fully air-gapped. The right column is what stays constant across them: a fully air-gapped deployment classifies against the same categories, enforces the same policies, and exposes the same MCP tools as the multi-tenant SaaS.

Start here

Start with where it has to run

Can we run this where our regulator says our data has to stay? Multi-tenant SaaS with full data segregation options, data ringfenced inside any of 30+ countries, and single tenant full isolation set as a deployment flag on the same product. Deployment modes → Do we get the full product in our own VPC, or air-gapped? Self-managed in a VPC and fully air-gapped on-premises run the same software as the SaaS, with equivalent discovery, classification, remediation, and AI governance, while telemetry and model calls stay inside your boundary and BigID runs on its own. Deployment modes → How does capacity follow the workload? Cloud outposts spin up and down dynamically with the workload, so capacity is sized for the work in front of it instead of the peak. On-premises outposts are fully Kubernetes native and scale to hundreds in a cluster. Local processing → Does our data stay in our environment to get classified? Yes. BigID processes data locally at the outpost and scans it in place; side and snapshot scans run behind a security layer that isolates the customer from the vendor, and snapshot scanning does not require admin level access. Local processing → Can our agents operate BigID as well as read from it? MCP plus tools, so the surface goes past reporting into operations, and those tools are extensible by customers and partners. Agentic operation lets business users request and run the work from inside Claude, GPT, Copilot, or Gemini, scoped by their role. API and MCP → How is what an agent can reach scoped? Fine grained RBAC on every API and MCP service, so what an application, an agent, or an AI user can see and do is scoped. Agents reach data through the identities associated with them, and every interaction is logged. API and MCP →

Capabilities

One architecture, from deployment to product security

Where the software runs, where the processing happens, what the programmatic surface looks like, how it is operated day to day, what comes out of it, what an agent can do with it, and how it is secured.

Same software, any deployment

A cloud-native SaaS that deploys more than one way, so scale and sovereignty come together. The isolation level is configuration; the product is the same product.

Multi-tenant SaaS with full data segregation options
Data ringfenced within any of 30+ countries for residency and sovereignty requirements
Single tenant full isolation is a deployment flag, not a separate product line
Self-managed in your own VPC, running the exact same software
Fully air-gapped on-premises, running the exact same software
FedRAMP environments run that same software too
Equivalent discovery, classification, remediation, and AI governance in every mode
BigID runs on its own, with telemetry and model calls kept inside your boundary
AI models decoupled from the platform, so they can be swapped or supplied by you
Bring your own AI, so classification and analysis run on a model you choose

Outposts and local processing

The outpost is where the reading happens, next to the data, inside your environment. They were rebuilt as ephemeral in the cloud and Kubernetes native on premises, which is what lets bursty and petabyte workloads run smoothly.

Cloud outposts scale to hundreds per cluster natively
In the cloud, outposts spin up and down dynamically, so capacity is used only while scanning
On-premises outposts are fully Kubernetes native and scale to hundreds in a cluster
Outposts support hundreds of different data sources and formats natively
Outposts can run metadata only scans, smart sampling, configured sampling, and full scans
Side and snapshot scans run behind a proprietary security layer that isolates the customer from the vendor
Separate local authentication for each local outpost
Processing stays local, so customer data is scanned where it lives

API and MCP architecture

The APIs were rebuilt as MCP interfaces so headless and agent-first operation is native. MCP made BigID accessible to AI; tools on top of it are what make BigID operable by AI, under permissions you set.

API coverage across the platform
Cloud and local MCP server options, so the interface can sit inside your boundary
MCP plus tools, so access reaches past reporting into operations
Tools are extensible by customers and by partners
Fine grained RBAC on every API and MCP service, scoping what applications, agents, and AI users can reach and do
Agents reach data through the identities associated with them
Context for AI workflows: the interface delivers metadata and classification insight
Audit logging on every AI interaction: who accessed what, when, and how

Enterprise-class operations

Scanning runs as an operational system. Frequency, blackout windows, exclusions, and triggers are all configuration, with telemetry on the run and an audit trail on the change.

Rapid setup and dynamic data discovery
Scan configurability including sampling rate, frequency, blackout windows, data exclusions, event triggers, and change based scans
Customer data is scanned in place and stays in your environment
Full localization of processing with outposts
Delegated review and remediation, under RBAC restrictions
Full scan and accuracy telemetry, while the scan runs
Integrated agentic ops automation
Change audit across configuration and policy

Reporting and investigations

Reporting reaches the places decisions get made: the warehouse, the BI tool, and the assistant, all on the same data the scan produced.

In-product reporting, customizable by persona
Native support for Tableau and Power BI
Integrated ETL into data warehouses and data lakes for advanced analytics
Bespoke reporting in plain language through Claude, Copilot, and GPT
Breach investigation: impact radius and data flow inference on a real incident
Data and access exposure investigation, using the same AI features

Agentic operationalization

The layer that makes the platform operable from the assistant a team already works in. What each agent can do is bounded by the role and permissions behind it.

Business users request and operate the product from inside AI, according to role and permissions
Works with Claude, GPT, Copilot, and Gemini
AI workflows automate remediation and surface it in the tools people already watch, including Teams
Native BigID agents for simplified automation and advanced analysis
Simplified third party integration across the rest of the stack

Product security

A security architecture review opens on this group: keys, credentials, access paths, and what the vendor can see.

FedRAMP authorized
Certifications including SOC 2, ISO 27001, PCI DSS, and HIPAA
Full bring your own keys support
Customer data stays where it lives, on premises or in the cloud
RBAC protected review and remediation
Password vault support, so scan credentials stay where your team keeps them
Fully air-gapped deployment option for AI sovereignty use cases
Secure snapshot scanning that does not require admin level access
Separate local authentication for local outposts

Verification

Certifications, controls, and capabilities across deployment modes

Across deployment modes

BigID can govern data and AI entirely inside a customer's own environment, using the models you approve to perform the work
Runs fully air-gapped, with discovery, classification, and governance operating with zero outbound connectivity required
The same architecture runs across cloud, on-premises, private cloud, and air-gapped deployments, with equivalent discovery, classification, remediation, and AI governance in every mode

And from outside

Frost & Sullivan 2025 Company of the Year for AI Governance
Forrester scored BigID the highest possible 5 out of 5 on secure-by-design commitments in The Forrester Wave™: Sensitive Data Discovery And Classification Solutions, Q2 2026

See the Forrester scoring →

What a security review checks

Certifications and authorizations

✓FedRAMP authorized
✓SOC 2
✓ISO 27001
✓PCI DSS
✓HIPAA

Controls on the architecture itself

✓Bring your own keys
✓Password vault support
✓Customer data scanned in place
✓Snapshot scanning without admin access
✓RBAC on every API and MCP service
✓Separate local outpost authentication
✓Audit log on every AI interaction
✓Air-gapped option

FAQ

Answers on air-gapped deployment, AI models, and MCP access

Does the air-gapped version run the full build?

Yes, it is the same software. Self-managed in a VPC, FedRAMP, and fully air-gapped on-premises all run the same BigID software as multi-tenant SaaS, with equivalent discovery, classification, remediation, and AI governance. Isolation is set as a deployment flag, so the sovereign deployment stays on the same release train as everything else.

Which AI models does BigID run on?

The models are decoupled from the platform, so you choose. They can be swapped or supplied by you, so classification and analysis run on a model your own review has already approved. BigID air-gapped deployments run with zero outbound connectivity, keeping telemetry and model calls inside your boundary, so a governance tool does not become its own concentration risk.

What does exposing BigID over MCP give agents access to?

What you scope, service by service. There is fine grained RBAC on every API and MCP service, so an application, an agent, or an AI user reaches the functions and data its identity allows. Agents reach data through the identities associated with them, the interface delivers context and metadata for AI workflows, every interaction is logged, and the MCP server can run locally so the interface stays inside your boundary. AgentIQ builds on this surface for agent-driven operation.

Which deployment options does BigID support?

Multi-tenant SaaS through fully air-gapped on-premises, all from one software build. That includes SaaS with full data segregation options, residency ringfenced SaaS, single tenant full isolation, self-managed deployment in your own VPC, FedRAMP environments, and fully air-gapped on-premises, with equivalent discovery, classification, remediation, and AI governance in each.

Can BigID keep data and AI processing inside a specific country?

Yes, data can be ringfenced within any of 30+ countries. That covers residency and sovereignty requirements on the same platform, and the air-gapped option extends it to environments with no outbound connectivity. The AI and data sovereignty page covers the wider program.

Does data leave our environment to get classified?

Processing stays local to the outpost. BigID scans customer data in place. Side and snapshot scans run behind a security layer that isolates the customer from the vendor, snapshot scanning does not require admin level access, and each local outpost has its own authentication. The result is metadata and classification insight, while raw data stays inside your boundary.

Which AI assistants can operate BigID?

Claude, GPT, Copilot, and Gemini. Business users can request and run work from inside the assistant they already use, scoped by their role and permissions, and AI workflows can surface remediation in tools such as Teams. AgentIQ covers the agent experience in detail.

Which certifications and authorizations does BigID hold?

FedRAMP authorized, with SOC 2, ISO 27001, PCI DSS, and HIPAA coverage. Controls on the architecture itself include bring your own keys, password vault support, snapshot scanning without admin access, RBAC on every API and MCP service, separate local outpost authentication, and an audit log on every AI interaction. The BigID Trust Center has the detail a security review asks for.

Take it further

Where to go deeper on the architecture

Trust Center / start here

The BigID Trust Center

Security practices, independent assessments, and responsible AI policy in one place, including SOC 2, ISO 27001, and PCI DSS, plus the certification and vulnerability management detail a security review asks for line by line.

Open the Trust Center →

Solution brief The BigID MCP Server for AI How agents get governed data context instead of raw data, with token based authentication, RBAC, scoped policies, and an audit record of every interaction. Read the brief → Announcement BigID delivers the AI sovereignty standard The August 2026 release: governing data and AI entirely inside your own environment, air-gapped, with no third party model dependency. Read the release → Free assessment Run it against your own environment An agentless, cloud native assessment that pinpoints where sensitive data and AI risk live, in the deployment mode you would actually use. Start it →

Tell us where it has to run.

A residency rule, a no-egress network, a model your security team has already approved, or a cluster that has to absorb a quarter-end burst. The architecture walkthrough is scoped to the deployment you actually want, and each deployment mode runs the same software.

Book an architecture walkthrough Get a free risk assessment