Where your data runs: Thaliq’s cloud, or your own infrastructure
The same platform can run in two places: Thaliq’s cloud, in AWS, or your own infrastructure. Here is what lives where, and what leaves.
“Where does our data go?” is the first question a serious buyer asks, and the one most AI platforms answer with a shrug and a data-processing addendum. We would rather answer it in the open.
Two places to run Thaliq
- Thaliq’s cloud, the default. We run everything, multi-tenant, in Amazon Web Services. It is the fastest way to start, and you operate nothing.
- Your own infrastructure. The same code and the same images, set to the self-hosted edition and started with Docker Compose. The services verify their license offline, and an air-gapped install loads everything from a signed bundle.
What lives where in Thaliq’s cloud
| Data | Where it lives |
|---|---|
| Conversations, agents and usage | PostgreSQL on Amazon RDS, in AWS us-east-1 (N. Virginia), encrypted at rest. Each organization’s rows are isolated from the others’ by row-level security in the database itself. |
| Live state and queues | Valkey on Amazon ElastiCache, in the same region, encrypted at rest and in transit. |
| Secrets you store, such as the credentials of your tools | In the database, encrypted with AES-256-GCM under a key of your organization, itself wrapped by a master key. |
| The language model | Claude Haiku 4.5 on Amazon Bedrock, called from Thaliq’s AWS account through a cross-region inference profile, so a request can be processed in an AWS region other than us-east-1. |
| Knowledge embeddings | Voyage AI’s API. If you use knowledge bases, the text of your sources and your users’ questions go there to be embedded. |
| Exports of your data | A private Amazon S3 bucket in the same region, encrypted, where each archive is deleted after seven days. |
| Sign-in codes, invitations and alerts | Amazon SES for email. Slack and webhooks only if you configure them. |
| The edge | Cloudflare: DNS, the network edge and a tunnel to our servers. The website and the chat widget are served from Cloudflare Pages. |
Running it yourself
When Thaliq runs in your account, the database, the queues and the object store are yours: PostgreSQL, Valkey and an S3-compatible store in the Compose bundle. The model is whichever provider you configure: Anthropic, Amazon Bedrock or OpenAI with your own account, or a model you host yourself with Ollama or vLLM, in which case inference never leaves your network.
Two things can still reach outside. Knowledge bases need Voyage AI’s embeddings API, so an installation without that key simply runs without knowledge. And whatever you connect yourself, such as tools, MCP servers, webhooks or channels like WhatsApp and Slack, receives what you configure it to receive.
Who this is for
If you are in a regulated industry, such as health, finance or the public sector, “trust us, it’s encrypted” is not an answer you can take to your security review. Being able to say where each piece of data lives, who handles it and which of those pieces you can bring inside your own perimeter is.
Thaliq’s cloud is the fastest way to start. If your risk or your regulator needs the platform inside your perimeter, write to us at [email protected]. The details are in our privacy policy and our data processing addendum, both beta drafts for now.
Jhosetp Chino
We write about how we build Thaliq: the decisions, what went wrong and what we changed. From Lima.