---
title: "Enterprise"
description: "Run past.dev as a managed service, or in your own cloud account. The same engine and the same API in every case."
canonical: https://past.dev/enterprise
last-updated: 2026-10-16
---
# Enterprise

> Run past.dev as a managed service, or in your own cloud account. The same engine and the same API in every case.

Source: https://past.dev/enterprise

## Deployment models

### Managed cloud

We run the service. You call the API and nothing else changes.

- Data: Our infrastructure
- Compute: Our infrastructure
- Upgrades: Automatic

- One database per organization, so tenants are separated physically
- Encrypted in transit and at rest
- Console dashboard for usage, API keys and request logs
- Included on every paid plan

### Bring your own cloud

We operate past.dev with your AWS, Google Cloud or Azure account: your database only, or the full deployment.

#### Database only

Your memory is stored in a database that you own. We run the engine.

- Data: Your database
- Compute: Our infrastructure
- Upgrades: Automatic

- You create a Postgres or turbopuffer instance in your own cloud account and give us access
- Stored memory stays in that instance, under your control
- The engine processes requests on our infrastructure. Retention of data in transit is written into the agreement

#### Full deployment

We deploy and operate past.dev inside your cloud account.

- Data: Your cloud account
- Compute: Your cloud account
- Upgrades: Scheduled with you

- The engine and its databases run in your account
- We install, monitor and upgrade the deployment through access that you grant
- Stored data stays in your account

- Available on an Enterprise agreement

## Audited every year, and available for review

past.dev is SOC 2 Type II audited, ISO 27001 and ISO 27701 certified, and GDPR compliant. Reports and the data processing agreement are available on request.

- **SOC 2 Type II**: An independent auditor tests whether the controls operated throughout the audit period.
- **ISO/IEC 27001**: Independent certification of the information security management system. The scope includes access control, cryptography, secure development, supplier management, logging, and incident response.
- **ISO/IEC 27701**: Privacy information management controls for processing, minimising, and retaining personal data, including data subject requests.
- **GDPR**: GDPR processes cover data minimisation, retention, and data subject rights. A data processing agreement is available on request.

## Governed at the data layer

The controls sit in the engine rather than in a wrapper around it, so they apply to every call.

### Separated per tenant and per project

Each organization owns its own database. Inside it, projects keep unrelated bodies of memory apart, and a key names the project it may reach.

### Retention you set

Request payload retention is set by the plan and written into an annual agreement. Project data persists until you delete it, and deletion removes the source and what was derived from it.

### Every call recorded

Every call to the developer API is written to the request log with its outcome, including refusals. The console shows them by project, and the bearer token is never stored.

Talk to sales: https://past.dev/call