Most compliance platforms make you choose between capability and control. Send your data to their cloud and you get the models, the screening and the dashboards — but your most sensitive records now live on someone else’s infrastructure. Keep everything in-house and you inherit years of data engineering.
KeplerAI resolves this with a strict split borrowed from modern data platforms and CI runners: a control plane and a data plane.
What each plane holds
The control plane is the multi-tenant SaaS we host. It holds the front end, the business backend, tenant and user metadata, RBAC, use-case definitions and the AI-agent orchestration. It never holds a single raw customer record.
The data plane is a lightweight Runner you deploy in your own environment. It holds your raw data, the compute engine (DuckDB or Spark-local), your database credentials and any trained model weights. Nothing sensitive ever leaves it.
What crosses the boundary
Only three things move from the control plane to the data plane: metadata (schemas and column statistics), code to execute, and aggregated results. Raw rows, secrets and model weights are blocked by design. This is the same boundary that lets our AI agents generate modeling code without ever seeing your data.
Why this matters
- Data residency becomes architectural, not a contractual promise. There is no copy of your data to leak.
- Your firewall stays closed. The Runner connects outbound only and pulls work.
- Compliance reviews get shorter, because the surface area a typical SaaS creates simply doesn’t exist.
If you’re evaluating compliance tooling, the first question isn’t “which models do they have?” — it’s “where does my data live when the model runs?” With a control-plane / data-plane split, the answer is always: at home.
See how the two planes talk to each other on the Platform page, or read why customer data should never leave your infrastructure.