Compare deployment modes
Three deployment modes, one verification gate. The difference is who runs it and where. Here is the whole decision on one page.
The three modes at a glance
Two meanings of zero-egress — never blurred
Both are real; they are not the same thing:
- On-prem (Mode 1): zero-egress = as installed, DocMark sends nothing off the box — no model call, no DocMark telemetry. It runs offline once installed; keeping the box off the internet is your network’s control.
- DocMark cloud (Mode 3): zero-egress = no PII reaches the execution plane — your identity stays in the control plane; the render worker never sees it.
- Client cloud (Mode 2) is deliberately not called zero-egress: content reaches the LLM provider you bring, under your own contract.
Side by side
| Criterion | Mode 1 — On-prem | Mode 2 — Client cloud | Mode 3 — DocMark cloud |
|---|---|---|---|
| Where it runs | Your own hardware / network | Your own cloud tenant | DocMark's managed Azure |
| Who runs & manages it | You | You | DocMark |
| AI / LLM | None as installed — needs no internet; AI only if an operator enables it | Your own LLM subscription (BYO; we recommend options) | DocMark-managed, included |
| Who authors content | Your people (AI only if enabled) | AI via your LLM, or your people | AI or your people; your copilot via MCP |
| What "zero-egress" means | As installed, DocMark sends nothing off the box — keeping the box off the internet is your network's job | Not called zero-egress | No PII reaches the execution plane |
| Verification gate | local — deck gate is on by default | in your tenant — deck gate is on by default | |
| Provenance record | engine and isolation; no brand | engine; no brand version | brand version when served from the brand store |
REST API (/v1) + MCP | You run it locally | You run it in your tenant | Available now — included in every plan |
| Branded decks | Per engagement | Per engagement | Live today |
| Documents · spreadsheets · newsletters · brochures · video | Per engagement | Per engagement | Live today |
| Web one-pager | On the roadmap — not available yet | ||
| Best for | Air-gapped confidential content | AI authoring inside your own cloud boundary | Fastest start with managed AI |
Mode 1 — On-prem
- Where it runs
- Your own hardware / network
- Who runs & manages it
- You
- AI / LLM
- None as installed — needs no internet; AI only if an operator enables it
- Who authors content
- Your people (AI only if enabled)
- What "zero-egress" means
- As installed, DocMark sends nothing off the box — keeping the box off the internet is your network's job
- Verification gate
- local — deck gate is on by default
- Provenance record
- engine and isolation; no brand
- REST API (
/v1) + MCP - You run it locally
- Branded decks
- Per engagement
- Documents · spreadsheets · newsletters · brochures · video
- Per engagement
- Web one-pager
- On the roadmap — not available yet
- Best for
- Air-gapped confidential content
Mode 2 — Client cloud
- Where it runs
- Your own cloud tenant
- Who runs & manages it
- You
- AI / LLM
- Your own LLM subscription (BYO; we recommend options)
- Who authors content
- AI via your LLM, or your people
- What "zero-egress" means
- Not called zero-egress
- Verification gate
- in your tenant — deck gate is on by default
- Provenance record
- engine; no brand version
- REST API (
/v1) + MCP - You run it in your tenant
- Branded decks
- Per engagement
- Documents · spreadsheets · newsletters · brochures · video
- Per engagement
- Web one-pager
- On the roadmap — not available yet
- Best for
- AI authoring inside your own cloud boundary
Mode 3 — DocMark cloud
- Where it runs
- DocMark's managed Azure
- Who runs & manages it
- DocMark
- AI / LLM
- DocMark-managed, included
- Who authors content
- AI or your people; your copilot via MCP
- What "zero-egress" means
- No PII reaches the execution plane
- Verification gate
- Provenance record
- brand version when served from the brand store
- REST API (
/v1) + MCP - Available now — included in every plan
- Branded decks
- Live today
- Documents · spreadsheets · newsletters · brochures · video
- Live today
- Web one-pager
- On the roadmap — not available yet
- Best for
- Fastest start with managed AI
Not sure? Walk the tree
Is the content client-confidential?
- NoMode 3 — DocMark cloudzero install, web today, API/MCP available now
- Yesnext question
Do you want AI to author the content?
- No — we authorMode 1 — On-premyour hardware, no AI as installed, your people author
- Yesnext question
Can AI run inside your own cloud tenant, on your own LLM account?
- YesMode 2 — Client cloudyour tenant, bring your own LLM
- NoMode 1 — On-premyour hardware, no AI as installed, your people author
Starting on Mode 1? You can add AI later in your own cloud, with Mode 2.
Confidential-content teams that need an air gap start with Mode 1 — On-prem. Teams that want AI but must keep content in their own cloud boundary choose Mode 2 — Client cloud and bring their own LLM. Teams that want the fastest start with managed AI choose Mode 3 — DocMark cloud.