Bring Your Own Cloud to Replit
By Steven Van ·
Full BYOC is in private preview, while Published Apps hosting and Image Exports are in early access for enterprise customers on Azure, Google Cloud or AWS.
Replit now offers Replit in three Bring Your Own Cloud (BYOC) configurations, so enterprise teams can keep development, production, or both inside their own cloud tenant. The options work with Microsoft Azure, Google Cloud and Amazon Web Services, and Replit describes the goal as giving security and platform teams more isolation and control while keeping the familiar Replit experience.
Full BYOC (private preview)
Full BYOC runs the whole Replit platform and published project hosting in the customer's cloud tenant. The platform includes compute, storage, the file system, integrations and the Agent harness, which together power project building, connectors, scheduled agents, publishing and other knowledge work.
It works by deploying Replit "cells", the isolated infrastructure units of Replit's cellular architecture, into the customer's cloud. The Agent harness sits inside the cell. Replit says this lets the security team govern which internal resources the Agent reaches and apply controls to outbound connections, and that colocating the harness with compute removes network latency. Replit calls it the most comprehensive option and the one that needs the most upfront setup.
BYOC for Published Apps (early access)
Published projects are hosted in the customer's cloud tenant, while Replit continues to manage the platform itself. Administrators choose the publishing destination for each Replit Workspace. Builders still click "Publish" as before.
- Production apps can connect to private databases in the customer environment.
- All infrastructure backing the projects has private endpoints and can be reached through the company network or VPN.
- Security teams can inspect deployed workloads and dependencies with their existing cloud security tools.
- Replit provisions and manages the infrastructure as code, with primitives such as object storage, caching, message queues and scheduled jobs.
Secure tunnels connect Replit to resources in the customer tenant over private networking. They use mTLS on the tunnel plus mTLS between communicating services, and they only connect outwards, so no publicly accessible ingress is needed. Replit encrypts all storage types. Customer-managed encryption keys (CMEK), which the customer can revoke at any time, are available to customers whose agreement includes full physical isolation of the Replit Cell.
Image Exports (early access)
Projects set to use Image Exports produce a Docker image, a Terraform file and an SBOM that an infrastructure team can use to deploy the app in its own cloud. Builders still press "Publish", which starts a customizable review process for security and compliance. The published app does not call back to the Replit platform, which suits restricted environments.
The customer's team deploys and operates the app itself, and has to supply building blocks Replit normally provides, such as managed auth and connectors. Replit says Agent can be customized with Skills and Project Memory for this setup. Image Exports can be combined with BYOC for Published Apps, so admins can control how each project is published.
Availability
Full BYOC is in private preview, and BYOC for Published Apps and Image Exports are in early access, all for enterprise customers. Organizations can have different environments for different business units: one workspace can run in a Replit-managed cell with CMEK while another runs in the customer's cloud. Interested teams are directed to Replit's enterprise team and the BYOC documentation.
