BYOK Overview
NearSync offers two deployment models: Managed and BYOK / Self-hosted. This section covers BYOK - the model where you own and control your entire data infrastructure.
What is BYOK?
In the BYOK model, you bring the infrastructure, not a specific vendor: the NearSync data plane (PostgreSQL plus the platform services) runs on cloud infrastructure you own, in the region you choose. NearSync never stores your production data on NearSync-owned infrastructure.
The same application code powers both Managed and BYOK deployments. The difference is where the data plane lives:
- Managed: NearSync hosts your data in NearSync's cloud. Tenant isolation is enforced via
org_idcolumns and Row-Level Security policies. - BYOK: The data plane runs on your infrastructure. You choose the provider and region, you hold the keys, and you control backups.
Supported providers
| Provider | Regions relevant to residency |
|---|---|
| Amazon Web Services | UAE (me-central-1), Bahrain, Mumbai, all EU regions, and beyond |
| Google Cloud | Dammam (in-Kingdom Saudi Arabia), Doha, all EU regions |
| Microsoft Azure | UAE North, Saudi regions, all EU regions |
| Oracle Cloud (OCI) | Jeddah, Abu Dhabi |
| STC Cloud / SCCC | Saudi sovereign cloud, for local-operator mandates |
| On-premises | Enterprise tier, scoped per deployment |
Two paths within BYOK:
- Managed-platform path (fastest): the data plane runs as a managed PostgreSQL platform project inside your chosen region - you own the account and the keys, setup takes an onboarding call. The setup guide covers this path.
- Dedicated cloud-account path (enterprise): NearSync deploys the containerized data plane directly into your AWS / Google Cloud / Azure / OCI / STC account. Arranged with our team; required for in-country mandates the managed platform's regions cannot satisfy (for example in-Kingdom KSA).
How It Works
BYOK setup is a four-step process:
1. Create Your Supabase Project
You create a Supabase project in the region of your choice (US, EU, Middle East, Asia Pacific, etc.). See Supabase Setup for a step-by-step guide.
2. One-Time Schema Setup
During the onboarding call, you provide your Supabase URL and keys via the secure Setup tab in the NearSync client portal. NearSync runs database migrations (schema creation) against your database. This is a one-time operation. See Schema Migration for details on what gets created.
3. Keys Are Discarded After Setup
Your privileged database key is used once during provisioning (schema creation, initial admin user, manifest seeding) and then immediately discarded. NearSync does not store it. You can - and should - rotate your key immediately after setup.
4. Same App Code, Your Database
The NearSync application (admin dashboard and client portal) connects to your Supabase using your public key, which only has RLS-restricted access. All data lives in your database, in your Supabase project, in your chosen region.
What NearSync CAN Access
After setup, NearSync's access to your deployment is limited to metadata-only health monitoring via Sentinel v2.
Sentinel v2 Heartbeat
A lightweight Supabase Edge Function deployed to your project during setup. It exposes a single endpoint that returns:
- Active user count (number only, not names)
- Deals created in the last 7 days (count only, not details)
- Current instance tier
- Industry vertical
- App version
- Heartbeat timestamp
No names, no emails, no deal values, no messages, no documents, no financial data.
Heartbeat Security
- Protected by signed JWT (only NearSync's master instance can call it)
- Polled hourly, not continuously
- Returns aggregate counts only - no row-level data, no PII
Your Control
You can disable or remove Sentinel at any time by deleting the edge function from your Supabase project. This is a standard Supabase CLI command. The NearSync application will continue to function normally without it.
What NearSync CANNOT Access
In a BYOK deployment, NearSync has zero access to:
- Your database contents (contacts, deals, messages, documents, invoices, employee records)
- Your authentication data (user emails, passwords, sessions)
- Your file storage (uploaded documents, contracts, images)
- Your API keys or integrations (WhatsApp, Stripe, Google Workspace credentials)
- Your privileged database key (discarded after one-time setup)
- Any PII (personally identifiable information)
- Database query logs or access logs
Managed vs. BYOK Comparison
| Aspect | Managed | BYOK |
|---|---|---|
| Database location | NearSync's Supabase (shared, multi-tenant) | Your Supabase project (any region) |
| Data isolation | org_id column + RLS policies | Full database isolation |
| NearSync DB access | Yes (restricted operations role) | None (post-setup) |
| NearSync data visibility | Metadata via restricted Sentinel role | Metadata-only via Edge Function heartbeat |
| Key control | NearSync holds keys | You hold all keys |
| Seats | Priced per seat | Unlimited (your infrastructure cost) |
| Backup responsibility | NearSync | You |
| Region selection | NearSync's Supabase region | You choose any Supabase region |
| Infrastructure cost | Included in monthly fee | You pay Supabase directly |
| Compliance scope | NearSync is data processor | NearSync is software licensor only |