Search for data breach any week of the year, and you will find new headlines about sensitive data leaking through third-party vendors. In just the past week, there were eight data breaches linked to compromised third-party vendors:
- 4 healthcare
- 2 consumer tech
- 1 government
- 1 financial services
Third-party vendor and supply chain compromises account for 14% of all breaches and cost $4.91 million per incident, the second most expensive attack vector after phishing. In the United States, the average breach cost has reached an all-time high of $10.22 million.
The delivery model is part of the problem.
Modern software is overwhelmingly delivered as centralized SaaS, a model that concentrates trust and risk inside the vendor’s infrastructure. When customer data flows through a vendor-controlled environment, every access misstep or security lapse can cascade across customers and become dozens of customer breaches.
Enterprises are responding by demanding self-hosted or Bring Your Own Cloud (BYOC) deployments to regain control over data boundaries. But most SaaS companies weren't built to operate hundreds of isolated customer environments. Supporting BYOC requires fundamentally different architecture, tooling, and operational capabilities. As a result, many vendors avoid BYOC deals entirely rather than absorb that complexity.
This is why we started Ryvn.
Our founding team scaled one of the largest customer deployment platforms in the world at Palantir. We took products from a single deployment to hundreds of isolated customer environments across regulated industries. We experienced the operational strain, observability gaps, and release friction that come with managing deployments at that scale.
Instead of bringing sensitive data to where software runs, we should bring software to where sensitive data already lives.
Who Ryvn is for
Ryvn is built for B2B companies delivering SaaS to enterprises in sensitive industries, where “no” from customer security and IT is the default response. More specifically, we're for companies that need to ship a BYOC version of their product.
This is software deployed into environments where every change is reviewed and automation cannot come at the expense of control. Where “secure” means on-prem, formal change approvals, and comprehensive audit trails.
Handling one bespoke "BYOC" deployment is manageable. But with each additional customer, ops and support costs scale linearly and release cadences slow to a crawl.
We built Ryvn for:
- The startup closing its first BYOC deal and wanting ease of delivery from day 1.
- The established vendor spending too much on operations to support hundreds of self-hosted customers.
- Ourselves. We use Ryvn to manage Ryvn SaaS and to deploy Ryvn as a BYOC offering itself.
How Ryvn works
Ryvn has three core parts.
Your application. Helm charts, Terraform modules, Docker images. Package it the same way you do today, or let Ryvn handle it for you.
The Ryvn Agent. Runs inside your customer's cloud and executes a constrained set of operations like Helm installs, Terraform applies, and secret generation. It's also responsible for reporting environment status and metadata back, but never has direct access to your application's workload or customer data.
The Ryvn Control Plane. Fully managed by Ryvn, it acts as the central hub that issues tasks out to Ryvn Agents. It continuously compares the desired state of deployments with the actual state and decides what needs to happen. When you push a change through the Ryvn UI, CLI, or Git, the Control Plane queues tasks for Agents to execute.
Communication between the Agents and Control Plane always originates as a request from the Agents. The Agent polls the Control Plane for work and pulls down tasks from a queue. The Control Plane doesn't have inbound access to a customer's cloud.
What’s next
We want BYOC deployments to feel boring. The less you think about Ryvn, the better.
Security review and requirements kill more enterprise deals than pricing does. We want to make security your competitive advantage.
For your customers, getting a BYOC deployment stood up should be effortless and take less than two minutes. No back-and-forth over scripts, no confusion about environment variables.
BYOC is just the start for Ryvn. Every week brings another batch of third-party breach headlines.
We believe the future of enterprise software is distributed by default. Software should move to data, not the other way around.
We’re building the infrastructure to make that practical.