Deploying in Your AWS Account
FunnelStory can run as a single-tenant deployment inside your own AWS account, instead of on FunnelStory's multi-tenant cloud. Choose it when your security or data-residency policies require customer data to stay in infrastructure you own: the application, its database and its storage all run in your account, behind your network controls, and your users reach it on your private network.
This page is an overview for your platform, cloud and security teams. Customer-VPC deployments are arranged with your FunnelStory account team, who provide the detailed deployment package during onboarding. For Google Cloud, see Deploying in Your Google Cloud Project.
How it works
FunnelStory deploys and operates the application in a VPC in your account. You own the account, the network around it, and who can reach it.
| Runs in your account | Stays with FunnelStory |
|---|---|
| The FunnelStory application, on Amazon EKS | The deployment automation and its source code |
| Your data: the database (Amazon Aurora PostgreSQL), file storage (Amazon S3) and application secrets (AWS Secrets Manager) | Container images, which are copied into your account for each release |
| Encryption keys (AWS KMS) and logs (Amazon CloudWatch) | |
| An internal load balancer for your users |
Your customer data stays in your account. The application reaches out only to the systems you connect it to, such as your CRM, data warehouse, support tool, LLM provider and messaging tools.
What you provide
Before FunnelStory deploys, your team prepares:
- An AWS account and region. We recommend a dedicated account for FunnelStory.
- A VPC with private subnets in at least two Availability Zones.
- A hostname and certificate for the address your users will use, such as
funnelstory.example.com. - Private access for your users, from your corporate network or VPN to the internal load balancer.
- Outbound access from the VPC to the services you connect FunnelStory to.
- Single sign-on with your identity provider. See Single Sign-On (SSO).
If your organization uses Service Control Policies or other guardrails, share them with FunnelStory before the first deploy. Some steps, such as creating security groups or IAM roles, can be done by your team instead when a policy requires it.
How FunnelStory's access is controlled
FunnelStory's access to your account follows two principles:
- Changes go through automation, not people. Infrastructure changes and releases run from FunnelStory's deployment pipeline using short-lived, federated credentials. Only reviewed changes can reach your account, and no long-lived AWS keys exist.
- People have no standing access. If an incident needs hands-on work, FunnelStory engineers use a break-glass role that is disabled by default. Your team enables it for that incident and disables it afterward. FunnelStory can't grant itself access.
You create the roles FunnelStory uses, and you can revoke them at any time. FunnelStory doesn't need organization, billing or account-management access.
Shared responsibility
| Area | You | FunnelStory |
|---|---|---|
| Account and network | The AWS account, VPC, routing, security groups and network monitoring | The application's network requirements |
| Identity and access | AWS administrators, your identity provider, and approving break-glass access | Application roles and permissions inside FunnelStory |
| Application | Approving changes to infrastructure you control | Deploying, upgrading and operating the application |
| Data | Data classification and retention policies | Encryption in transit and at rest, and backups |
| Security monitoring | Account-level logging, threat detection and scanning | Application audit logging, and fixing vulnerabilities in FunnelStory's components |
| Incidents | Account and network issues | Application issues, with joint triage through a shared channel |
AWS is responsible for the security of the cloud itself: its data centers, the EKS control plane and the managed database engine. Response times, maintenance windows and other commitments are set in your agreement with FunnelStory.
Getting started
- Talk to your FunnelStory account team about scope: the region, the data sources to connect, and your LLM provider.
- Review the deployment package. FunnelStory provides the access, network and sizing requirements for your platform and security teams.
- Prepare your account and create the access roles, following the package.
- FunnelStory deploys the application and gives you the address to point your hostname at.
- Connect single sign-on and your data sources, and agree the shared support and incident process.
Related
- Deploying in Your Google Cloud Project — the same deployment on Google Cloud.
- Security — how FunnelStory protects data.
- Single Sign-On (SSO) — connect your identity provider; use your own hostname in a private deployment.
- AI Providers — bring your own LLM provider.
- Audit log — what the application records about changes and activity.
- Data connections — the sources FunnelStory reads from.