T0 Managed egress
Hosted
Marker cloud
SaaSRun Marker where your agent data already lives.
T1 Allow-listed egress
Your cloud
Your cloud account
Helm + signed images T2 Allow-listed egress
On-prem
Your datacenter
Helm + signed images T3 Zero internet egress
Air-gapped
Isolated network
Helm + signed imagesEvery dependency is a seam you plug in yourself.
Kubernetes 
Kubernetes 
EKS 
GKE 
AKS One Helm install into the cluster you already run.
Postgres 
PostgreSQL 
RDS Cloud SQL Self-hosted Relational state, evidence coordinates, and the durable job queue.
Object store 
MinIO 
Amazon S3 S3-compatible Call audio and result artifacts in any S3-compatible store.
Telephony 
Twilio 
Telnyx Your SIP Calls arrive through your provider or your own SIP trunk.
The Marker package
Marker UI
The full application at a URL you control.
Marker API
Runs, evals, and results over REST.
Eval workers
Ingest, finalize, enrich, and evaluate inside the data plane.
Identity 
Okta 
Keycloak 
Entra ID SAML or OIDC against your IdP. Marker stores no passwords.
Secrets 
Vault 
AWS GCP Your manager Secret references resolved from your manager. Never stored in Marker.
Model endpoints 
Claude 
GPT 
Gemini 
Grok Your endpoints Customer-approved judge and transcription endpoints, hosted or local.
Deployment modes
Deployment
Operated by
Data lives
Model access
Delivery
T0 Hosted Managed
Marker
Marker-operated environment
Hosted or approved BYO
SaaS
T1 Your cloud Allow-listed
Your platform team
Your VPC and storage
Your approved endpoints
Helm + signed images
T2 On-prem Allow-listed
Your platform team
Your private network
Local or approved endpoints
Helm + signed images
T3 Air-gapped Zero internet
Your platform team
Never crosses the boundary
Local endpoints only
Helm + signed images