Deployment & Hosting

1. One platform, run by us

A tenant is a provisioning step, not a project. From there the region you picked governs where everything the platform records ends up, and retention enforces itself.

OptiML is a managed cloud platform. Your tenant is provisioned in minutes and hosted in the region you choose, so data stays where you need it. Isolation is not a code convention. PostgreSQL row-level security on 231 tables means the database refuses to return another tenant's row, whatever the application asks for. RMT operates the platform against a 99.9% monthly uptime commitment: patching, monitoring, scaling, backup and disaster-recovery drills. Enterprise buyers can take a dedicated single-tenant instance, still inside OptiML Cloud, still fully managed, with its own retention windows and compliance posture.

• Provisioned in minutes, in the region you choose
• Patching, monitoring, scaling, backup and DR drills, all run by RMT, so you are not staffing an ops rota to cover three in the morning
• 99.9% monthly uptime, with credits
• Dedicated single-tenant hosting on Enterprise

See the governance, guardrail and audit layer

2. Your data stays in the region you choose

Conversation data, transcripts, recordings and analytics are stored in the region you nominated when the tenant was provisioned, and they do not wander from it. Retention is configurable per tenant and per class of data, and the platform enforces it on its own. Regional compliance packs, sixteen and counting, carry the jurisdiction-specific rules for consent, disclosure, retention and erasure. Opening in a new market is configuration. It is not a project.

3. Isolation the database enforces, not the code

This is the difference between a control you can audit and a convention you have to trust. A defect in application code cannot leak data across tenants here, because the application is not what is enforcing the boundary.

Most multi-tenant platforms enforce isolation in application code: a WHERE tenant_id = ? clause on every query, correct right up until the day one query gets written without it. OptiML enforces it in PostgreSQL instead, with row-level security policies on 231 tables. The database refuses to return another tenant's row regardless of what the application asks for. Tenant context is derived from the authenticated token and fails closed. No resolvable tenant, no data. For a BPO the consequence is commercial. Each client programme is an isolated tenant carrying its own retention, compliance mode, audit trail and DNC list, so an audit can be answered one programme at a time instead of across the whole estate.

• Row-level security policies on 231 tables
• Tenant context derived from the authenticated token, so a missing or forged tenant id gets no rows back at all
• Fails closed
• Retention, compliance mode, audit trail and DNC list, all set per client programme

How per-programme DNC lists work in Outbound & Dialer

4. A dedicated instance, still fully managed

Two Enterprise options sit here, and they answer different questions. One isolates the instance. The other moves the system of record into your cloud account, under your keys.

Dedicated single-tenant hosting is an Enterprise option: an isolated instance inside OptiML Cloud, in your chosen region, with its own retention windows, its own compliance posture and no shared infrastructure underneath it. RMT still runs it. Same release train, same monitoring, same on-call rota. Nothing about the product changes. What changes is that no other tenant is sharing the machinery.

5. Your data, your account

Some obligations are about where the data lives, not where the software runs. Customer-managed data residency is an option on the Enterprise plan. It puts your database and recording storage in your own cloud account or your own datacentre, reached over a private, mutually authenticated connection. You hold the encryption keys, so access is yours to grant and yours to revoke. The system of record is yours: those two stores hold the only durable copy of your conversations, transcripts and recordings. The platform itself keeps running in OptiML Cloud. Application, AI runtime, media plane and console process that data in transit and keep no primary copy of it. What persists with us is PII-redacted operational telemetry and a bounded message-queue retention window, both enumerated by data class in the DPA, so your reviewer gets a list to read line by line and does not have to take it on trust from whoever is on the call.

6. Keys you hold, and can revoke

Custody is the part of a security review that cannot be argued around. Either you can make the data unreadable without asking us, or you cannot.

Recordings are encrypted with AES-256-GCM envelope encryption: a key per recording, wrapped by a tenant key held in KMS. Bring your own key and the tenant key is yours. Rotate it or revoke it and the data is unreadable without your action, which is a shorter answer to give a regulator than a paragraph about our internal access controls. TLS in transit, mTLS between services. PII is detected and redacted across transcripts, logs, exports and analytics before it reaches anyone's screen or anyone's report.

• AES-256-GCM envelope encryption, a key per recording
• Bring your own tenant key into KMS and it stays yours to rotate or revoke
• TLS in transit, mTLS between services
• PII redacted before it reaches a screen or a report, across transcripts, logs, exports and analytics

7. What 99.9% is made of

The SLA carries a 99.9% monthly uptime commitment with a published credit schedule, so a missed month has a consequence written down in advance. The list below is what that number is actually made of. Most of it is unglamorous plumbing, the queues and the autoscaling and the second region that can take the traffic. The drills matter more. A backup nobody has restored is a hope, and a failover nobody has triggered is a diagram. Incident history and subscribable updates sit on a public status page, which stays up whether the month went well or badly.

• Microservices behind an event bus
• Queues with dead-letter handling and idempotency
• Horizontal autoscaling per service
• Multi-region failover with replication
• Automated backups, plus restores that someone has actually tested
• Restore drills inside the release process, not once a year
• Chaos experiments against production-like environments
• A public status page with incident history

8. Managed does not mean opaque

A Terraform provider covers agents, flows, knowledge sources, phone numbers, integrations, users and roles, so provisioning goes through review like any other change. Around it sit a REST API with OpenAPI, 11 client SDKs, a CLI, HMAC-signed webhooks with retries and a dead-letter queue, and an MCP server SDK. You configure and automate. We keep it running. Nothing in your configuration lives somewhere only RMT can reach.

• Terraform provider for agents, flows, knowledge sources, phone numbers, integrations, users and roles
• REST API with OpenAPI, plus 11 client SDKs
• A CLI
• HMAC-signed webhooks with retries and a dead-letter queue
• MCP server SDK

What the Terraform provider provisions in Agent & Flow Builder

9. Operated by RMT

Everything in this table is a headcount decision you do not have to make. The platform you would otherwise be staffing an ops rota for is staffed by ours, and the telemetry still lands in your monitoring stack.

What RMT operates on your behalf:

10. What we do not do

Can we run OptiML inside your own perimeter? No. OptiML is a managed cloud service, and that is a deliberate choice rather than a gap in the roadmap. It is why upgrades are continuous, why the release train is a single train for every tenant, and why 99.9% is a number we can be held to. If your obligation is about where conversation data rests, customer-managed data residency answers it. If your obligation is about where the software executes, then we are not the right vendor for you. Better you find that out here than in month six.