Bring your own cloud

Bring your own cloud (BYOC) lets you deploy Pinecone Database in your own AWS or GCP account to ensure data sovereignty and compliance, with Pinecone handling provisioning, operations, and maintenance.

​

Use cases

Pinecone BYOC is designed for organizations with high security and compliance requirements, for example:

• Data sovereignty: If your organization has strict data governance policies, Pinecone BYOC can help ensure that all data is stored and processed locally and does not leave your security perimeter.
• Data residency: The standard Pinecone managed service can be deployed in several AWS or GCP cloud regions. If your organization has specific data residency or latency constraints that require you to deploy in regions that Pinecone does not yet support, Pinecone BYOC gives you that flexibility.

​

Architecture

The BYOC architecture employs a split model:

• Data plane: The data plane is responsible for storing and processing your records, executing queries, and interacting with object storage for index data. In a BYOC deployment, the data plane is hosted in your own AWS or GCP account within a dedicated VPC, ensuring that all data is stored and processed locally and does not leave your organizational boundaries. You use a private endpoint (AWS PrivateLink or GCP Private Service Connect) as an additional measure to secure requests to your indexes.
• Control plane: The control plane is responsible for managing the index lifecycle as well as region-agnostic services such as user management, authentication, and billing. The control plane does not hold or process any records. In a BYOC deployment, the control plane is managed by Pinecone and hosted globally. Communication between the data plane and control plane is encrypted using TLS and employs role-based access control (RBAC) with minimal IAM permissions.

​

Onboarding

The onboarding process for BYOC in AWS or GCP involves the following general stages:

​

Configure a private endpoint

You use a private endpoint to securely connect to your BYOC indexes. On AWS, you use the AWS PrivateLink service; on GCP, you use the GCP Private Service Connect service.

​

Create an index

Once your BYOC environment is ready, you can create a BYOC index in the Pinecone console or via Pinecone API or Python SDK.

To create a BYOC index, set the spec parameter to the environment name provided to you during onboarding, for example:

from pinecone import Pinecone, ByocSpec

pc = Pinecone(api_key="YOUR_API_KEY")

pc.create_index(
    name="example-byoc-index", 
    dimension=1536, 
    metric="cosine", 
    spec=ByocSpec(
        environment="aws-us-east-1-b921"
    ),
    deletion_protection="disabled",
    tags={
        "example": "tag"
    }
)

​

Read and write data

Once your private endpoint is configured, you can run data operations against an index as usual, but you must target the index using its private endpoint URL. The only difference in the URL is that .svc. is changed to .svc.private..

You can get the private endpoint URL for an index from the Pinecone console or API.

import { Pinecone } from '@pinecone-database/pinecone';

const pc = new Pinecone({ apiKey: 'YOUR_API_KEY' });

await pc.describeIndex('docs-example');

{
  name: 'docs-example',
  dimension: 1536,
  metric: 'cosine',
  host: 'docs-example-jl7boae.svc.aped-4627-b74a.pinecone.io',
  privateHost: 'docs-example-jl7boae.svc.private.aped-4627-b74a.pinecone.io',
  deletionProtection: 'disabled',
  tags: { environment: 'production' },
  embed: undefined,
  spec: {
    byoc: undefined,
    pod: undefined,
    serverless: { cloud: 'aws', region: 'us-east-1' }
  },
  status: { ready: true, state: 'Ready' },
  vectorType: 'dense'
}

​

Monitoring

Pinecone engineers monitor the state of your BYOC deployment and manage incidents if they arise. In addition, you can monitor performance metrics for your BYOC indexes in the Pinecone Console or with Prometheus or Datadog.

​

Limitations

BYOC does not support the following:

• Integrated embedding, which relies on models hosted by Pinecone that are outsite of your AWS or GCP account.

• Reading and writing data from the index browser in the Pinecone console. You must use the Pinecone API or SDKs instead.

• Using customer-managed encryption keys (CMEK) to secure data within a Pinecone project.

Also, to monitor performance metrics with Prometheus, you must configure Prometheus within your VPC.

​

FAQs