UNIVERSITY · LESSON · PUBLISHED 18 SEPTEMBER 2026
AI SOC deployment models and data residency
Cyber AI Comparison team · Last checked September 2026 · Editorial assessment
Published 18 September 2026
3 min read
What to know
Most AI SOC platforms are sold as SaaS, but the details differ: a shared multi-tenant service, a dedicated single-tenant environment, a deployment in your own cloud tenant or, for the incumbent SOARs, on-premises. Data residency options differ too. Check where alerts, evidence and model inference are processed early, because it can rule a vendor out before any test.
What deployment models exist?
- Multi-tenant SaaS: one service shared by many customers, with data kept separate. Usually the fastest to start.
- Single-tenant: a dedicated environment for one customer, still run by the vendor.
- Customer cloud tenant: the platform runs inside the customer's own cloud account, so data stays under the customer's control.
- On-premises: the customer runs the software in its own data centre. Among the platforms here, only the incumbent SOARs describe it.
- Hybrid: some components on-premises and some in the cloud.
What does each vendor publish?
| Platform | Deployment published |
|---|---|
| Mate Security | SaaS. Mate says it is built on AWS infrastructure and sells through AWS Marketplace; its trust center lists Amazon Web Services and Google Cloud as cloud subprocessors. Self-hosted, customer-tenant and data residency options: not described. |
| Cortex XSOAR | XSOAR 8 SaaS, XSOAR 8 On-prem, XSOAR 6 |
| Artemis Security | Not published (on-prem action execution described) |
| Torq AI SOC Platform | Cloud-native |
| Dropzone AI | Standard, single-tenant, MSSP; EU residency |
| Prophet Security | Single-tenant on AWS; BYOK |
| Exaforce | Not published (self-run or managed service) |
| Tines | Shared, self-hosted or hybrid |
| 7AI | Not published |
| Splunk SOAR | Cloud, on-premises, hybrid |
| Conifers CognitiveSOC | Conifers Azure SaaS or customer Azure tenant |
| Intezer | Not published |
Details worth knowing: Conifers runs as SaaS on Conifers-hosted Azure or in the customer's own Azure tenant, and on 8 July 2026 added a Singapore data region alongside North America and Europe, with inference and data processing in-country. Dropzone AI offers a dedicated single-tenant Enterprise environment and an EU data residency option. Prophet Security is single-tenant, keeps customer data in individual datastores, offers bring-your-own-key and runs on AWS. Mate Security is SaaS: Mate says it is built on AWS infrastructure and sells through AWS Marketplace, and its trust center lists Amazon Web Services and Google Cloud as cloud subprocessors; self-hosted, customer-tenant and data residency options are not described. Cortex XSOAR ships as XSOAR 8 SaaS, XSOAR 8 On-prem (end of life 30 September 2029, per Palo Alto documentation) and XSOAR 6, and Splunk SOAR as cloud, on-premises or hybrid.
Which data questions should you ask?
- Where are alerts, evidence and case records stored, and in which region?
- Where does model inference run, and does it leave the region?
- Is any customer data used to train models shared with other customers? Prophet Security states it does not train AI models with personal data, and Torq says SOC Brain gives each customer a private model trained only on its own data.
- Who holds the encryption keys, and is bring-your-own-key available?
- Which sub-processors handle the data?
- What happens to the data, and to anything the platform has learned, when the contract ends?
How does this show up in our scores?
Deployment model options carry 10% of the weighted score in our method. The highest score is 9, held by Cortex XSOAR, Splunk SOAR and Tines. Mate Security scores 5 on this criterion because its public pages describe a SaaS service and no self-hosted, customer-tenant or data residency options.
Next lesson: How to read AI SOC vendor claims