Run in your own cloud
Your products. Your data. Your cloud.
Tomstok is designed for Bring Your Own Cloud: product work takes place in your AWS environment with a clear boundary to central administration.
Keep your product foundation in your environment
Keep product models, materials, configurations and calculations in an AWS account you own. With BYOC, ordinary product calculations run in your environment, independently of Tomstok’s central administration.
You gain direct visibility into where product data lives, which cloud resources are used and who has access. Your IT team has a concrete basis for managing operations and security.
Separate accounts. Clear operational boundaries.
Simplified architecture of your Tomstok installation
Tomstok’s AWS account Your own AWS account You establish installation roles and their permission boundaries. This connects your account to Tomstok’s central administration.
Access through VPC endpoints
'%20fill='%23FFFFFF'%3e%3cpath%20d='M47.836,30.893%20L48.22,28.189%20C51.761,30.31%2051.807,31.186%2051.8060132,31.21%20C51.8,31.215%2051.196,31.719%2047.836,30.893%20L47.836,30.893%20Z%20M45.893,30.353%20C39.773,28.501%2031.25,24.591%2027.801,22.961%20C27.801,22.947%2027.805,22.934%2027.805,22.92%20C27.805,21.595%2026.727,20.517%2025.401,20.517%20C24.077,20.517%2022.999,21.595%2022.999,22.92%20C22.999,24.245%2024.077,25.323%2025.401,25.323%20C25.983,25.323%2026.511,25.106%2026.928,24.761%20C30.986,26.682%2039.443,30.535%2045.608,32.355%20L43.17,49.561%20C43.163,49.608%2043.16,49.655%2043.16,49.702%20C43.16,51.217%2036.453,54%2025.494,54%20C14.419,54%207.641,51.217%207.641,49.702%20C7.641,49.656%207.638,49.611%207.632,49.566%20L2.538,12.359%20C6.947,15.394%2016.43,17%2025.5,17%20C34.556,17%2044.023,15.4%2048.441,12.374%20L45.893,30.353%20Z%20M2,8.478%20C2.072,7.162%209.634,2%2025.5,2%20C41.364,2%2048.927,7.161%2049,8.478%20L49,8.927%20C48.13,11.878%2038.33,15%2025.5,15%20C12.648,15%202.843,11.868%202,8.913%20L2,8.478%20Z%20M51,8.5%20C51,5.035%2041.066,0%2025.5,0%20C9.934,0%200,5.035%200,8.5%20L0.094,9.254%20L5.642,49.778%20C5.775,54.31%2017.861,56%2025.494,56%20C34.966,56%2045.029,53.822%2045.159,49.781%20L47.555,32.884%20C48.888,33.203%2049.985,33.366%2050.866,33.366%20C52.049,33.366%2052.849,33.077%2053.334,32.499%20C53.732,32.025%2053.884,31.451%2053.77,30.84%20C53.511,29.456%2051.868,27.964%2048.522,26.055%20L50.898,9.293%20L51,8.5%20Z'%20id='Amazon-Simple-Storage-Service-Icon_64_Squid'%3e%3c/path%3e%3c/g%3e%3c/g%3e%3c/svg%3e)
CloudFormation stacks with separate lifecycles
Network, databases, files, encryption key and DNS. Data remains when the application is removed; you approve changes to the foundation.
API, runtime agent and frontend. A root stack with nested stacks groups the software version, which can be updated without replacing the data foundation.
The TLS certificate for CloudFront has its own stack. Its region is not the location of your product and order data.
The zones show network separation. Database instance count, capacity and recovery requirements are agreed for the installation. Regional services are shown outside individual zones.
Central administration with bounded responsibilities
Benefit from shared administration of installations and software versions with a clear boundary around business data. Tomstok’s central administration is separate from the environment where you work with products and orders.
Scoped roles and short-lived credentials keep operational tasks within their purpose. Human support has a separate access route where you approve both the task and the duration.
Read about access and permissionsSeparate your data from the application’s lifetime
Your data stays with you, even if you later remove the Tomstok application. The data foundation has its own lifecycle in your AWS account, and central administration has no permission to delete it.
You retain control of your product knowledge throughout the solution’s lifetime. Backup, recovery and retention are agreed as part of your operational setup, with clear practical responsibilities.
Give testing its own space
Try changes in separate environments before they affect everyday operations. Data transfers between environments are explicit and controlled, keeping work in one environment separate from access to another.
A different software version is tested in a separate installation. IT can plan product-data and software changes independently and choose the right path from testing to operation.
Make a deliberate choice about AI processing too
AI processing uses Amazon Bedrock in your AWS account. The initial offering is EU-only, with direct inference in Ireland as the default. An optional EU inference profile is assessed separately because its processing regions and retention terms can differ.
Before use, we review data flows, activation, access and responsibilities with your IT team.
Read about AI assistanceReview the architecture with your IT team.
We start with your AWS setup and walk through installation, access, updates and data processing.