Blog
Case Study
How Pavo Turned Custom AI Deployments Into a Repeatable Process
At-a-Glance
Company
Pavo delivers a system improvement platform for production AI systems, helping enterprises learn from experience and optimize business outcomes.
Challenge
Extending Pavo’s deployment model into customer-owned VPCs introduced a new level of complexity. Each customer environment came with different security, networking, IAM, and governance requirements, making enterprise deployments difficult to standardize and scale.
Solution
Pavo used Omnistrate to generate a private control plane that deploys and operates its application stack across customer environments. Omnistrate handles secure connectivity, infrastructure provisioning and management, end-to-end deployment, and ongoing lifecycle operations across AWS, GCP, and other cloud environments.
Result
With Omnistrate, Pavo turned customer-specific deployments into a repeatable, automated process. It allowed Pavo’s team to scale by focusing most of its time understanding customer requirements and helping customers with deployment questions, rather than manually setting up and managing deployments.
The Challenge
Scaling Secure Enterprise AI Deployments Across Clouds and Customer Environments
Pavo serves medium and large enterprises that require strict control over where their data and workloads run. Extending its existing deployment process into AWS and GCP customer environments meant supporting a range of BYOC and self-hosted configurations — single-customer self-hosted, customer VPC, highly restricted customer VPC, and multi-customer self-hosted environments — each with different security, networking, and operational requirements.
Enterprise Security Requirements
Deploying inside isolated, customer-owned cloud accounts required Pavo to protect both customer data and its own intellectual property while meeting strict enterprise security and compliance requirements—including least-privilege IAM, secrets management, customer-managed encryption keys, zero-inbound connectivity, customer-controlled egress, and audit logging.
Pavo also needed to build and maintain a strong compliance posture across every customer environment, supporting SOC 2 Type II, ISO 27001, GDPR, and HIPAA-regulated workloads without introducing deployment-specific gaps or exceptions.
Bespoke Deployment Overhead
Each new customer profile required Pavo to extend and re-validate its existing Helm and Terraform/OpenTofu automation, then maintain that variant alongside the others.
Multi-Cloud Infrastructure Provisioning and Management
Every new cloud could become a massive lift. Pavo would have to rebuild and maintain its core infrastructure for each cloud, manage infrastructure state separately for every customer, and safely recover from failed provisioning or updates—all without leaving behind partial deployments or orphaned resources.
Operating Software After Deployment
Running inside locked-down customer VPCs changed how Pavo could update, observe, inventory, and support its software. Pavo needed to continuously operate eight services inside isolated customer environments without creating permanent inbound access or ongoing DevOps overhead.
The Solution
Standardizing Enterprise BYOC Deployments with Omnistrate
Pavo selected Omnistrate as its software deployment and operations platform for customer-owned cloud environments. Omnistrate gave Pavo a repeatable, multi-cloud deployment model that could be reused across customers and cloud environments while still allowing customer-specific configuration and security controls.
Standardized Deployment Automation
Pavo used Omnistrate to generate a private control plane that builds on its existing Helm and Terraform/OpenTofu artifacts, standardizing deployment automation, infrastructure management, operational visibility, metering/billing, and integrating with Pavo’s CI/CD workflows.
Pavo uses the generated control plane to deploy and operate both software and supporting infrastructure inside customer-owned AWS accounts, and the same model extends to GCP.
Enterprise Security Controls
Pavo and Omnistrate defined the permissions and security controls required for enterprise deployments, including least-privilege access, customer-managed encryption keys, signed-image enforcement, private connectivity, and cloud-native audit logging. Pavo can operate these environments without maintaining a permanent inbound network path.
Resilient Multi-Cloud Infrastructure Management
Pavo defined its core infrastructure once, and its Omnistrate-generated control plane provisions and manages it across clouds and customer environments.
Infrastructure is managed independently for each tenant, and every operation is transaction-safe across different lifecycle flows—either completing successfully or failing cleanly without leaving infrastructure in an inconsistent state or leaking resources.
Lifecycle Operations
After deployment, Omnistrate manages software versions and deployment inventory while enabling Pavo to release updates, monitor application health, and troubleshoot customer environments.
BYOC Anywhere Principles: Omnistrate formalized these principles for operating software inside isolated customer environments at byocanywhere.org.
"Pavo’s deployment pipeline worked — for customers who were happy for their data to sit in our cloud. It was never built to put our entire stack inside someone else's VPC and keep it there to enterprise security standards.
"That's where Omnistrate came in. It let us reach customer profiles we couldn't serve before, without standing up a separate deployment process for each one — which means our engineering time goes into the product instead."
Founding Engineer, Pavo
The Impact
Scaling Enterprise AI Delivery with a Repeatable, Multi-Cloud Model
By standardizing deployments with Omnistrate, Pavo extended a single deployment model across customer profiles it previously couldn't serve, using a reusable, multi-cloud operating model across AWS, GCP and additional platforms—accelerating enterprise onboarding without scaling DevOps overhead.
Pavo achieved the following results:
Significant Reduction in Engineering Onboarding Effort
Hands-on Pavo engineering time dropped from several weeks to a couple of days on average per customer. Engineering focus shifted away from writing custom Terraform/OpenTofu and Helm configurations toward initial requirements gathering and architecture alignment.
Accelerated Time-to-Production
Once initial customer permissions and requirements are finalized, the control plane automatically provisions core infrastructure in minutes. Complex BYOC environments reach production in 7-10 days, while simpler self-hosted environments go live in a day.
Proven Flexibility Across Deployment Models
A single Omnistrate-generated control plane supports four distinct deployment configurations — single-customer self-hosted, customer VPC, highly restricted customer VPC, and multi-customer self-hosted — demonstrating Omnistrate's ability to flex to varying security postures without custom engineering per model.
Customer-Controlled Security Governance
Delivers enterprise-grade compliance out-of-the-box through customer-managed KMS encryption keys, least-privilege IAM policies, signed container images, and cloud-native audit logging.
Zero-Trust Day-2 Operations
Enables Pavo to deploy software releases, monitor system health, manage deployment inventory, and troubleshoot isolated customer VPCs without maintaining permanent inbound network paths or static credentials.
Why Omnistrate
Why Pavo Selected Omnistrate
Pavo considered building its own BYOC platform, but quickly realized that the challenge went far beyond running Terraform and Helm. Supporting enterprise customers meant solving for cloud infrastructure, security, tenant isolation, upgrades, monitoring, recovery, compliance, and ongoing Day-2 operations—an operational burden that would continue to grow with every customer and require significant investment away from Pavo’s core product.
Instead, Pavo selected Omnistrate to generate the control plane it needed rather than build and operate one internally.
Build once, deploy across clouds
A DIY approach would have required Pavo to maintain separate infrastructure implementations across clouds and different customer environments. With Omnistrate, Pavo could define its core infrastructure once and use the generated control plane to provision it across clouds and customer environments.
Operate securely inside customer environments
Pavo needed customer data to stay inside the customer’s VPC while minimizing outbound connectivity and still retaining the ability to operate and support the application.
Get the full operational layer, not just deployment tooling
The Omnistrate-generated control plane gave Pavo the foundation for provisioning, upgrades, monitoring, recovery, tenant isolation, development environments, SSO, licensing, and other lifecycle operations instead of building each capability independently.
Scale without building a large platform team
Pavo had strong GCP expertise, but expanding to other environments would have required significant new engineering and operational expertise. Omnistrate provided that abstraction while allowing Pavo to retain its own Terraform for Pavo-specific pieces, giving the team flexibility where it needed it.
Developer productivity
Omnistrate’s MCP and CLI workflows let Pavo’s engineers interact directly with the platform to deploy, inspect, troubleshoot, and manage environments, helping them achieve what they needed without building custom operational tooling.
Improve day-to-day engineering velocity
Pavo automated their CI/CD including per-PR environments for isolated testing before merge and production, turning individual engineering workflows into a repeatable deployment process.
Rely on deep cloud infrastructure expertise
Omnistrate’s team brought experience working on foundational systems including the original AWS control plane, Amazon Aurora, and Confluent Cloud—giving Pavo access to expertise that would be difficult to build internally.