Blog
Case Study
Zep AI Reduces Enterprise BYOC Deployment Time by 80% with Omnistrate and AWS
Learn how Zep AI used Omnistrate to standardize BYOC deployments into customer AWS VPCs, reducing deployment time by 80% for its Fortune 500 customers while meeting strict enterprise security requirements.
Key Benefits
80% reduction in BYOC deployment time for the initial Fortune 500 deployment
Zero manual Terraform edits for the deployment cell rollout
Zero customer-specific code or chart forks across the deployment fleet
Zero public internet egress with AWS PrivateLink
Overview
Zep AI provides an enterprise-scale context engineering and long-horizon agent memory platform. By structuring temporal knowledge graphs across millions of Context Graphs, Zep AI enables enterprise AI agents to operate reliably, learn from historical interactions, and maintain strict data governance. With its core open-source graph-construction engine (Graphiti) garnering over 26,000 GitHub stars, Zep AI targets Fortune 500 enterprises deploying production-grade AI agent workloads.
To meet strict data sovereignty, compliance, and governance requirements, enterprise customers increasingly require Zep AI to run directly inside their own dedicated AWS Virtual Private Clouds (VPCs). To execute this Bring Your Own Cloud (BYOC) strategy without building its own control plane or maintaining separate deployment implementations for each customer, Zep AI partnered with Omnistrate to standardize and automate deployments into customer AWS VPCs through an Omnistrate-generated control plane and a shared service definition.
This approach enables Zep AI to deliver a fully managed service experience directly inside customer AWS accounts. Zep AI can automatically provision, operate, and scale its Context Lake within sovereign enterprise AWS VPCs, while enterprise platform teams retain full data custody and governance.
The Challenge
Turning Enterprise BYOC Commitments into Working Deployments
To deploy enterprise AI agents in production, Fortune 500 security and platform engineering teams require complete data custody within their sovereign perimeter, requiring an alternative to traditional multi-tenant SaaS deployment models. However, traditional BYOC deployment models often forced enterprise platform teams to operate vendor workloads like complex on-premise or air-gapped software—shifting deployment, patching, and troubleshooting responsibilities to internal SRE teams. To scale effectively, Zep AI needed to deliver a fully managed service experience directly inside the customer’s AWS Virtual Private Cloud (Amazon VPC), preserving customer data custody while simplifying deployment and ongoing operations.
While Zep AI successfully navigated early security assessments by aligning on offering BYOC deployments inside customer AWS accounts, post-contract surfaced technical challenges during interactions with customer platform, security and SRE teams. Standard enterprise VPC environments enforced stringent architectural and security requirements:
1. Data Residency
All customer data must remain within the customer's VPC.
2. No Public Ingress
No inbound access from the public internet to the customer's AWS account or deployed services.
3. Controlled Network Egress
No direct public internet access, no Internet Gateway (IGW), and no NAT Gateway. All approved outbound traffic must pass through the customer's on-premises firewall with SNI-based filtering. Deployments cannot depend on unrestricted internet access.
4. Compliance with Enterprise Cloud Guardrails
All infrastructure provisioning and operations must comply with the customer's existing AWS Service Control Policies (SCPs), without requiring exceptions or changes to established security guardrails.
5. End-to-End Software Supply Chain Security
Container image signatures and provenance must be preserved and verifiable throughout the deployment process, including when images pass through the customer's internal Artifactory registry.
6. No Standing Vendor Access
Vendor personnel cannot have persistent access to the customer's infrastructure or environment.
7. Customer-Controlled Operations
The customer's SRE team must be able to deploy, upgrade, monitor, and troubleshoot the software within its existing operational controls.
8. Security-Approved Private Connectivity
All private connections to external services, including AWS PrivateLink, must undergo customer security review and approval.
9. Complete Auditability
All deployment, infrastructure, and operational actions must be recorded in customer-visible audit logs for full traceability and accountability.
10. Governance Controls
The customer must retain full control over vendor and platform access, including the ability to immediately revoke access and permissions at any time.
Without a standardized control plane, accommodating these customer constraints across multiple enterprise accounts would require significant custom engineering, manual processes, and ongoing operational overhead for each customer—making deployments slow, expensive, and difficult to scale.
"Using Omnistrate on AWS, we have a centralized control plane running in an isolated account connected via AWS PrivateLink to our customer’s VPC. Zep receives health and billing telemetry securely with zero public inbound access, giving our enterprise customers complete data sovereignty without operational complexity."
Founder & CEO, Zep AI
The Solution
Deploying and Managing Customer Environments Through One Control Plane
Zep AI selected Omnistrate to standardize deployment and ongoing operations across customer-owned AWS environments. Omnistrate generates the control plane, which Zep hosts in its own dedicated, isolated AWS account. Through this control plane, Zep uses one service definition across customer deployments and centrally manages versioning and fleet-wide upgrades.
Customer deployments connect to the control plane through a secure, outbound-only connection over the AWS PrivateLink. This private connection enables the agent to report deployment health and usage metrics and receive deployment, upgrade, and operational instructions, without requiring public internet access or exposing inbound endpoints.
The deployment combines Omnistrate’s generated control plane with AWS services for compute, storage, connectivity, and governance:
Compute & Orchestration
Amazon EKS manages Zep’s Kubernetes workloads, while Amazon EC2 GPU Instances (G5/P4 series) deliver high-performance real-time embedding generation and inference.
State & Memory Storage
Konig, Zep's proprietary graph database and managed runtime, persists and serves the temporal Context Graphs — entities, relationships, facts, and episodic history — that Graphiti constructs, with supporting AWS storage for backups and raw episodic data.
Security & Network Boundaries
AWS PrivateLink establishes secure, unidirectional communication between the customer VPC deployment and Zep AI’s Omnistrate control plane. Telemetry, health status, and billing metrics flow securely to the control plane without opening public ingress or egress internet routes.
Encryption & Governance
All data at rest is encrypted using AWS Key Management Service (KMS) with Customer-Managed Keys (CMKs). Fine-grained role scoping is enforced via AWS IAM (IRSA / OIDC), while AWS CloudTrail logs all platform activity for auditing.
Zep AI, Omnistrate, and the customer's engineering teams collaborated to validate security requirements, conduct testing, and ensure production readiness:
Production Deployment
Zep AI, Omnistrate, and the customer's engineering teams worked together to successfully deploy to production in just two weeks.
Defining Enterprise Standards
The BYOC architecture is designed in accordance with AWS security and architectural best practices and zero-trust guidelines, establishing a repeatable pattern for zero-standing-access vendor management.
Complete Enterprise Custody
Customers maintain 100% custody of their raw data inside their AWS account and foundational model access via Amazon Bedrock, reducing third-party data exposure.
The Impact
80% Less Deployment Time, a Repeatable BYOC Model
By standardizing on Omnistrate as its deployment engine and AWS PrivateLink, Zep AI transformed a complex, multi-week enterprise deployment process into an automated, repeatable lifecycle. Zep AI can now deliver a fully managed SaaS experience directly inside strict enterprise AWS environments without creating custom code forks or compromising customer security policies.
Key outcomes achieved include:
80% Reduction in BYOC Deployment Time
Zep AI reduced the time from contract signoff to active VPC deployment by 80% for its initial Fortune 500 deployment, completing the process in a couple of weeks, with most of that time dedicated to gathering and validating the customer's security and deployment requirements.
Automated BYOC Deployments
Deployed into the customer's VPC without manual Terraform changes or custom infrastructure setup.
Consistent Deployments Across Customers
A single service definition eliminated the need for customer-specific code or Helm chart forks.
Simplified Day-2 Operations & Batch Updates
Centralized versioning enables Zep AI to execute staged, fleet-wide batch updates and version rollouts across isolated customer VPCs via AWS PrivateLink—eliminating vendor standing access while ensuring all enterprise instances stay up to date.
Unblocked Enterprise Sales Cycles
Standardized PrivateLink connectivity and zero-egress patterns allowed Zep AI to satisfy Fortune 500 InfoSec, legal, and platform engineering requirements in parallel.