Run SBOX in a fully isolated environment or your own dedicated infrastructure. You own the network, the data, and the keys. Element34 ships the platform, you operate it. Kubernetes, Helm, Docker, bare metal, air-gapped. No public cloud test data. Ever.
PCI-DSS scopes shrink when test traffic never crosses the boundary. European tier-1 banks and reinsurers run SBOX inside their own networks.
Zero public egressPatient data stays inside the customer HIPAA-aligned perimeter. Element34 has no network path into the SBOX environment after install.
HIPAA-aligned architectureDoD, NATO, and national-agency customers run SBOX fully air-gapped. Self-hosted LLM keeps inference inside the security boundary.
Air-gap readyThe encryption boundary stays inside your perimeter. Element34 never holds a credential into your environment, and never receives a session token from one.
Customer-controlled keysPublic-cloud test grids look great in the demo and die in the security review. Test traffic crosses the customer network boundary. Test data lands on shared infrastructure. The vendor controls the keys. The compliance team marks it red. Private Cloud (self-hosted) clears the gate before the demo starts.
Symptom. The QA team picked a SaaS testing platform. Security blocked the procurement because test data crosses the boundary. Six months of evaluation, no deployment.
Symptom. The team built a Selenium grid in-house. It works, until someone leaves. Versions drift. Browsers fall behind. Sessions hang. No one wants to own it anymore.
Symptom. Defense, intelligence, and national-security workloads cannot pull anything from the public internet. Every commercial testing platform assumes outbound connectivity. None work.
SBOX self-hosted runs as three components inside the customer network: a Load Balancer that fronts the API, one or more Hubs that orchestrate sessions, and Executor nodes that host the browser containers. All three live inside the customer perimeter. Nothing reaches out.
Fronts the SBOX API and Hub web UI. Routes traffic across Hub instances. Customer-owned and customer-operated. TLS termination at the customer-managed cert authority.
The control plane. Orchestrates sessions, manages the executor pool, exposes the API, runs the AI features (Auto Heal, Automated RCA, Pulse Report), writes the session record. AI features are integrated directly into the Hub.
Browser execution nodes. Each executor pulls browser container images and runs the actual test session. Disk IOPS throughput matters at scale.
Same SBOX, five surfaces. Pick the surface that matches your operating model. Move between them without changing the platform.
Helm-installable on customer K8s. Self-managed executor pods. Standard kubectl operations. Elastic scaling that VM-based deployments handle manually.
Infrastructure-as-code from day one. Helm chart for SBOX components, Terraform modules for VMs, network, storage. ArgoCD ready for GitOps customers.
Classic deployment on Linux VMs (RHEL, Ubuntu, Debian). Docker-based component images. Manual scaling. Predictable behaviour. How most regulated customers run SBOX today.
Physical servers, no virtualisation layer, no shared kernel. Defense and high-compliance customers run this way. Container runtime sits directly on the host OS.
No outbound internet required at runtime. Container images pulled from customer Artifactory or registry. Self-hosted LLM keeps AI inside the boundary. No vendor telemetry.
Three private deployment models. Same SBOX product runs across all three. Pick the model that matches your operating model and your compliance posture.
Private Cloud (self-hosted) is the deployment model designed for the customer security review. Every common audit objection has a deployment-level answer, not a contractual one.
SBOX runtime makes no outbound call to Element34. No license callback, no telemetry. Test data stays inside the customer perimeter.
Customer KMS, HSM, or BYOK. Encryption boundary stays customer-owned. Element34 never holds a credential into the SBOX environment.
AI features use a customer-supplied LLM endpoint, cloud or self-hosted. Prompts never reach Element34.
Customer pulls container images from their own registry. Runtime needs no outbound connectivity. Supports defense and intelligence workloads.
Customer identity provider, customer audit log. SAML and OIDC. Element34 holds no user account in the customer environment.
Video, screenshots, and session metadata follow customer-set retention rules. Video offloads to customer S3 with customer-defined lifecycle policies.
We sit with your platform, security, and procurement teams. We answer the questions in the order your review asks them. We hand you the deployment plan that clears the gate. Annual licensing, predictable across the contract term.
