> ## Documentation Index
> Fetch the complete documentation index at: https://site.aspect.build/llms.txt
> Use this file to discover all available pages before exploring further.

# Hosted by Aspect

> Aspect Enterprise hosted in Aspect's cloud: an isolated Aspect Workflows deployment for your organization, provisioned and operated by Aspect.

Hosted by Aspect, Aspect Enterprise is a complete, isolated Aspect Workflows deployment (CI runners, remote cache, remote execution and the Build Results UI) in its own account in Aspect's cloud. Aspect provisions and operates it. It's for teams that need isolation without running infrastructure themselves.

The difference from [self-hosted](/docs/aspect-workflows/enterprise/self-hosted) is whose cloud account it sits in and who holds the credentials, not what you get.

## What Aspect operates

Everything below the endpoints:

* Provisioning the account, the network and every service in it.
* Monitoring, alerting and 24/7 on-call for the infrastructure.
* Upgrades, in scheduled windows. Patch upgrades need nothing client-side; for a minor or major, Aspect sends any client-side steps before the window.
* Capacity: runner groups and remote execution worker fleets scale to the ceilings configured for your deployment.
* Backups and restores of the build event database.
* Certificate issuance and renewal for your endpoints.

You never run `terraform apply` or hold cloud credentials.

## What stays yours

* **Your repository and your pipelines.** Workflows registers runners with your CI provider; the pipeline definitions stay in your repo and keep calling `bazel`.
* **Your Bazel configuration.** Which actions run remotely, which platforms they target, what gets cached: all decided by your `.bazelrc` and your `BUILD` files, the same as on any other deployment.
* **The configuration surface.** Runner groups, remote execution platforms, which warming set each group restores, retention windows. These are yours to decide; Aspect applies them. See [Configuration options](/docs/aspect-workflows/enterprise/hosted/configuration).
* **Your identity provider, if you want it.** Standard deployments use Aspect sign-in, which can connect to your identity provider for SSO. You can instead replace Aspect sign-in with your own identity provider, which [changes how CI authenticates](/docs/aspect-workflows/enterprise/connect/ci-setup#if-the-deployment-uses-your-own-identity-provider); read that before you decide. With Aspect sign-in, SCIM provisioning can sync users from your directory; with your own identity provider you manage users and groups there instead.

## Where the isolation stops

The infrastructure and the data are isolated **within Aspect's cloud**: the account is Aspect's, and Aspect's engineers hold the credentials to operate it. That's data isolation without data ownership; see [how to choose](/docs/aspect-workflows/platform/choosing#how-to-choose). For ownership too, choose [self-hosted](/docs/aspect-workflows/enterprise/self-hosted).

## Getting set up

<Steps>
  <Step title="Hand over what Aspect needs">
    A VCS app installation, a CI provider credential, and your identity provider and DNS choices. See [What Aspect needs from you](/docs/aspect-workflows/enterprise/hosted/setup).
  </Step>

  <Step title="Agree the configuration">
    Runner groups sized to your pipeline, remote execution platforms matching your toolchains. See [Configuration options](/docs/aspect-workflows/enterprise/hosted/configuration).
  </Step>

  <Step title="Point your builds at it">
    Authenticate the CLI, write the Bazel rc, target the runner groups from CI. See [local setup](/docs/aspect-workflows/enterprise/connect/local-setup) and [CI setup](/docs/aspect-workflows/enterprise/connect/ci-setup).
  </Step>
</Steps>

## Reaching the endpoints

Your cache, remote execution and build event endpoints are on the public internet, authenticated, not inside your VPC. [`aspect auth`](/docs/aspect-workflows/enterprise/connect/local-setup) and the [generated Bazel rc](/docs/cli/tasks/setup_bazelrc) handle this for developers.

For CI runners you operate yourself, or workstations that must not egress to the internet, private endpoints (AWS PrivateLink or GCP Private Service Connect) can be added to the deployment: Aspect publishes the endpoint service and you create the endpoint in your VPC. No route exchange, no CIDR coordination.

## Changing the configuration

You request configuration changes rather than applying them, since you don't hold Terraform for this deployment. [Requesting changes](/docs/aspect-workflows/enterprise/hosted/requesting-changes) covers what to send, what turnaround to expect, and which changes need a maintenance window.