LLMs.txt directory

ThoughtSpot deployment options

ThoughtSpot offers three deployment models to fit a wide range of infrastructure, compliance, and operational requirements, from a fully managed multi-tenant SaaS to a deployment that runs entirely inside your own cloud account.

All models deliver the same core ThoughtSpot experience: AI-powered search and analytics, Spotter, Liveboards, and the Semantic Model. What differs is who manages the infrastructure, where data and metadata reside, and how much operational control you retain.

ThoughtSpot Cloud

ThoughtSpot Cloud is the default deployment option and the right choice for most organizations. ThoughtSpot provisions and operates all infrastructure on your behalf, including compute, storage, networking, security patching, upgrades, and 24×7 monitoring. You connect your cloud data warehouse and start building analytics immediately, with no servers to provision or software to install.

ThoughtSpot Cloud uses a multi-tenant architecture. Each customer’s data and metadata are logically isolated from all other customers within the shared ThoughtSpot infrastructure. Data is never replicated into ThoughtSpot. Every query is sent live to your connected data warehouse and only results are returned to the ThoughtSpot UI.

Virtual Private ThoughtSpot

Virtual Private ThoughtSpot (VPT) provides complete physical isolation within ThoughtSpot-managed infrastructure. Almost every component, including compute, storage, search indexes, and communication services, is provisioned exclusively for your organization. Nothing is shared with any other customer. ThoughtSpot continues to manage 24×7 operations, upgrades, and security inside an architecture dedicated to you.

VPT adds support for Bring Your Own Key (BYOK). Your encryption keys, managed in your key management system, protect all data at rest. If you revoke your key, all data in your VPT instance becomes immediately and cryptographically inaccessible, even to ThoughtSpot.

For more information about BYOK for VPT, refer to Bring Your Own Key (BYOK) for ThoughtSpot on GCP VPT and Bring Your Own Key (BYOK) for ThoughtSpot on AWS VPT.

Customer-hosted ThoughtSpot

Customer-hosted is ThoughtSpot’s enterprise deployment solution for organizations with the most stringent security requirements. ThoughtSpot runs entirely within your own GCP project or AWS account. No data leaves your firewall.

Availability: Customer-hosted ThoughtSpot has limited customer availability. Contact your account team to discuss eligibility.

Key characteristics

  • VPC-isolated cloud deployment — All application components run in your cloud account/VPC. Customer analytical data never traverses ThoughtSpot’s network.

  • Sovereign AI deployment — Spotter and LLM agents run in your cloud environment through your BYOLLM endpoint.

  • Zero data residency compromises — Built for regulated industries, including financial services, healthcare, and government.

  • Cloud-native — Runs on standard Kubernetes infrastructure within your account. Available on GCP now, with AWS support coming soon.

  • BYOK support — Your KMS keys protect all data by default because it runs in your account.

  • No third-party data flows — There are no external data flows to third-party observability or analytics services.

Architecture

Network security

All traffic stays within your secure network. Customer-hosted ThoughSpot integrates with your existing network security practices.

Encryption

HTTPS and TLS 1.3 encrypt all data in transit. Backups are encrypted in your secure environment. BYOK is enabled by default because the deployment runs in your account and uses your keys.

Data isolation

High isolation — customer data, metadata, and column indexes stay in your cloud environment. Analytical data never leaves your firewall, while standard operational telemetry connects securely to the ThoughtSpot hub.

Control plane

In customer-hosted ThoughtSpot deployments, a ThoughtSpot control plane runs within your account. ThoughtSpot provides operations tooling, automation, lifecycle management, and audit trails, but these all run within your boundary. ThoughtSpot maintains a connection through a service account to store licensing information and to push upgrades and patches.

Feature comparison

The following table compares key capabilities across all three deployment models.

Feature ThoughtSpot Cloud Virtual Private ThoughtSpot Customer-hosted ThoughtSpot

Infrastructure ownership

ThoughtSpot (shared)

ThoughtSpot (dedicated)

Customer (own cloud account)

Data isolation

Logical

Physical (dedicated cell)

Customer Environment (telemetry/licensing syncs to Hub)

Control plane location

ThoughtSpot

ThoughtSpot

Customer

BYOK / CMEK support

No

Yes

Yes

Spotter / AI features

Yes

Yes

Yes (BYO LLM on GCP). AWS will support Spotter 3 only.

Third-party data flows

Yes

Partial

None for analytical data (System health/telemetry flows to ThoughtSpot hub)

Analyst Studio

Yes

No

Not currently available

Cloud provider support

GCP, AWS

GCP, AWS

GCP (available now); AWS (coming soon)

AgentSpot

Yes

No

Not available

Status

GA

GA

Limited availability

Support model

The level of ThoughtSpot support differs by deployment model.

Aspect ThoughtSpot Cloud / Virtual Private ThoughtSpot Customer-hosted ThoughtSpot

Infrastructure

ThoughtSpot-managed

Customer-managed

Upgrades

ThoughtSpot-managed; customer notified

ThoughtSpot-delivered; customer-applied within 30 days

Monitoring

ThoughtSpot 24×7 monitoring

Customer responsibility

Support scope

Full stack (infrastructure and application)

Application only

Incident response

ThoughtSpot triage; proactive response

Customer triage; ThoughtSpot assists

SLAs

Defined availability SLA

None for uptime (application incident response only)

Prerequisites for customer-hosted ThoughtSpot

Before you begin, confirm the following general requirements. Your ThoughtSpot setup email includes the installer service-account name to use. ThoughtSpot has already granted that service account read access to the ThoughtSpot image registry.

Customer-hosted ThoughtSpot is currently available on GCP. AWS prerequisites are documented below for the future release.

  • A service account for ThoughtSpot. ThoughtSpot SRE teams retain secure access to assist with cluster troubleshooting and emergency support.

  • Persistent connectivity to the ThoughtSpot hub for call-home, patches, upgrades, and troubleshooting. The central hub coordinates deployment and lifecycle operations by pushing new artifact versions and configuration updates.

GCP prerequisites

Your project

  • A dedicated Google Cloud project with billing enabled. ThoughtSpot assumes one cell per project. Do not share the project with other workloads.

  • A user who can enable APIs and create service accounts, IAM bindings, VPCs, Cloud DNS zones, KMS keys, Cloud Storage buckets, Cloud Run jobs, and GKE clusters in the project, for the duration of the install. The installer runs as that user’s own identity (gcloud auth application-default login).

  • Organization policies that allow, in the project: service-account creation, private GKE clusters, Private Service Connect endpoints, VPC peering, and Workload Identity Federation from ThoughtSpot’s identity pool.

  • Compute quota in your region for two autoscaling node pools of e2-standard-8 machines, 1 to 10 nodes each, up to 20 nodes (160 vCPUs) at full scale.

Address ranges

The cell uses fixed address ranges. These ranges must not overlap any network you peer with or route to from these VPCs.

Range Used by

10.0.0.0/16

Cell (Nucleus) VPC: subnets, GKE pods and services, Cloud Run connector

10.253.0.0/16

Atom VPC

A range starting at 172.16.0.0

Private Service Access for Google managed services

Installer machine

A machine with the Google Cloud CLI (gcloud) and Terraform installed, signed in to your project.

A cell is a self-contained deployment boundary that houses all the services required to run ThoughtSpot. The nucleus is the control-plane Kubernetes cluster inside a cell that orchestrates infrastructure and manages atoms. An atom is a Kubernetes cluster within a cell that hosts the ThoughtSpot instance, providing the isolated runtime environment for the deployment.

AWS prerequisites (coming soon)

  • A dedicated AWS account for ThoughtSpot. Sharing the account with other workloads is not recommended.

  • A user with administrator access to the account for the duration of the install.

  • Service control policies (SCPs) that allow the IAM, EKS, RDS, ElastiCache, KMS, Lambda, and VPC actions the installer uses.

  • Thoughtspot setup email containing some infrastructure parameters that will help in connecting to the customer-hosted hub.

Address ranges

The cell uses fixed address ranges. These ranges must not overlap any network you peer with or route to from these VPCs.

Range Used by

10.0.0.0/16

Cell (Nucleus) VPC: subnets, EKS pods and services

10.253.0.0/16

Atom VPC

A range starting at 172.16.0.0

Private subnets for AWS managed services

A cell is a self-contained deployment boundary that houses all the services required to run ThoughtSpot. The nucleus is the control-plane Kubernetes cluster inside a cell that orchestrates infrastructure and manages atoms. An atom is a Kubernetes cluster within a cell that hosts ThoughtSpot instance, providing the isolated runtime environment for the deployment.

Account preparation

Plan for at least the following quotas in the deployment region:

Quota Minimum

EC2-VPC Elastic IPs

20 (6 for NAT gateways, plus load balancer and VPN addresses and headroom)

VPCs per region

10

Installer machine

A workstation pre-configured with Terraform and active AWS access credentials required to execute the setup script.

Configuration and installation

Once the cloud-specific prerequisites for either GCP or AWS are satisfied, the remaining installation and deployment process is identical across both platforms.

  1. Download the installer on the machine using the link provided in your setup email.

  2. To configure your deployment, update the customer.tfvars file with your specific environment details, such as your domain, certificate, target region, and installer service account name.

    Do not modify any settings below the "DO NOT MODIFY" marker in customer.tfvars. These define default ThoughtSpot infrastructure settings. 
tar xzf ch-installer-v1.0.0.tar.gz

cp customer.tfvars.example customer.tfvars

# Fill in gcp_project, customer_region, installer_sa_name (GCP only)
gcloud auth application-default login   (1)

./install.sh --config=customer.tfvars
1 This step is required for GCP only.

install.sh runs three phases. You can re-run the entire script, or a single phase, safely. Every phase is idempotent.

Phase Command What it does

1. Project init

./install.sh --config=customer.tfvars project-init

Enables APIs, creates the Terraform state bucket and service accounts, and generates the cell’s IDs.

2. Cell

./install.sh --config=customer.tfvars cell

Builds the Nucleus and Atom networks and clusters, and connects the cell to the ThoughtSpot Hub.

3. Check

./install.sh --config=customer.tfvars check

Connects to both clusters and confirms their nodes are ready.

Verify the installation

Run the check phase to verify that the deployment is complete and healthy:

./install.sh --config=customer.tfvars check

Upgrades and day-2 operations

ThoughtSpot delivers every upgrade and patch through the same private connection used at install time. Your team does not run upgrade commands.

  • Service updates — New versions of cell services arrive as manifests from the Hub and are applied automatically when maintenance is scheduled.

  • Images — New container images are pulled through the Hub.

  • Tenant upgrades — New ThoughtSpot releases for your tenants run in a maintenance window, scheduled or started by a ThoughtSpot operator.

  • Patches — Delivered as small upgrades through the same path.

  • Health — A status page in the cell UI shows overall cell health (Healthy, Degraded, or Down) and per-tenant status.

ThoughtSpot maintains a connection through a service account to provide weekly patches and monthly upgrades. You see a pending action message on your control plane and are expected to apply the change.

Your responsibilities

  • Keep the account’s quotas, billing, and organization policies in place.

  • Do not modify or delete resources the installer created, including network, firewall rules, the private endpoint, DNS zones, clusters, databases, keys, or the ThoughtSpot identities, without contacting ThoughtSpot first.

  • Notify ThoughtSpot about planned network or policy changes that could affect the connection to the Hub.

Frequently asked questions

Does ThoughtSpot ever store my query results?

No. For all deployment models, ThoughtSpot connects to your cloud data warehouse (CDW) with read-only access to execute queries. Query results are not stored or cached within ThoughtSpot. They are returned directly to the requesting user or application. Your data records reside in your CDW at all times.

What is the difference between VPT and customer-hosted ThoughtSpot?

In VPT, ThoughtSpot owns and manages the dedicated infrastructure. It exists in ThoughtSpot’s cloud account but is exclusively provisioned for your organization. In customer-hosted ThoughtSpot, the infrastructure runs in your GCP project or AWS account. You own it, and ThoughtSpot provides the application and support.

Can I use my own encryption keys (BYOK)?

BYOK / CMEK is available in VPT and customer-hosted ThoughtSpot deployments. It is not available in standard ThoughtSpot Cloud (multi-tenant). With BYOK, your KMS key encrypts all data at rest, and revoking the key immediately renders all data cryptographically inaccessible. Note that the ThoughtSpot global control-plane state uses ThoughtSpot-managed keys even in BYOK configurations.

Is Spotter available in all deployment models?

Spotter is available in ThoughtSpot Cloud, VPT, and customer-hosted ThoughtSpot. In customer-hosted ThoughtSpot deployments on GCP (available now), Spotter agents run in your cloud environment once you configure a BYOLLM endpoint for sovereign AI operation. When AWS support launches, only Spotter version 3 will be supported initially. Analyst Studio is not currently available in customer-hosted ThoughtSpot deployments.

Which cloud providers are supported?

Customer-hosted ThoughtSpot is available on GCP now. Support for AWS is coming soon. ThoughtSpot Cloud and VPT are available on both GCP and AWS.

Are the Spotter Agents available for a customer-hosted deployment?

While Spotter 3 is available for customers to use with BYOLLM, the Spotter Agents (SpotterViz, SpotterModel, and SpotterCode) are not available with BYOLLM for AWS.

How do upgrades work?

ThoughtSpot delivers automated patches and monthly upgrades through the hub connection. Customers will be notified to schedule and apply regular updates within a 30-day window, and critical security patches within 7 days, to maintain service compatibility.