Cloud
Fully managed by Cosmon. OAuth sign-in, LLM calls proxied through the Cosmon backend, telemetry and sync included.
On-premise (BYOK)
Runs entirely in your environment. No Cosmon backend, no account — bring your own LLM key or point at an internal model.
Cloud
Cloud is the fully managed offering. Users sign in with OAuth, and every LLM request is proxied through the Cosmon backend under Cosmon’s provider agreements. Authorization, usage telemetry, cross-device sync, and application updates are all handled automatically. Dedicated single-tenant infrastructure is available for organizations that need physical data isolation while keeping the managed experience — see backend topology.Advantages
- No infrastructure to install, patch, or maintain
- New features and model upgrades ship automatically
- One consolidated invoice — no separate LLM provider contract
- Centralized user management, team collaboration, and sync
- Cosmon owns uptime, scaling, and security patching
- Dedicated single-tenant hosting available on request
Considerations
- Prompts and responses route through the Cosmon backend
- Requires outbound network access to the Cosmon domain
- Data residency is tied to Cosmon’s hosting region, unless single-tenant
- Availability depends on Cosmon’s service uptime
On-premise (BYOK)
On-premise runs the same desktop application entirely inside your environment, with no Cosmon backend involved — no account, no telemetry, no sync. The application validates its license locally with a machine-locked product key (see authorization). From there, you choose where the model lives: point Nexus at a model hosted on your own infrastructure, so the LLM never leaves your network either, or call an external provider’s API directly using your own key. Either way, the desktop app talks only to that one endpoint — Cosmon is never in the loop.Advantages
- No data ever passes through Cosmon’s infrastructure, regardless of which model you point at
- With an internal model, nothing leaves your network at all; with an external API, only your LLM provider does
- Independent of Cosmon’s uptime
- Minimal procurement overhead — no vendor security review of a hosted backend required
- Well suited to evaluations, strict data-sovereignty, and air-gapped-adjacent environments
Considerations
- No centralized user management, collaboration, or cross-device sync
- Updates are applied manually, on your own schedule
- No consolidated billing — LLM usage is billed directly to you by the provider
- Your team manages issuing, storing, and rotating API keys
- No usage analytics or admin dashboard, by design
Compare
Which should you choose?
Choose Cloud if
You want the fastest path to value, centralized team management, and automatic updates, and you’re comfortable with a trusted vendor operating the infrastructure — with single-tenant hosting available if you need stricter isolation later.
Choose On-premise if
Data isolation is a hard requirement, your environment is air-gapped-adjacent, or minimizing your external vendor footprint matters, and your team can manage updates and API keys directly.
For the full connection model — including authorization modes, telemetry, and LLM trace collection — see Architecture overview. For network and IT allowlisting details, see IT prerequisites.