Skip to content

Deployment

Overview

SailPoint Entro is delivered exclusively as a SailPoint-hosted SaaS platform. The platform, UI, and management services run in SailPoint Entro's cloud infrastructure.

To connect sources that are not accessible from the internet, deploy a SailPoint Entro Outpost in your environment. The Outpost is a connector. It is not a self-hosted version of the SailPoint Entro platform.

1. SaaS Deployment

  • Best for: Organizations that prefer ease of deployment, managed infrastructure and automatic updates.

  • Hosting: SailPoint Entro's cloud environment (AWS, region selectable).

  • Data Flow: Connectors hosted in SailPoint Entro's cloud infrastructure communicate securely with Customer's integrations via APIs over mutual TLS.

  • Security:

    • TLS encryption for data-in-motion (TLS 1.3), data encryption for data-at-rest (AES-256), secret data SHA256 hashed (for future correlation) and redacted.

    • Role-based access control (RBAC) with SSO and MFA.

    • SOC-2 and ISO 27001 aligned controls.

  • Advantages:

    • Fastest on-boarding

    • No maintenance overhead.

    • Continuous updates and feature rollouts.

    • Scales elastically with usage.

Deployment diagram

2. Customer-Hosted Outpost

Use a customer-hosted Outpost to connect sources in an on-premises or private network.

  • Best for: Sources that SailPoint Entro cannot reach from the internet, such as on-premises Git servers, internal Jira or Confluence, private Kubernetes clusters, and file shares.

  • Hosting: The Outpost runs as a Docker or Kubernetes workload in your environment. The SailPoint Entro platform, UI, and management services remain in SailPoint Entro's cloud.

  • Data Flow: The Outpost connects outbound to SailPoint Entro and communicates with your integrations through APIs over mutual TLS. After processing (including hashing and redacting sensitive data), metadata is sent to the SailPoint-hosted platform for correlation, risk processing, and reporting.

  • Requirements:

    • Kubernetes 1.24+ or Docker Compose environment for the SailPoint Entro Outpost.

    • Network access from the Outpost to SailPoint Entro and to the sources it scans.

Important

Deploying an Outpost does not deploy the SailPoint Entro platform in your environment. SailPoint Entro does not offer a self-hosted or on-premises platform deployment.

SailPoint Entro Outpost connecting a customer environment to the SailPoint-hosted platform

For installation and network details, refer to SailPoint Entro Outpost Overview, Outpost Docker Installation, Outpost Kubernetes Installation, and Network Requirements.

Deployment Process

  1. Provision infrastructure (VMs or Kubernetes cluster) for SailPoint Entro Outpost Connector(s).

  2. Deploy SailPoint Entro Outpost Connector(s) software and supporting services using Helm or Docker Compose.

  3. Connect data sources through API keys or OAuth apps.

  4. Verify collector connectivity to SailPoint Entro or self-hosted API.

  5. Validate first scan results in the SailPoint Entro Web Console.

Maintenance

  • Monitoring: Exposed via metrics and health endpoints.

  • Logs: Shipped via Fluentd or CloudWatch.

  • Backups: Automated daily backups (configurable retention).

  • Updates: Versioned container images with rolling deployment support.