Ask five cloud teams how they’ve deployed their backup infrastructure and you'll get five different answers.
Some are bound by regulations that don't let data leave their own account, so control is mandated. Others like having their hands on every dial because that's how they deploy everything else in their environment.
But there's another camp. Maybe it's a two-person platform team that inherited backup on top of everything else they already own. Maybe it's a company moving fast that would rather not stand up another piece of infrastructure just to check a box. Either way, they don't want dials. They want to connect an account, set a policy, and get on with their day.
Rubrik doesn't make you pick a side. Our cloud protection ships in two deployment models: customer-hosted (where you run the compute and storage inside your own AWS accounts) and Rubrik Managed Cloud Protection, where Rubrik hosts and manages that infrastructure for you. Both deployment models use the same policy engine, same recovery experience, same immutable and air-gapped backups, and the same place you go to check on things in Rubrik Security Cloud. What changes is who's running the plumbing.
Backing Up the Cloud: What it Actually Takes
Before getting into the two models, it helps to know what Rubrik actually needs to protect a workload in AWS, because both customer-hosted and managed cloud models are built from the same two ingredients.
The first is compute. Something has to read your snapshots, process the data, and move it somewhere durable. Rubrik calls this layer exocompute: a set of containers that spin up when there's work to do, handle the backup or restore job, scan backups for anomalies and threats, precompute clean restore points, and spin back down. It's not a server sitting idle waiting for a job. It only exists while it's working.
The second is storage. Once exocompute has processed the data, it has to land somewhere immutable and outside the reach of whatever might be happening in your production environment. That's the vault: the actual place your backups live, locked down so nothing, including a compromised account, can quietly delete or alter them.
Every cloud backup Rubrik performs needs both pieces: compute to do the work, and storage to hold the result. The only real question is whose account they run in, and who's operating them. That's exactly what the two deployment models decide.
The Two Deployment Models
Now that you know what exocompute and the vault actually do, the two deployment models are really just a question of whose account they run in, and how much of the surrounding infrastructure you want to own.
Customer-hosted: With customer-hosted protection, exocompute runs inside your own AWS account, but Rubrik still manages it: spinning it up when there's work to do, patching it, and tearing it down when the job's finished. What you own is the account boundary itself: the networking, the IAM roles, and the security posture around it.
Rubrik teams ultimately work with organizations to review scope and customize security permissions to suit requirements, however the deployment itself lives inside a customer owned account. Storage works on the same principle. By default, your backup data lands in a storage target you own, whether that's the same account running compute or a separate account you designate for it.
Either way, it's your account and completely under your control. If you'd rather not manage the storage piece either, you can point it at Rubrik Cloud Vault instead and offload storage the same way Rubrik Managed does, ensuring backups are outside of your authentication domain while keeping compute in your own account.
This is a genuinely good fit for organizations with strict requirements about where data lives, or teams that want full ownership of the account boundary itself, not a fallback option. Your data never leaves your AWS organization, you choose the exact region, you control the network path, and you get the full breadth of workload and configuration options as they roll out.
Rubrik Managed: With Rubrik Managed Cloud Protection, exocompute and the vault both run inside Rubrik's environment instead of yours. You deploy a single cross-account IAM role with narrowly scoped permissions, pick the regions you want protected, and discovery starts. There’s no VPC to configure, no Kubernetes cluster to size, no storage to stand up. Data moves out of your account into the Rubrik-managed vault and Rubrik operates the infrastructure end to end.
The natural question is what happens to data once it leaves your account. Here's what's actually in place:
Your backups are isolated within Rubrik's managed environment, with access controls that keep any other tenant from reaching your data.
Traffic between your environment and the Rubrik-managed account moves over the AWS backbone; it never touches the public internet.
Data in-transit and at rest is fully encrypted, using your own keys or platform provided keys.
Every backup written to the vault is locked with Object Lock immutability by default, no configuration required on your end.
If you're using your own encryption keys, Rubrik requests access to them just long enough to complete the backup or restore job, then that access is revoked; there's no standing grant sitting around. And nobody on Rubrik's side has direct human access to the vault. Every operation, including Rubrik's own, goes through the same control plane API that your policies use.
The real consideration isn't safety, it's where the data physically resides. Rubrik Managed moves data outside your AWS organization by design, so it's not the right fit if your policy specifically requires backups to stay inside your own account boundary.
How to Choose
Start with your data residency and sovereignty posture. If policy requires backups to stay inside your own AWS organization, full stop, customer-hosted is the answer. If there's flexibility there, keep going.
From there, think about your team. Do you have the cloud platform expertise, and the appetite, to manage the networking and security boundary around your cloud environment long term? If yes, customer-hosted lets you use it, while Rubrik still handles exocompute itself. If your team would rather spend that time elsewhere, Rubrik Managed removes that work entirely.
Then weigh speed to value against feature breadth. Rubrik Managed gets you protecting workloads fast, with a narrower slice of configuration options today. Customer-hosted involves an engaged deployment experience to scope and approve security permissions to get the desired functionalities.
Plenty of teams run Rubrik Managed for accounts where speed matters most and customer-hosted for the ones carrying stricter compliance requirements.
Best Practices for Each
If you're running customer-hosted use Terraform, or your infrastructure-as-code tool of choice, to deploy the networking, IAM roles, and account scaffolding. This makes your backup and recovery workflows repeatable across accounts instead of clicking through the console each time. Plan your account and networking topology before you scale past a handful of accounts, not after. And keep an eye on IAM permissions over time. Environments drift, and a role that worked fine at launch can quietly become a bottleneck if nobody revisits it.
If you're running Rubrik Managed, the setup is lighter but it's still worth doing a few things properly. Loop your security and compliance team in early so they can review the data flow before onboarding, not after. Understand which pieces are abstracted away, like storage, versus which ones you still control, like SLA policy and key management if you're bringing your own keys. And if you're onboarding more than a handful of accounts, use Terraform to deploy the cross-account IAM role instead of doing it by hand in the console. Rubrik's Terraform provider supports it.
Why it Matters
The best backup architecture is the one that matches how your organization actually operates. There's no one-size-fits-all version of that. Some teams need full control over where their data lives and are staffed to manage that. Others need protection to work without adding infrastructure to their plate. Rubrik built both models on the same underlying platform so that choice doesn't cost you anything in resiliency, recovery experience, or where you go to manage it all.
Want to learn more? Check out the Delivering the Blueprint for Cloud session from our Cyber Resilience summit. Want to get hands on? Take our self-guided, hands-on lab to see it in action for yourself.