From cloud to on-prem — we've got you covered

Smallstep offers three deployment models designed to meet different operational and compliance requirements. Smallstep Cloud is a fully managed SaaS platform that provides globally available certificate authorities, attestation services, and RADIUS and VPN integrations. It requires no infrastructure to operate, delivers the fastest onboarding experience, and includes automatic updates.

Smallstep Run Anywhere is a self-hosted edition of the full Smallstep platform that can be deployed in customer-controlled cloud environments, on-prem data centers, or air-gapped networks. It offers full feature parity with the SaaS platform while keeping operations under the organization’s control, making it suitable for data sovereignty and regulatory constraints.

Smallstep Open Source consists of step-ca and the step CLI for teams that want to manage their own certificate authority infrastructure. It is well suited for development environments, internal PKI, and custom integrations, but it does not include the full device and workload identity platform. Across all three models, the underlying architectural principles remain the same; only the operational model differs.

Smallstep Cloud uses a multi-tenant architecture with cryptographically isolated trust boundaries. Each customer is provisioned with dedicated certificate authority hierarchies, including roots and intermediates, and private keys are stored in FIPS 140-2 or 140-3 compliant HSMs. Attestation and certificate signing occur within tenant-specific trust zones, ensuring strong isolation.

Device and workload data never co-mingle across tenants, and all agent-to-cloud communication is authenticated using mutual TLS. This design allows customers to benefit from world-class operational security without having to manage certificate authority infrastructure themselves.

Run Anywhere is the self-hosted deployment option for the full Smallstep platform. It is designed for environments that require air-gapped or offline operation, strict data residency or sovereignty controls such as GovCloud or regulated private clouds, customer-managed HSMs and key management systems, and custom network boundaries with tailored audit controls.

It can be deployed on Kubernetes, virtual machines, or bare metal infrastructure, and provides maximum operational control while retaining the full feature set of the Smallstep platform.

step-ca delivers a modern certificate authority but does not include the broader identity platform around it. It focuses on certificate issuance through ACME, OIDC, and SSH, supports workload identity using AWS, GCP, and Azure instance identity documents, and provides the basic building blocks needed to run a PKI.

Run Anywhere extends beyond the CA to deliver a complete Zero Trust device and workload identity platform. It adds device identity and attestation pipelines, end-to-end certificate lifecycle automation for Wi-Fi, VPN, SSH, SaaS, and ZTNA, multi-CA orchestration with metrics, policy, and visibility, deep integrations with MDMs, identity providers, SIEMs, and network systems, and full revocation, inventory, posture gating, dashboards, and operational tooling.

Smallstep Cloud is designed for high resilience and operational simplicity. It runs on a multi-region backend with redundant HSM clusters, supports automatic failover and disaster recovery, and receives continuous upgrades without requiring any customer action.

Run Anywhere provides high availability through Kubernetes replicas and multi-zone deployments, with PostgreSQL high availability for persistent CA state and optional HSM or KMS redundancy. Disaster recovery planning and execution remain under customer control.

The open-source option does not include built-in clustering or high-availability features. Replication, failover, and resilience must be designed and operated manually by the organization.

A typical Run Anywhere deployment is built on a Kubernetes cluster such as AKS, EKS, GKE, OpenShift, on-prem Kubernetes, or K3s. PostgreSQL is used to provide durable storage for CA state, attestation logs, and policy data, while Redis handles caching and ephemeral workflow state.

Certificate authority keys can be protected using an optional HSM or cloud KMS, and load balancers or ingress controllers expose ACME, attestation, and control plane endpoints. This architecture closely mirrors the Smallstep SaaS service, but is fully owned and operated by the customer.

Yes, Run Anywhere is commonly deployed in environments with strict regulatory and sovereignty requirements. These include AWS GovCloud, Azure Government, private OpenShift clusters, vSphere or VMware Tanzu environments, and highly regulated networks across finance, healthcare, defense, and critical infrastructure sectors.

The platform is designed to support strong data custody controls and data immobility requirements in these environments.

Key protection differs by deployment model. Smallstep Cloud always uses HSM-backed keys that are compliant with FIPS 140-2 or 140-3 standards. Run Anywhere allows customers to use their own HSM or KMS for key protection, with software-based keys as an alternative when required.

The open-source deployment uses software keys by default, with HSM integration available but manual and optional. For production root and intermediate certificate authorities, hardware-backed keys are strongly recommended.

For scale and operational simplicity, Smallstep Cloud is the best option. It provides globally distributed, auto-scaling certificate authority and attestation infrastructure with no operational overhead for customers.

For regulated environments, Run Anywhere is preferred. It delivers the same scalability and capabilities as the SaaS platform while allowing customers to manage the underlying infrastructure. The open-source step-ca is not recommended for large fleets without significant customization, as it lacks built-in high availability, attestation orchestration, and revocation pipelines.

Yes, hybrid deployments are common and well supported. Organizations often use Smallstep Cloud for device identity while running Run Anywhere for restricted workloads, or rely on the SaaS platform for operations while deploying an on-prem registration authority for local attestation.

Other common patterns include using Run Anywhere in production with open-source step-ca for development, or combining the SaaS identity layer with on-prem RADIUS, VPN, or SSH enforcement points. These hybrid models allow teams to maintain a unified identity framework while respecting compliance requirements and network segmentation boundaries.

Smallstep Cloud handles upgrades automatically, including patches, attestation root updates, and security fixes, with new features delivered to customers immediately and transparently.

Run Anywhere upgrades are performed through Helm or automation tooling, with customer-controlled maintenance windows and scheduled schema migrations or CA rotations as required. The open-source option requires fully manual upgrades, with operators responsible for migrations and configuration changes, and does not include an SLA or managed support unless separately contracted.

Yes, migration is designed to be non-disruptive. Typical migration flows include importing existing CA roots and intermediates, replaying historical attestation records into new inventory systems, and updating device agents to point to the new control plane.

Organizations can perform live cutovers or phased migrations for Wi-Fi, VPN, and SSO enforcement, with optional cross-signing during the transition. Devices and workloads continue operating without interruption throughout the process.