"Private tenant" and "public tenant" get used for three different things. Separate them, and every conversation about staging becomes shorter.
| Question | Answer in TRANXACT Private Cloud |
|---|---|
| Is anything shared with another customer? | Never. Every deployment has its own VPC/VNet, cluster and database, and no ledger or database is shared. |
| Whose cloud account is it? | TRANXACT-hosted — a dedicated account TRANXACT provides — or customer-owned, operated by TRANXACT through a delegated automation role. |
| Is it reachable from the internet? | Public posture: HTTPS through the WAF, the default. Private-only posture: the public listener closed, reached only over VPN, private connection or peering. |
There is no shared multi-tenant edition. A customer who asks for a "public tenant" nearly always means a dedicated tenant reachable over the internet — the default posture, not a different product.
Account ownership
- TRANXACT-hosted: TRANXACT provides the dedicated account or subscription (INFRA_2.1.01) and applies guardrails, tagging and budget alerts (INFRA_2.1.04).
- Customer-owned: the customer creates the account, sets up billing, applies its landing-zone policies and grants the automation role (INFRA_2.1.02, Excluded). The provider bills the customer at list rates, and it is the customer who buys reserved capacity (INFRA_2.1.06).
- Either way, TRANXACT provisions a separate vault account with its own identities, MFA and keys (INFRA_2.1.03). The vault is never in the production account.
Which environments, which year
Tier S includes production plus one non-production environment, M plus two, L plus three, XL per landscape. Non-production databases have no HA standby, and non-production availability is 95%. More environments are Optional (TO_4.1.04).
| Env | Purpose | Year 1 | Years 2–5 |
|---|---|---|---|
| PRD | Production | Yes | Yes |
| DR | Live DR of production, full size | Yes | Yes |
| QAS | Test / regression, refreshed and masked | Yes | Yes |
| TRN | Training / sandbox | Yes | Scaled down |
| MIG | Migration trial loads (Optional, MIG_8.1.03) | Yes | Decommissioned after cutover |
| Vault | Air-gapped backups | Yes | Yes |
Write the year-2 step-down into the proposal. Every later change is a change request.
Staging order
- Before signature: account ownership, region, Live DR region, database engine, FQDN and address ranges. These are fixed once the build starts.
- Customer-owned only: the customer prepares the account and grants the role, in parallel with contracting.
- TRANXACT provisions the vault account and the guardrails.
- Network per region: the VPC/VNet and its subnets.
- Environments from infrastructure-as-code (TO_4.1.01); the code and configuration copied to the vault (TO_4.1.06) — the runtime is rebuilt, not restored.
- Credentials to the named technical contact only (TO_4.1.02); the customer verifies connectivity and SSO (TO_4.1.03).
Calderwood: TRANXACT-hosted on Azure, public posture with IP allow-listing on the listener (a Standard service request), and a site-to-site VPN for its MES and legacy systems only. Year 1 runs PRD, DR, QAS, TRN and MIG; MIG is decommissioned after cutover.
Try it Calderwood’s security team now wants production reachable only from the corporate network. What changes, in which category, and what does it do to remote users?
The public listener is closed (INFRA_2.6.05, Optional, by change request), traffic arrives over the VPN or a private connection to the internal load balancer, and the customer’s DNS resolves the FQDN to the private ingress. Remote users then need a VPN client or zero-trust access. It goes in the non-standard log, and it adds network build time.