Thunderduck inside your own cloud account.
Run Thunderduck inside your own AWS or Google Cloud account. Your data, your credentials and the compute that touches them stay behind your network and your IAM, while we keep the platform running and up to date.
The managed platform, without handing over your data.
BYOC is for teams whose data can't leave their own account: regulated industries, strict residency rules, or simply a security team that wants every control in its own hands.
Data stays in your account
Tables, files and query results live in your own buckets. Queries run on compute in your account, next to the data.
Your IAM and network
Access goes through roles and network rules your security team already owns and reviews.
Credentials in your vault
Database passwords and tokens are kept in your cloud's secrets manager and read only when a query needs them.
Audit in your own logs
Cloud API calls land in your CloudTrail or Cloud Audit Logs, alongside Thunderduck's own query history.
Built on each cloud's own services.
AWS
Available- AWS Glue Data Catalog for your Iceberg tables, on S3
- Runs on ECS or EKS, whichever your team prefers
- Credentials in AWS Secrets Manager
Google Cloud
Available- GKE Autopilot cluster, so there are no nodes to manage
- Nessie catalog for your Iceberg tables, on Google Cloud Storage
- Credentials in Google Secret Manager
Azure
Coming soon- Azure is next. Tell us about your setup and we'll bring you in early.
You own the account. We run the platform.
- The query engine and its workers
- Your catalogs and buckets
- Your credentials
- Query results
- Installs and upgrades
- Worker sizing per query
- New features as they ship
- Support from the team that builds it
