AuthZed Dedicated
Build great features.
Not authorization infrastructure.
Dedicated is the same SpiceDB engine and the same single-tenant isolation as Self-Hosted
— delivered as a private managed cloud. What changes is who runs it. Below is each of the
fourteen capabilities Dedicated adds: what it is, how it helps, and where the saving comes from.
Self-hosted · SpiceDB Enterprise
You run it
You run SpiceDB in your own infrastructure with AuthZed’s premium support. You operate
encryption, networking, isolation, upgrades, monitoring and the control plane.
Dedicated · private managed cloud
AuthZed runs it
AuthZed runs a private, single-tenant SpiceDB cloud for you — adding managed security,
observability, Materialize and a full control plane on top of everything Self-Hosted includes.
The fourteen, at a glance
Grouped by what they do for you. Click any one to jump straight to it. + marks an optional add-on at additional cost.
Security & reliability
01 – 03
01
Managed encryption
in-flight, at-rest and backup
- Encrypted in transit, at rest and in backups — including key management
- Passes security review without you designing the cryptography
- No key rotation or encrypted-backup system to build and run
02
Private networking
- Traffic runs over private networking, not the public internet
- Much smaller attack surface, and meets strict network-security requirements
- No peering, VPNs or hardening for your team to operate
03
Workload isolation
single-tenant
- Single-tenant infrastructure, never shared with other customers
- Predictable performance, with no noisy-neighbour risk
- No dedicated hardware to buy, and no over-provisioning just in case
Stability & risk reduction
07
07
Automated updates
- Always on a supported, patched, regression-tested version
- Managed upgrades, no maintenance windows
- No upgrade planning, testing or downtime risk
Observability
08 – 09
08
Official Datadog integration
- Authorization metrics stream straight into Datadog
- Lands in the dashboards and alerts your team already uses
- No telemetry plumbing to build or maintain
09
Out-of-the-box metrics dashboards
- Prebuilt dashboards, ready in the control plane
- Health and performance visible from day one
- Nothing to design, wire up or keep working
Management
10 – 14
10
Control plane SSO authentication
- Single sign-on for your team’s control plane access
- Meets enterprise identity and SSO requirements
- Simpler audits, and one-step offboarding
11
Cloud control plane
- Provision, configure and operate permission systems through a managed interface and API
- AuthZed handles the infrastructure underneath
- No team needed to deploy, scale and babysit SpiceDB
12
Dedicated control plane infrastructure
- A single-tenant control plane, not just a single-tenant data plane
- Isolation all the way up the stack
- Nothing private for you to build and run, and a smoother security review
13
Control plane API for provisioning
- A programmatic API for your permission-system resources
- Automate environment creation, scaling and configuration
- Folds provisioning into your existing workflows and CI
14
Terraform provider for provisioning
- Manage your Dedicated resources as code
- Version-controlled, reviewable, repeatable environments
- No manual setup, and no configuration drift
Support
Premium & Enterprise
Both tiers include the same people, the same channels and the same team. They differ in exactly two
places — how much onboarding you get, and how fast someone responds when production is
down.
| What you get | Premium | Enterprise |
|---|
| Schema design | ✓ | ✓ |
| Architecture review | ✓ | ✓ |
| Support desk · email | ✓ | ✓ |
| Slack support | ✓ | ✓ |
| Dedicated account team | ✓ | ✓ |
| Onboarding calls |
Four weekly 30-minute calls |
Eight weekly 60-minute calls |
| Response time SLA for P1 and P2 | ✓ | ✓ |
Response times
| Severity | Premium | Enterprise |
|---|
| P1 — complete production outage with critical impact to business |
12 hours |
1 hour |
| P2 — non-production outage, or an impaired production environment |
12 hours | 12 hours |
| P3 — general support, architecture, product questions, feedback |
One business day | One business day |
Difference one
Onboarding
Four 30-minute calls becomes eight 60-minute calls — four times the onboarding
time. That matters most in the first quarter, while the schema is still being shaped.
Difference two
P1 response: 12 hours → 1 hour
The only severity level that changes. If a complete production outage is a business event rather
than an engineering one, this is the row the decision turns on.
Worth saying out loud. Everything else is identical — schema design, architecture review,
Slack, email, and a dedicated account team are on both. Most of the day-to-day value is in those
shared rows: authorization’s hard problems are usually modelling problems rather than outages,
and access to the people who wrote the schema language is worth more on an ordinary Tuesday than it is
at 3am.
The bottom line
All the control of Self-Hosted.
None of the operational weight.
AuthZed Dedicated keeps the single-tenant isolation and premium support of Self-Hosted, then takes
encryption, networking, upgrades, observability, Materialize and the control plane off your team’s
plate — turning hidden operational cost into a predictable, managed service.