# Bring Your Own Cloud (BYOC) for AI Coding Agents

> Bring your own cloud (BYOC) means AI coding agents and dev environments run on compute in your own cloud account. What it covers, who offers it as of October 2026, and what to ask vendors.

Published October 17, 2026 · by the AQ team · Canonical: https://aq.dev/guides/bring-your-own-cloud-for-coding-agents/

Bring your own cloud (BYOC) means your development environments, and the AI coding agents working inside them, run on compute in your own cloud account: your network, your credentials, your data, on machines you can audit and delete, while a vendor supplies the software around them. The term got a visibility push on October 16, 2026, when Replit announced an enterprise BYOC program, but the pattern is older and available far more broadly: you can have it today with a plain VM and tmux, with a self-hosted platform like Coder, or with AQ, where running on your own cloud is part of the standard paid plan rather than an enterprise preview.

## What "bring your own cloud" actually covers

A coding agent setup has three separable pieces, and BYOC offers differ in which pieces move into your account:

- **The model.** The LLM doing the reasoning. In almost every BYOC setup it remains a hosted API: prompts, which include code context, still go to the model provider. BYOC moves execution and custody, not intelligence.
- **The platform.** The dashboard, orchestration, and session management. Some offers move this into your cloud too; most keep it vendor-hosted and move only the next piece.
- **The execution environment.** The filesystem with your repository clone, the shell the agent runs commands in, your GitHub tokens, database URLs, and network position. This is where the custody stakes live, and it is the piece every serious BYOC offer moves into your account.

When a vendor says BYOC, the first question is which of these pieces actually lands in your cloud. The distinctions are the same ones that apply to [self-hosted AI coding agents](https://aq.dev/guides/self-hosted-ai-coding-agents/); BYOC is the same idea described from the vendor's side.

## Why teams want agents in their own cloud

- **Code and credential custody.** The repository clone, build artifacts, and the real secrets a useful agent holds (a GitHub token that can push, database URLs) stay on hardware in your own account.
- **Internal network access.** Agents inside your network reach private package registries, staging databases, and services behind your VPN without exposing them.
- **Data residency and review.** "Execution stays in our cloud account" is a short, auditable answer for a security review.
- **Compute economics.** You pay your cloud provider's price for the machine, not a platform's bundled compute margin.

## The BYOC landscape as of October 2026

| Route | What runs in your cloud | Availability as of October 2026 |
| --- | --- | --- |
| Plain VM you operate | Everything except the model: agent CLIs, repos, credentials | Any cloud, today; you build the team glue yourself |
| AQ | The execution environment: agents, repos, credentials on VMs you connect from your own cloud account; AQ hosts the dashboard | Part of the Pro plan ($50 per user per month early access); also offers AQ-managed VMs |
| Coder | The whole platform, air-gap capable | Self-hosted platform, generally available |
| Cursor, Warp Oz | Self-hosted workers that attach to the vendor's hosted platform | Worker options on hosted products; see the self-hosted guide for details |
| Replit BYOC | Three tiers: the full platform as managed "cells" in your tenant, hosting for published apps only, or exported Docker images you operate | Enterprise only; full BYOC in private preview, the other two in early access; Azure, Google Cloud, and AWS (announced October 16, 2026) |

Two patterns are worth separating. In the first, the vendor's software runs in your account but the vendor still operates it remotely (Replit's cells, where Replit manages the infrastructure inside your tenant). In the second, your machines run the workloads and you hold root, while the vendor's hosted control plane coordinates sessions (AQ, and the self-hosted worker options). Both keep code and credentials in your account; they differ in who administers the boxes and how much upfront setup the vendor needs from you.

## Questions to ask any BYOC vendor

- **Which pieces move?** Execution only, or the platform too? Is the model still a hosted API (it almost always is)?
- **Who holds credentials?** Are agent logins and GitHub tokens per engineer on your machines, or pooled in the vendor's service?
- **Who administers the machines?** Can your team SSH in, audit, and wipe them? Does the vendor have remote management access to infrastructure inside your account?
- **What is shared?** Is there a multi-tenant execution tier anywhere in the path, or is your compute exclusively yours?
- **Who can buy it?** Is own-cloud execution on the standard plan, or gated behind an enterprise contract, a preview program, or a sales call?
- **What is the exit?** If you leave the vendor, what survives in your account: repositories, machines, exported images?

## Where AQ fits

AQ is the multiplayer coding harness where engineering teams run AI coding agents like Claude Code and Codex together: shared live terminals, a code editor, and app previews, in your own cloud. Running on your own cloud is not an enterprise tier in AQ; it is how the product is built. The Pro plan ($50 per user per month early access, standard $200, billed monthly, rate locked for your first 12 months) covers VMs you connect from your own cloud account, or a dedicated always-on AQ-managed VM in its own isolated network if you would rather not operate one.

On your VM, agents run as real CLIs (Claude Code, Codex, Cursor Agent, Kimi, Grok, or plain shells) in persistent tmux sessions streamed live to the browser, so sessions survive a closed laptop and teammates can open the same workspace and watch or steer the same live session. Custody follows the BYOC lines above: each engineer signs into the CLIs with their own Claude or OpenAI account (no inference markup, no shared vendor key), commits and pull requests use per-user GitHub auth, every workspace is an isolated git worktree, and there is no shared multi-tenant execution tier. The operational glue is included: runner health is visible in the product, the installer runs preflight checks, and an aq-runner doctor command diagnoses a broken host. The Free plan is a personal sandbox AQ creates for one person, with no time limit, so you can evaluate everything before connecting your own machines.

Plainly: if your policy requires the whole platform inside your network, a fully self-hosted or air-gapped product is the right shape, and if you are one engineer, a plain VM is enough. AQ is for teams that want own-cloud execution with the collaboration and persistence already built, on a standard plan rather than an enterprise agreement.

## Frequently asked questions

### What is bring your own cloud (BYOC) for AI coding agents?

BYOC means the environments where AI coding agents read code, run commands, and hold credentials are compute in your own cloud account rather than the vendor's. The vendor supplies the software; your account supplies (and owns) the machines. In most BYOC setups the model itself is still a hosted API.

### Is BYOC the same as self-hosting?

They overlap. Self-hosting usually means you operate the software; BYOC means the workloads run in your cloud account, whoever operates them. A fully self-hosted platform is the strictest form. Some BYOC offers run vendor-managed infrastructure inside your tenant, which keeps data in your account but leaves administration with the vendor. Ask which pieces move and who holds root.

### Does Replit support bring your own cloud?

Yes, as an enterprise program announced October 16, 2026, with three options: the full platform running as Replit-managed cells in your Azure, Google Cloud, or AWS tenant (private preview), hosting published apps in your tenant while Replit hosts the platform (early access), and exported Docker images your team deploys and operates (early access). As of October 2026 it is not part of Replit's standard plans.

### Can I run coding agents in my own cloud without an enterprise contract?

Yes. A plain Linux VM with tmux and the agent CLIs needs no platform at all, and AQ includes own-cloud execution on its standard Pro plan at $50 per user per month (early access pricing, standard $200): you connect VMs from your own cloud account and the agents run there.

### Does BYOC keep my code away from the model provider?

No. BYOC moves execution and custody: the repository clone, credentials, and shell stay in your account. Prompts, which include code context, still go to whichever hosted model the agent uses. Only a locally served open-weight model, or an air-gapped platform pointed at one, keeps source-derived prompts inside your network.

---

About AQ: AQ is the multiplayer coding harness where engineering teams run AI coding agents like Claude Code and Codex together: shared live terminals, a code editor, and app previews, in your own cloud. Start at [aq.dev](https://aq.dev/).