> ## Documentation Index > Fetch the complete documentation index at: https://docs.maia.ai/llms.txt > Use this file to discover all available pages before exploring further. # Full SaaS vs Hybrid SaaS > A comparison of the functional differences between Maia's Full SaaS and Hybrid SaaS deployment models. export const script_runner = "shared script runner"; export const m_runner = "Maia runner"; export const designer = "Designer"; export const maia = "Maia"; {maia} offers two deployment models: Full SaaS and Hybrid SaaS. Both give you access to the same {maia} platform, {designer} interface, and pipeline features—the difference is where the {m_runner} runs and who manages it. * **Full SaaS:** Matillion hosts and manages the {m_runner} for you. There's no infrastructure to set up—every {maia} account includes a Full SaaS {m_runner} from the moment you create your first project. * **Hybrid SaaS:** You deploy and manage the {m_runner} within your own cloud infrastructure (AWS, Azure, Google Cloud, or Snowflake). This gives you more control over networking, scaling, and where your secrets and data are processed. This feature is only available to customers on specific Maia plans. Visit the Maia [Pricing](https://www.maia.ai/pricing) page to learn more. You choose a deployment model per project, and a project can't switch between models later—read [Migrating from Full SaaS to Hybrid SaaS](/docs/guides/runner-overview#migrating-from-full-saas-to-hybrid-saas) if you need to move a project. For a deeper look at how each model fits together, read [Maia product architecture](/docs/guides/architecture-overview) and [Deployment options](/docs/security/deployment-options). The rest of this page lists the specific functional differences between the two models. *** ## Runner deployment and management | Feature | Full SaaS | Hybrid SaaS | | ----------------------------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Runner hosting | Provisioned automatically at project creation; can't be manually added or removed. | You deploy and manage your own {m_runner} in [AWS, Azure, Google Cloud, or Snowflake](/docs/guides/create-a-runner). | | Runner management actions | Not available—Matillion manages the {m_runner} for you. | Pause, restart, remove, and test connectivity from the [Runners page](/docs/guides/manage-runners). | | Version track | Always on the Current track and updates automatically. | Choose between the [Current or Stable](/docs/guides/runner-updates) track, with optional automatic updates. | | Scaling | Automatic; no manual scaling required. | Kubernetes-hosted {m_runner}s (EKS, AKS, GKE) support autoscaling via Kubernetes HPA. Manual scaling is required for ECS Fargate and Azure Container Apps deployments. Read [Scaling best practices](/docs/guides/scaling-best-practices). | | Dedicated {script_runner} (for Script Pushdown) | Not available. | [Available](/docs/guides/shared-script-runner), with a maximum of one per {m_runner} instance. | | Access runner logs | You can't access {m_runner} logs, but Matillion can access them for support purposes. | You can access {m_runner} logs, and can choose to send them to Matillion for support purposes. Read [Export logs](/docs/guides/export-logs-hybrid-saas). | *** ## Secrets and credentials | Feature | Full SaaS | Hybrid SaaS | | -------------------------- | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | Secret storage | Stored in Matillion's hosted vault, on Matillion's own AWS infrastructure. | Stored in your own [AWS Secrets Manager, Azure Key Vault, or Google Cloud Secret Manager](/docs/guides/secrets-and-secret-definitions). | | Updating a secret value | Update the value directly in {maia}. | Update the value in your own vault—{maia} only stores a pointer to it. | | Deleting a secret | Also removes the value from Matillion's vault. | Must also be deleted manually from your own vault. | | Cloud provider credentials | Always required, to let Matillion access your cloud resources. | Only required for resources outside the platform hosting your {m_runner}. Read [Cloud credentials](/docs/guides/cloud-credentials). | *** ## Networking and security | Feature | Full SaaS | Hybrid SaaS | | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Custom drivers (JDBC, SAP, NetSuite) | Not available. | [Available](/docs/guides/uploading-external-drivers)—upload drivers to a storage location the {m_runner} can access. | | Custom Python libraries | Not available. | [Available](/docs/guides/installing-python-libraries). | | Proxy server support | Not supported. | [Supported](/docs/guides/customizing-runner-networking-and-connectivity) using the `PROXY_HTTP`, `PROXY_HTTPS`, and `PROXY_EXCLUDES` runner parameters. | | Custom certificates | Not supported. | Supported using the `CUSTOM_CERT_LOCATION` runner parameter. | | Private connectivity | [AWS PrivateLink](/docs/guides/aws-privatelink) connects Matillion's control plane to Snowflake or AWS-hosted sources. | [AWS PrivateLink](/docs/guides/connecting-via-privatelink) connects your own runner to Matillion's control plane, alongside full network isolation for the runner itself. | | SSH tunneling to network-secured databases | [Supported](/docs/security/ssh-tunnelling) via the Database Query and RDS Query components. | Not typically required, as your runner already sits inside your own network. | *** ## Components and connectors | Feature | Full SaaS | Hybrid SaaS | | -------------------------- | ------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- | | Standard connector library | 130+ connectors available. | 130+ connectors available. | | Custom JDBC connectors | Not available. | Available—[JDBC](/docs/components/jdbc) and [JDBC Load](/docs/components/jdbc-load). | | SAP ODP | Not available. | [Available](/docs/components/sap-odp). | | SAP NetWeaver | Not available. | Available—[SAP NetWeaver](/docs/components/sap-netweaver) and [SAP NetWeaver Load](/docs/components/sap-netweaver-load). | | NetSuite SuiteAnalytics | Not available. | Available—[SuiteAnalytics](/docs/components/netsuite-suiteanalytics) and [SuiteAnalytics Load](/docs/components/netsuite-suiteanalytics-load). | | Python Script | Not available. Use [Python Pushdown](/docs/components/python-pushdown) instead (Snowflake only). | [Available](/docs/components/python-script). | | Script Pushdown | Not available. | [Available](/docs/components/script-pushdown); requires a {script_runner}. | *** ## Data residency | Feature | Full SaaS | Hybrid SaaS | | ------- | -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | Region | Fixed to your account region, set when the account is created. | Runner can be hosted in [a region of your choice](/docs/administration/account-regions), independent of your account region. |