Mode A — Claresia Cloud Shared SaaS

Mode A is the default for customers under 200 seats with no residency requirement. Time-to-go-live: <24 hours from contract signature.

When to choose Mode A

• ≤ 200 seats
• No regulatory requirement for data residency
• Comfortable with SaaS data plane
• Want the fastest possible onboarding (1 sitting, ~30–60 min self-serve)
• Lowest pricing tier

Topology

Customer's LLM (Claude/Copilot/ChatGPT) ←──── Distribution Plane ←─── Skill IR
                ↓                                  (Claresia Cloud)
        Skill invocation                                    ↑
                ↓                                            │
        LLM platform audit log ──── Telemetry Pull Connector┘
                                          (Claresia Cloud)
                                                    ↓
                                          fn_telemetry_event
                                                    ↓
                                          Command Center UI
                                                    ↑
                                            IT Admin browser
                                                    ↑
                                          WorkOS SSO redirect

        Skill output payload ──────── Hub (shared Postgres + RLS)
                                          (Claresia Cloud, eu-south-1)
                                                    ↑
                                              Hub Browser
                                                    ↑
                                          IT Admin / End User browser

Customer data location

• Region: eu-south-1 (default). EU-region is Mode B territory — if you need EU residency, pick Mode B.
• Storage: shared AWS RDS Aurora PostgreSQL cluster, RLS-isolated to your tenant_id. AES-256 at rest. KMS key rotated by Claresia annually (or on demand on a per-tenant basis).
• Encryption in transit: TLS 1.3 minimum. mTLS not exposed in Mode A.

Customer-side install

Zero. No agents, no sidecars, no Terraform. The IT admin pastes:

1. SAML metadata or OIDC discovery URL (or uploads SAML XML)
2. SCIM bearer token (we generate + display in the portal)
3. One of the following:
   • Anthropic Admin API key (for Claude Enterprise)
   • Azure AD service principal (for Microsoft Copilot M365)
   • OpenAI Compliance API key (for ChatGPT Enterprise)
   • Google Workspace OAuth grant (for Gemini)

That’s the entire customer-side action.

Time-to-go-live

Step	Wall-clock
Contract signature → magic link email	<5 min
IT Admin opens portal	depends on customer
10 portal steps end-to-end	30–60 min
Pilot publish + smoke test	5 min
Total	<24 hours including human latency

For a real-world Mode A onboarding, see the Quickstart.

Pricing

Pricing follows the cc-033 v2 model:

• Claude Enterprise license: $60/seat/month (passed through)
• Claresia Platform Fee: 20% of license (under 75 seats), 15% (75–499), 10% (500+) — minimum $12k/year
• Professional Services: variable, one-time
• SaaS Marketplace: referral commissions only (Claresia revenue, no customer line item)

Mode A has no additional surcharges.

SLA

Tier	Target
Uptime	99.5%
Sev 1 (down) response	30 min
Sev 2 (degraded) response	4 h
Sev 3 (cosmetic) response	1 business day

Where Mode A is not the right answer

• You have a CISO mandate that forbids shared Postgres → Mode B
• You need EU-only residency → Mode B (eu-central-1)
• You operate in a regulated industry (pharma, finance, defense, public sector) → Mode C
• You want to bring your own KMS-managed encryption keys → Mode B or Mode C

Upgrading from Mode A → Mode B

Possible at any time. Migration runs in the background — Hub records are copied from shared Postgres to your dedicated Postgres, RLS row is removed from shared, DNS for hub.{tenant_slug}.claresia.com cuts over. Typical wall-clock: 3 days. No downtime for end users (Distribution Plane and LLM stay live throughout).

Talk to your CSM in your #claresia-{tenant} Slack/Teams Connect channel to schedule the migration.

What you give up vs Mode B

• No CMEK (you can’t rotate the encryption key on your schedule)
• No dedicated cluster (shared Aurora, RLS-isolated)
• No regional residency
• Online click-through DPA (no signed/redlined version)
• Telemetry payloads in Claresia Cloud (still per-tenant isolated, but not in customer cloud)

For most customers under 200 seats, none of these are blocking.