Your Customer Cell is the data home
A Customer Cell holds the authoritative copy of your content and controls: shared work, Rooms, memory, secrets, policy, and audit records. Geyser runs managed Cells, while a supported Host or enterprise Cell can keep that custody inside your own environment.
Agent computers also hold working files, browser state, and local working context, and backups, exports, and connected services keep their own copies or handle their own processing. Calling the Cell the “authoritative home” is about custody. Other working copies can still exist.
Agent computers can live somewhere else
Agents do their computing on your own Mac, Windows, or Linux computers running Geyser Host, either in an isolated pod or on the machine itself. Picking a Host to run Agents doesn’t automatically move the Cell there.
Keeping the two apart lets a team decide separately who runs its data home and which computers its Agents use. Moving between supported placements is a planned step, with its own routing and recovery behavior.
Compare deploymentsThe path is part of the boundary
Direct connections over your private network are limited to your workspace and encrypted end to end between authenticated peers. Managed deployments and other supported placements connect out through authenticated, encrypted tunnels.
Those paths have different endpoints and different custody. Model requests, speech, and calls to connected apps each follow their configured processing route. A shared provider bridge you’ve explicitly approved can process content in transit, and an admin view that shows no content doesn’t take that processing path away.
Running the service is kept apart from your work
Geyser Global holds the operational information needed for identity, directory, billing, routing, releases, health, and Cell assignments. The Cell stays the authoritative home for your content, and if the route to a Cell is lost, Global doesn’t silently become its new data home.
When support needs to see your content, it takes a named, scoped grant that expires, approved by the customer owner and logged in the audit trail. That access is tied to a purpose and a customer boundary.
A stricter setup for a tighter boundary
Private Cell Strict applies default-deny egress and uses inference routes the customer controls. It turns off the shared content relay, the shared provider bridge, and content federation, while keeping a limited set of central operational functions.
The configuration is checked against its supported deployment requirements, and running strict-private also limits external meeting and app connections. It describes how Geyser is deployed. It isn’t a claim of independent compliance certification.
Discuss a private deployment