SaaS
Doram runs in its cloud, and an agent inside your network reaches your sources.
In SaaS, the control plane runs in Doram's cloud. A small agent runs inside your network, reaches your sources with read-only access, and connects out to Doram. You don't open any inbound port.
Only the graph is stored outside your company: definitions, relationships, profiles and evidence. Query results go to the person who asked and aren't stored in the graph.
Your workspace is created in the region you pick, and its data stays there.