Silo + BYOC by default
Your data and code stay in your cloud.
Every tenant runs in a dedicated GCP project — optionally in your own GCP organisation. No shared database, no shared application process, no shared secrets vault. LP operational due-diligence questions about residency and isolation answer themselves.