Security
Dynamiq now deployable on IBM Cloud: simplify, scale and secure your AI projects
Dynamiq runs self-hosted on IBM Cloud Kubernetes Service or Red Hat OpenShift, so agents, knowledge bases and traces stay in an IBM Cloud account you control.
Vitalii DukFounder and CEO4 min readUpdated 
In short
Dynamiq can be self-hosted on IBM Cloud, so agents, workflows, knowledge bases and traces run in an account your organization controls. It installs with a Helm chart on IBM Cloud Kubernetes Service or Red Hat OpenShift, backed by IBM Cloud Databases for PostgreSQL and Cloud Object Storage, and works with IBM watsonx models such as Granite alongside other providers.
Yes, Dynamiq can be self-hosted on IBM Cloud. You install it with a Helm chart on IBM Cloud Kubernetes Service, or on Red Hat OpenShift on IBM Cloud, backed by IBM Cloud Databases for PostgreSQL and IBM Cloud Object Storage. Agents, workflows, knowledge bases and traces then stay in an IBM Cloud account and region your organization controls, which suits banks, insurers, healthcare providers and public agencies with data residency rules.
We first announced IBM Cloud support in October 2024. This post covers what the deployment looks like today.
Why run Dynamiq on IBM Cloud?
Three reasons come up most often:
- Data residency and control. You choose the IBM Cloud region and own the account, the network and the keys. Customer data, documents and run history stay there.
- Proximity to IBM watsonx. Agents can use IBM watsonx models, including the Granite family, and watsonx embedding models, alongside models from other providers.
- Existing IBM relationships. Organizations that already run on IBM Cloud or OpenShift can add an agent platform without a new cloud vendor, and Dynamiq is available through IBM's marketplace.
Dynamiq is an IBM AI Technology Partner; the IBM partnership page covers the models, data services and agent catalog work in more detail.
What runs in your IBM Cloud account?
The Helm chart deploys the Dynamiq services into your cluster: the web application and its API, deployed Apps, model inference endpoints, knowledge bases, managed databases and service deployments. You provide the supporting services, which on IBM Cloud map to managed offerings:
| Dynamiq needs | On IBM Cloud |
|---|---|
| Kubernetes 1.32+ | IBM Cloud Kubernetes Service on VPC, or Red Hat OpenShift on IBM Cloud |
| PostgreSQL 16+ (three logical databases) | IBM Cloud Databases for PostgreSQL |
| S3-compatible object storage | IBM Cloud Object Storage, through its S3-compatible endpoint |
| NATS with JetStream | Installed in the cluster from the upstream NATS chart |
| DNS and wildcard TLS | IBM Cloud Internet Services or your DNS provider, with cert-manager |
Model calls go to the providers you configure, such as IBM watsonx or models you serve yourself. If your environment must make no outbound calls at all, fully isolated and air-gapped setups are delivered with our engineers; see where Dynamiq runs.
How does the installation work?
The installation follows the same Helm flow as any Kubernetes cluster, with IBM Cloud specifics for storage and ingress:
- Create the cluster: an IBM Cloud Kubernetes Service cluster on VPC running Kubernetes 1.32 or newer, or a managed OpenShift cluster.
- Provision PostgreSQL: an IBM Cloud Databases for PostgreSQL deployment at version 16 with three logical databases, using TLS for every connection.
- Create object storage: a Cloud Object Storage bucket with HMAC credentials, reached through its regional S3-compatible endpoint.
- Run NATS with JetStream in the cluster.
- Set up DNS and certificates for the platform's hostnames, with wildcard TLS issued through a DNS-01 challenge.
- Install the Helm chart and run the database migrations.
The IBM Cloud installation guide walks through every step.
What can you build once it is running?
Once the platform is running, teams can:
- Build agents on a visual canvas or in Python with the open-source SDK, on one engine; see Agent Builder.
- Ground them in your documents with knowledge bases that apply permission-aware retrieval; see Knowledge.
- Govern what they do with guardrails that detect PII and prompt injection and approvals that pause any tool step for a person; see guardrails and approvals.
- Measure quality with evaluations, including real-time evals on live deployments; see Evals.
- See every run as a trace with cost and latency; see observability.
- Run and fine-tune open models with managed inference and LoRA adapters; see models.
Common first projects include customer service agents, research and knowledge assistants, and back-office automation.
Who is this deployment for?
Self-hosting on IBM Cloud fits organizations that must show a regulator or an auditor where their data lives and who can reach it. That includes financial services, healthcare and the public sector.
Dynamiq has SOC 2, HIPAA and GDPR in place, and SSO is available on the Enterprise plan. For teams that want help, our engineers deploy the platform and the first agents with you and then hand over; see how we deploy.
FAQ
Can Dynamiq run on IBM Cloud?
Yes. Dynamiq can be self-hosted on IBM Cloud Kubernetes Service or on Red Hat OpenShift on IBM Cloud, using IBM Cloud Databases for PostgreSQL and IBM Cloud Object Storage for its data.
Does Dynamiq support Red Hat OpenShift?
Yes. Dynamiq installs on Red Hat OpenShift, including managed OpenShift on IBM Cloud, with OpenShift-specific settings for routes and security contexts.
What infrastructure does a self-hosted install need?
Kubernetes 1.32+, a PostgreSQL 16+ server with three logical databases, S3-compatible object storage, NATS with JetStream, and DNS with wildcard TLS certificates for the platform's hostnames.
Can we use IBM watsonx models with Dynamiq?
Yes. Dynamiq agents can call IBM watsonx models, including the Granite family, and use watsonx embedding models, next to models from other providers in the same workflow.
Can Dynamiq run fully isolated or air-gapped?
Fully isolated and air-gapped environments are delivered with our engineers, who plan the setup with your infrastructure and security teams.
