Overview
PlanetScale Managed on Microsoft Azure runs the PlanetScale data plane in a dedicated Azure subscription that you own and PlanetScale operates. You continue to use the PlanetScale dashboard, API, and CLI while your database infrastructure and data remain in your Azure environment.Architecture
PlanetScale deploys the data plane to a dedicated subscription in your Microsoft Entra tenant. The database runs on Azure Kubernetes Service (AKS), distributed across three availability zones in regions that support them. The subscription also contains the networking, managed identities, Azure Key Vaults, Azure Container Registry, storage accounts, and other resources required to operate the deployment. Backups are encrypted and stored in Azure Blob Storage in the same subscription. PlanetScale’s control plane runs outside your Azure subscription. It provides the PlanetScale dashboard, API, automation, and operational workflows used to manage your databases. PlanetScale receives access only to the dedicated subscription. It does not receive administrative access to your Microsoft Entra tenant or other Azure subscriptions.Subscription ownership and management
The subscription must be dedicated to PlanetScale Managed and must not contain existing workloads. You retain ownership of the subscription, Microsoft Entra tenant, and Azure billing relationship. PlanetScale manages all resources inside the subscription after the initial bootstrap. Do not modify, remove, or manage those resources with your own infrastructure-as-code tooling. Contact support to discuss configuration changes or customization. The one-time Azure bootstrap creates customer-owned managed identities for PlanetScale automation and support. The bootstrap uses federated credentials rather than client secrets.Security and compliance
The dedicated subscription is the security and operational boundary for the deployment. PlanetScale automation receives the subscription-scoped permissions required to provision and operate the data plane. PlanetScale does not require tenant-wide Microsoft Entra administrator roles. PlanetScale Managed is designed for organizations with additional security, compliance, and isolation requirements. PlanetScale maintains security and compliance programs including SOC 2 Type 2 and PCI DSS 4.0 Level 1 Service Provider compliance.If you have questions about the security or compliance of PlanetScale Managed on Azure, contact your PlanetScale Solutions Engineer.