Bring-your-own-cloud means exactly that: Chameleon runs entirely inside a GCP project you control, using a public Terraform installer. No keys, no data, and no infrastructure ever leave your cloud — this is the tier security-conscious teams and regulated industries choose.
A public Terraform module and bootstrap script deploy a self-contained Chameleon instance — the Key Vault control plane, the PII ingestor worker, and the console — entirely inside your own GCP project. Nothing runs outside that project.
Once your container images are pulled, the running instance has no runtime dependency on Chameleon's own infrastructure at all. If Chameleon's servers were unreachable tomorrow, your deployment keeps working exactly as it does today.
An AI coding agent can run this for you
If you'd rather not run the installer by hand, the installer repository ships an agent-oriented install guide meant for tools like Claude Code or Codex to follow directly — point your agent at it and it can drive the whole setup.
| Repository | What it is |
|---|---|
| chameleon-installer | The Terraform module and bootstrap script that deploys everything below into your project. |
| chameleon-vault | Key Vault (control plane) source — buildable independently of Chameleon's own registry. |
| chameleon-pii-ingestor | PII ingestor worker (data plane) source. |
| chameleon-console | The customer-facing console UI. |
| chameleon-pii-dbt | The dbt package for PII registry auto-registration, described in the PII registry guide. |
A minimal, one-directional footprint into your project
Setup grants exactly one permission into your project: read-only Artifact Registry access for your project's own Cloud Run service agent, so it can pull the container images. Nothing broader — and Chameleon gets no access to your project in return.
The installer's setup walkthrough covers configuration for either BigQuery or Snowflake as your warehouse target, depending on where your data actually lives.
Does Chameleon retain any access to my project after setup?
No beyond the one read-only Artifact Registry permission needed to pull container images. There's no ongoing access, no support tunnel, and no data path back to Chameleon's own infrastructure.
How long does self-hosted setup actually take?
Signing up is instant, and the generated Terraform variables file is emailed immediately — running the installer against your own project typically takes 10-15 minutes end to end.
What do I need to provide to get started?
Just a GCP project you control, along with its project ID and project number. Everything else — service accounts, IAM bindings, the running services — is created by the installer inside that project.
The alternative: a fully isolated instance Chameleon provisions and runs for you.
What the control plane and data plane actually do, wherever they're deployed.
All available developer documentation.