Application traffic
Coworkers reach published apps through Google Identity-Aware Proxy. After access is granted, traffic goes to the application's Cloud Run service in the customer project.
Customer-cloud architecture
Your applications run in your Google Cloud.
Garden's current design-partner pilot is a managed customer-cloud installation. Garden supplies and upgrades the platform; the customer's Google Cloud project holds the application runtime, source, images, data, secrets, logs, and infrastructure state.
Scope: design-partner pilotCloud: Google CloudUpdated: August 4, 2026
The operating boundary
The platform control plane, worker, read console, employee workbenches, and published internal applications run in the customer's project. Product source and release builds remain in a Garden-controlled distribution project. A reviewed release manifest pins the platform image, workbench image, Garden revision, and version used for an installation.
CoworkerGoogle identity
→
Google IAPAccess boundary
→
App on Cloud RunCustomer project
→
Company resourcesDirect app calls
Important boundary
Garden manages the credential plane, not the application's data plane. An application calls its database and external services directly using ordinary SDKs. Garden does not broker each application request or inspect each external API call.
Who controls each resource
This table describes the first-partner installation contract. It is more precise than saying only that the customer “owns the cloud.”
| Resource | Location and control | What that means |
|---|---|---|
| Application source | Customer project; Git-backed | Every change is a commit, and a release refers to an exact source revision. |
| Application images and runtime | Customer Artifact Registry and Cloud Run | The customer project contains the artifacts and services that run employee applications. |
| Application data | Customer Cloud SQL or another explicitly attached customer resource | Application records do not move into a Garden vendor database merely because Garden operates the release workflow. |
| Secrets and connections | Customer Secret Manager and customer project IAM | Release records carry version-pinned secret references, not secret values. |
| Logs and audit events | Customer project | The customer keeps the application and platform operating record in its environment. |
| Infrastructure state | Customer-controlled, versioned Terraform state | The installed boundary can be inspected and upgraded through auditable operator tooling. |
| Garden platform source and release builds | Garden distribution project | The managed pilot does not transfer Garden's platform source repository to the customer. |
Data and credential paths
Company connections
A workspace connection stores a company-owned credential or resource grant. Binding it to an app controls which runtime environment receives that connection.
Secret handling
Secrets stay out of Git. Secret Manager holds values; the immutable release snapshot records only the versioned references needed to reproduce the runtime configuration.
Garden access
The first-partner contract gives Garden no standing access after installation. Explicit support access, if needed, must be separately granted and removed by the customer.
What this page does not claim
Current limits
- The design-partner pilot supports Google Cloud; it is not a general multi-cloud offering.
- Customer-cloud placement is not, by itself, a compliance certification or proof of secure configuration.
- The pilot does not provide general team RBAC, approval workflows, or promotion stages beyond draft to live.
- A determined customer project administrator can inspect the compiled software that runs in the project. This is not an intellectual-property security boundary.
- Portability still requires the customer to understand application dependencies, data formats, and the procedure for operating without Garden.
Inspect the other operating boundaries
This page documents the current pilot design, not a contractual security or compliance guarantee. Garden is working with design partners. Send product questions or corrections to hello@gardenai.ai.