Azure API Management vs Gravitee

Azure API Management runs its gateway, management plane and developer portal as Microsoft-operated services in the Azure regions you select for a given tier. Your API definitions, policies, subscription keys and analytics live in Microsoft's control plane, so the question of where data sits is answered by the tier and region you choose, not by your own network design. Administrator access is typically governed through Microsoft Entra ID roles, and audit history comes from Azure activity logs and the service's diagnostics settings.

• Data location: Traffic and configuration are bound to the Azure regions that the chosen tier supports, so confirm which regions your tier can use.
• Identity: Console and portal administration integrates with Entra ID, which suits organizations already standardized on it.
• Audit: Activity logs and diagnostic exports must be configured and retained by your team, and their retention is yours to set.
• Compliance evidence: Microsoft publishes its own compliance documentation for the service, but your assessor will want evidence of your configuration and access reviews.
• Operations: Platform patching and availability sit with Microsoft, while policy, network and key decisions remain yours.

Ask Microsoft and your account team to confirm the data residency statement, log retention and the regions available for your specific tier before you rely on this model for a regulated workload.

The self-hosted gateway is a containerized gateway component that you run in your own Kubernetes or Docker environment while the management plane stays in Azure. Requests are processed locally, so payloads do not have to transit Microsoft's gateway, but the gateway still reports to and receives configuration from the Azure-hosted service. Azure documents this option for specific tiers, so confirm that your tier supports it before planning around it.

• Data location: Request traffic is processed in your environment, but configuration, telemetry and management metadata still flow to Azure.
• Identity: Administrators continue to authenticate through Entra ID in the Azure portal, and gateway tokens must be rotated as part of routine operations.
• Audit: Gateway logs stay in your cluster unless you forward them, so your logging pipeline becomes part of the audit design.
• Compliance evidence: Your assessor will need evidence for both the local gateway and the Azure-side control plane, which doubles the scope to document.
• Connectivity: The gateway needs outbound connectivity to Azure, so a sovereignty or air-gapped requirement may rule this option out.

Confirm the outbound endpoints, the connectivity requirement and the tier eligibility in Microsoft's current documentation, since they determine whether this model meets your data handling rules.

Gravitee Cloud is a SaaS option hosted on AWS, Azure or Google Cloud, which lets you choose the hyperscaler that matches your existing contracts and region strategy. The control plane and gateway are operated by Gravitee, so your team gains operational simplicity but gives up direct control over where the management backend runs. This option is relevant when residency needs are met by a chosen cloud region and your contracts allow a third-party operated platform.

• Data location: Choose the hosting cloud and region offered, then confirm where logs, analytics and backups are stored.
• Identity: Confirm which identity federation Gravitee supports for administrators and how it maps to your existing directory.
• Audit: Request the audit trail and log export options, since some audit features are part of the Enterprise Edition.
• Compliance evidence: Ask for the provider's own assurance documentation and define which controls remain your responsibility.
• Commercial terms: SaaS usage is governed by the subscription, so review data processing terms and exit provisions.

Ask Gravitee to put the hosting region, subprocessors, log retention and export formats in writing before choosing this model.

Gravitee documents a hybrid deployment for Enterprise customers, in which gateways run in your environment while the management layer is provided through Gravitee. Hybrid is a middle path: API traffic and sensitive payloads can stay local, while administration and some metadata sit with the vendor. Because this model depends on a commercial license, its scope and support terms should be confirmed against the current Enterprise Edition documentation.

• Data location: Gateways process traffic inside your network, which matters for payloads containing personal or financial data.
• Identity: Confirm how gateway and console access is federated and who holds administrator rights.
• Audit: Decide which gateway and management events are forwarded to your SIEM and who owns retention.
• Compliance evidence: Split the evidence into the parts you run and the parts the vendor operates, and document the boundary.
• Licensing: The Enterprise license is required for this deployment mode, so include it in the cost comparison.

Confirm the exact data flows between your gateways and the management layer with Gravitee before drawing your architecture boundary.

In a fully self-hosted deployment, the gateway, management API, Console UI, Portal UI and their data stores run in your infrastructure. The Gravitee repository lists a Helm chart for Kubernetes, which covers AKS, GKE, EKS and OpenShift, and a Docker Compose option that uses MongoDB. This model keeps every API payload, credential store, audit record and developer account inside your boundary, which is the strongest position for sovereignty or air-gapped needs, at the cost of running the platform yourself.

• Data location: Everything, including the MongoDB or other data stores, stays in the environments you control, including disconnected networks.
• Identity: Connect the Console and Portal to your directory through the supported federation options and manage the admin accounts yourself.
• Audit: Forward gateway and management logs to your own SIEM, and set retention to match your policy.
• Compliance evidence: You own the full control set, from backups and patching to access reviews, so the evidence trail is entirely yours to produce.
• Operations: Your team or a partner such as DeployOpen handles upgrades, backups and hardening, and Community features are self-run.

DeployOpen can prepare the controls, configuration baselines and evidence for your assessment, but independent auditors and certification bodies issue any audit report or attestation. Confirm with Gravitee which features you need from the Enterprise Edition for this model.