CVAT on AWS, Azure, Google Cloud and Oracle OCI: The 2026 Solution Architect’s Guide to Computer Vision Data Labeling

By Shrenik Parekh · Updated October 27, 2026 · 11 min read

TL;DR for solution architects

CVAT (Computer Vision Annotation Tool) is an MIT-licensed annotation platform for images, video, 3D point clouds and audio. It is available as a free self-hosted Community edition, a hosted CVAT Online service, and a self-hosted CVAT Enterprise edition. With AWS having closed SageMaker Ground Truth to new customers and Microsoft having retired Azure ML data labeling on September 30, 2026, CVAT is a strong cloud-neutral option for vision-heavy workloads.

What you get in this guide:

Editions and price compared, with caveats on what I could and could not verify.
A Kubernetes reference architecture that maps to EKS, AKS, GKE and OKE, including the database, cache, shared storage and analytics components CVAT needs.
Security, global availability, observability, auditability and governance patterns that work on any of the four clouds.
A decision table for choosing between Community, Online and Enterprise.

If your data is mostly text or multimodal rather than vision, read my companion post on Label Studio for multi-cloud architects, and for the bigger market picture see my multi-cloud data labeling guide.

1. What CVAT is good at

Computer vision first: bounding boxes, polygons, masks, keypoints, tracks across video frames, and 3D point-cloud cuboids. CVAT itself describes data types as images, video, 3D and audio.
Automation: AI-assisted and auto-annotation, using serverless functions through Nuclio when enabled in the Helm chart.
Quality tooling: CVAT Online lists manual review, Ground Truth and Honeypot quality checks, API access and export, per EveryDev’s summary.
Storage-native: CVAT can attach AWS S3, Azure Blob Storage and Google Cloud Storage for importing and exporting datasets.

CVAT’s own comparison with Azure ML Data Labeling is vendor material, so read it as one perspective.

2. Editions and pricing

Edition	Hosting	Price	Best for
Community	You self-host	Free, MIT license	Teams with Kubernetes or Docker skills and data-sovereignty needs
CVAT Online	Managed by CVAT.ai at app.cvat.ai	Free tier; Solo from about $23/month; Team priced per seat (third-party figures)	Individuals and small teams that want no infrastructure
Enterprise	Self-hosted in your VPC, on-premises or air-gapped	Custom quote; one third-party review puts it at roughly $12,000 per year and up	Regulated teams that need SSO, RBAC, audit logs and support
Labeling services	Run by CVAT.ai’s team	Project-based quote	Teams without in-house annotators

Sources: EveryDev, Toolradar, and the CVAT sales page for official quotes.

Price caution: I could not retrieve CVAT’s own price table, so the Online and Enterprise numbers above come from third parties. Request a written quote before budgeting.

Your real cost on self-hosted CVAT is the infrastructure plus people:

Kubernetes nodes and the managed control plane
Managed PostgreSQL and Redis-compatible cache
Shared (ReadWriteMany) file storage and object storage
Observability and log retention
GPU nodes if you run auto-annotation models
Annotator and reviewer time, usually the largest line item

3. Reference architecture

CVAT is more than a single container. According to the CVAT architecture guide and the Kubernetes Helm documentation, the platform consists of:

Component	Role
Backend server and workers	Django API and background jobs
Frontend	Web UI
PostgreSQL	Structured data: projects, tasks, annotations, users
Redis	In-memory cache and queues
Kvrocks	Redis-compatible on-disk cache for media chunks
Open Policy Agent (OPA)	Authorization decisions
Vector, ClickHouse, Grafana	Event collection, analytics storage and dashboards
Ingress (for example Traefik or NGINX)	Traffic routing
Nuclio (optional)	Serverless functions for auto-annotation
Shared storage with ReadWriteMany access	Required for multi-node deployments

Annotators / reviewers → SSO → WAF + Load balancer + TLS → Ingress
                                                            │
                     CVAT frontend + backend server + workers on Kubernetes
                        │          │           │            │            │
               PostgreSQL     Redis      Kvrocks        OPA     Vector → ClickHouse → Grafana
                        │
        Shared RWX file storage  +  Object storage (datasets, exports)
                        │
        Training pipelines, model registry, data catalog

Component mapping by cloud

Layer	AWS	Azure	Google Cloud	Oracle OCI
Kubernetes	EKS	AKS	GKE	OKE
PostgreSQL (managed)	RDS / Aurora PostgreSQL	Azure Database for PostgreSQL	Cloud SQL / AlloyDB	OCI Database with PostgreSQL
Redis (managed)	ElastiCache	Azure Cache for Redis	Memorystore	OCI Cache
RWX shared file storage	EFS	Azure Files	Filestore	File Storage
Object storage	S3	Blob Storage	Cloud Storage	Object Storage
Keys and secrets	KMS, Secrets Manager	Key Vault	Cloud KMS, Secret Manager	Vault
GPU for auto-annotation	EC2 GPU instance types	NC/ND series VMs	GPU on GKE	GPU shapes on OKE
Monitoring	CloudWatch, Managed Prometheus	Azure Monitor	Cloud Monitoring	Monitoring, Logging
Audit	CloudTrail	Activity Log	Cloud Audit Logs	Audit
Catalog	Glue Data Catalog	Purview	Dataplex	Data Catalog

Confirm product names, GPU availability and regional support in each provider’s documentation before you design.

Using managed databases. The CVAT Helm chart lets you turn off its bundled PostgreSQL and Redis and point to your own. For PostgreSQL, set postgresql.enabled: false and give the external host, port, username, database and a secret; Redis works the same way through redis.enabled: false and an external host, per the Helm guide. Check how Kvrocks and ClickHouse are handled in the chart version you deploy, since those remain separate stateful components.

# values.override.yaml (sketch)
postgresql:
  enabled: false
  external:
    host: <managed-postgres-endpoint>
    port: 5432
  auth:
    username: cvat
    database: cvat
redis:
  enabled: false
  external:
    host: <managed-redis-endpoint>

Note: MySQL is not part of this list. Use a PostgreSQL engine such as Aurora PostgreSQL.

4. Convenience: which path gets you running fastest?

Path	Effort	Use when
CVAT Online	Same day	You want zero infrastructure
Docker Compose on one VM	Under a day	Pilot or small team
Helm on Kubernetes (any cloud)	One to several days	Production, high availability
CVAT Enterprise	Days, with vendor support	Regulated or air-gapped environments

The Helm chart is documented for both the CVAT repository and an OCI chart from Docker Hub, and it supports optional Nuclio for auto-annotation. Plan for ReadWriteMany storage if you run more than one node, and for the Open Policy Agent service name limiting you to one release per namespace in some chart versions.

For related automation patterns, see my post on MLOps pipeline design.

5. Security

Control	Community	CVAT Online	Enterprise
Run inside your own network	Yes	No	Yes, including air-gapped
Authorization engine (OPA)	Included in architecture	Managed	Included
SSO (OIDC, SAML)	Not a documented feature	Verify with CVAT	Yes
Advanced RBAC	Basic roles	Organizations and team roles	Yes
Audit logs	Event analytics through Vector, ClickHouse and Grafana	Verify	Yes, per EveryDev
Dedicated support and SLA	Community	Plan dependent	Yes

As summarized by EveryDev, Enterprise adds SSO (OIDC/SAML), RBAC, audit logs, white labeling and dedicated support, and can run in a VPC, on-premises or air-gapped. Verify exact entitlements against your contract.

Cloud storage credentials need care. CVAT’s cloud storage documentation describes access key pairs for S3, SAS tokens for Azure Blob and service accounts for Google Cloud Storage, and it also mentions anonymous access via public buckets. In production:

Never make dataset buckets public.
Create a dedicated, least-privilege identity per project (read-only on source data, write to an export prefix only).
Rotate keys and SAS tokens, and keep them in your secret manager.
For Google Cloud Storage on self-hosted CVAT, the docs note the GOOGLE_APPLICATION_CREDENTIALS environment variable can supply credentials, which lets you use workload-based identity where your cluster supports it.

Hardening checklist for every cloud:

Private cluster endpoint; public traffic only through a WAF-protected load balancer
TLS everywhere, including database and cache connections
Customer-managed keys for database, file and object storage
Network policies and egress restrictions for annotation pods
SSO with MFA for all human users
PII masking before data reaches annotators
Separate organizations and projects by data sensitivity

6. Global availability and data residency

Self-hosted Community or Enterprise: runs in any region where you can run Kubernetes, PostgreSQL and shared storage. This is your strongest answer to data-residency and GDPR constraints.
CVAT Online: I could not verify the hosting regions. Ask CVAT.ai in writing if residency matters.
Oracle OCI: OCI Object Storage can be reached through CVAT’s S3 provider with a custom endpoint. CVAT documents this pattern for another S3-compatible service (Backblaze B2 example); test the equivalent for OCI in a pilot.
Latency: deploy near annotators; video and 3D data are bandwidth-heavy, so keep media in the same region as the cluster.

7. Applications, databases, observability, auditability and governance

Applications

Expose labeling through CVAT’s API. A typical flow: new images or video land in object storage, a pipeline creates tasks, auto-annotation proposes labels, annotators correct them, and an export publishes a versioned dataset to training. See my guide on designing cloud exit and portability strategies for keeping labels portable.

Databases

PostgreSQL holds annotation data. Use a managed, multi-zone instance with backups and point-in-time recovery, and test restores.
Keep media in object storage; keep CVAT’s shared volume sized for its working data.
Export annotations on a schedule (COCO, YOLO, Pascal VOC and other formats CVAT supports) into your lake so analytics and audits do not depend on the live labeling database.

Observability

CVAT ships an analytics stack (Vector, ClickHouse and Grafana) that you can enable or disable in the Helm values. Add platform telemetry on top:

Platform: pod health, request latency, queue depth, PostgreSQL connections, storage utilization, GPU use
Quality: review rejection rate, Ground Truth accuracy, agreement between annotators
Throughput and cost: tasks per day, cost per accepted annotation

Standardize on OpenTelemetry and link labeling jobs to training runs with OpenLineage. Related reading: observability for data and AI pipelines.

Auditability

Bring three sources together: CVAT’s own event and audit logs (full audit logs are an Enterprise feature), your cloud’s audit trail for storage and identity access, and dataset version lineage tying each model to the annotations it trained on. Write them to immutable storage with a retention period set by policy.

Governance

Align with the NIST AI Risk Management Framework and ISO/IEC 42001:

Classify data and approve it before it enters a project
Review annotator, contractor and admin access quarterly
Version labeling guidelines and attach a dataset card to every release
Define retention and deletion rules for media, annotations and annotator records
Run vendor due diligence if you use external labeling services

8. Quality: verification and validation

Verification (did we follow the process?): schema checks, Ground Truth and Honeypot checks, manual review, annotator agreement, duplicate detection.
Validation (is the dataset fit for purpose?): train and evaluate against an independently labeled, production-like holdout; check class balance, rare-object coverage and lighting, device and geography diversity.

Release a dataset only when both pass, and store the evidence with the dataset card.

9. Which option fits you?

Your situation	Suggested path
Individual or small team, minimal ops	CVAT Online
Vision-heavy, strong Kubernetes team, tight budget	Community on EKS, AKS, GKE or OKE
Regulated, air-gapped or strict audit needs	Enterprise self-hosted
No in-house annotators	CVAT labeling services, with governance controls
Mixed text, audio and LLM evaluation workloads	Evaluate Label Studio alongside CVAT
Migrating from Azure ML data labeling or Ground Truth	Export labels and metadata first, map label schemas, validate with a gold set

Frequently asked questions

Is CVAT free? The Community edition is free and MIT licensed. CVAT Online has a free tier, and Enterprise is quoted.

Does CVAT run on AWS, Azure, Google Cloud and Oracle OCI? Yes, on any Kubernetes or VM environment, with S3, Azure Blob and Google Cloud Storage supported directly. OCI Object Storage is typically reached through its S3-compatible API, which you should test.

Which database does CVAT use? PostgreSQL, plus Redis and Kvrocks for caching. MySQL is not documented as supported.

Can I use CVAT as a replacement for Azure ML data labeling? For image, video and audio annotation, yes. Moving requires exporting labels and rebuilding project settings. Managed workforce services are separate.

Does CVAT have a cloud marketplace listing? I did not find one on AWS, Azure, Google Cloud or Oracle. Confirm with CVAT.ai.

Key takeaways

CVAT is a cloud-neutral, vision-focused labeling platform that fits the shrinking native cloud options.
Design it as a Kubernetes application with managed PostgreSQL, Redis-compatible cache, shared RWX storage and object storage.
Enterprise adds SSO, RBAC and audit logs; confirm entitlements in writing.
Combine CVAT logs, cloud audit trails and dataset lineage for audit readiness.

References and further reading

CVAT.ai, CVAT home, documentation overview and sales.
CVAT docs, Kubernetes deployment with Helm and CVAT architecture.
CVAT docs, Attach cloud storage.
EveryDev, CVAT.ai profile and CVAT tool listing (third-party summaries).
Toolradar, CVAT pricing (third-party).
CVAT, CVAT vs. Azure Machine Learning Data Labeling (vendor comparison).
AWS, Service Availability Updates, June 30, 2026; Microsoft, Azure ML data labeling retirement.
NIST, AI Risk Management Framework; ISO, ISO/IEC 42001.
OpenTelemetry and OpenLineage.

Prices, features and regions change often. Verify with each vendor before purchasing or finalizing an architecture.