docs(sensei): DefectDojo Cloud instances can bring their own AI model

docs/content/get_started/about/defectdojo_versions.md

@@ -97,7 +97,7 @@ Each table below covers one part of a vulnerability management program. **The va
 | Configuration advice | ❌ Not included | ✅ [Sensei Advisor](/sensei/sensei_advisor/) suggests changes to your deduplication and prioritization settings and shows how each would affect your own findings. Nothing changes until someone applies it, and applied changes can be undone (Sensei license) | Tuning is based on what your own data shows, not guesswork, and it is safe to try. |
 | AI inventory | ❌ Not included | ✅ **AI Inventory** lists the AI coding assistants, MCP servers, models and AI packages found in your code repositories. **AI Governance Policies** create a finding whenever an unapproved one turns up | You can see, and govern, the AI your developers are actually using. |
 
-Sensei is never trained on your data, and DefectDojo's AI provider does not train on it either. On DefectDojo Cloud, Sensei is an AI agent built by DefectDojo. It runs inside your dedicated DefectDojo instance and reaches its models within DefectDojo's Google Cloud environment, using credentials unique to your instance, and your data is never mixed with another customer's. On self-hosted Pro, Sensei is the agent harness and you bring the model: connect the provider you already use (Anthropic, OpenAI, Amazon Bedrock or Google Vertex AI) under [AI Model Settings](/sensei/ai_model_settings/), and model traffic goes directly from your instance to your own provider account.
+Sensei is never trained on your data, and DefectDojo's AI provider does not train on it either. On DefectDojo Cloud, Sensei is an AI agent built by DefectDojo. It runs inside your dedicated DefectDojo instance and reaches its models within DefectDojo's Google Cloud environment, using credentials unique to your instance, and your data is never mixed with another customer's. On self-hosted Pro, Sensei is the agent harness and you bring the model: connect the provider you already use (Anthropic, OpenAI, Amazon Bedrock or Google Vertex AI) under [AI Model Settings](/sensei/ai_model_settings/), and model traffic goes directly from your instance to your own provider account. Cloud customers who want the same can [bring their own model](/sensei/ai_model_settings/#bring-your-own-model-on-defectdojo-cloud) as an enterprise option: contact [hello@defectdojo.com](mailto:hello@defectdojo.com).
 
 ### Compliance and product security
 

docs/content/get_started/about/faq.md

@@ -38,7 +38,7 @@ In Pro, check these in order:
 1. **Feature Flags.** Many capabilities are switched on by an administrator under [Feature Flags](/admin/feature_flags/pro__feature_flags/).
 2. **License.** Sensei and PSIRT need an add-on license.
 3. **Permissions.** The sidebar only shows the pages your role can open.
-4. **Deployment.** A few settings exist only on self-hosted instances (for example AI Model Settings and Version Manager) or only on DefectDojo Cloud (for example Firewall Rules).
+4. **Deployment.** A few settings exist only on self-hosted instances (for example Version Manager, and AI Model Settings unless your Cloud instance brings its own model) or only on DefectDojo Cloud (for example Firewall Rules).
 
 In Open-Source, check that the page describes Open-Source: the edition switch at the top of the navigation shows the pages for the edition you choose.
 
@@ -275,6 +275,8 @@ Sensei is never trained on your data. DefectDojo uses your data only to complete
 
 Model traffic goes directly from your instance to your own provider account and never passes through DefectDojo. Your provider's data terms apply to those requests.
 
+**On DefectDojo Cloud, you can also bring your own model.** This is an enterprise option: DefectDojo turns on [AI Model Settings](/sensei/ai_model_settings/#bring-your-own-model-on-defectdojo-cloud) for your instance, and Sensei then runs only on the provider account you connect there. To request it, contact [hello@defectdojo.com](mailto:hello@defectdojo.com).
+
 If you connect an AI assistant through the [MCP server](/metrics_reports/ai/mcp_server_pro/), the data it reads goes to that assistant, under that assistant's terms.
 
 ### Does Sensei change my code without approval?

docs/content/navigation/PRO__sidebar.md

@@ -98,7 +98,7 @@ The AI capabilities sit together in their own section rather than being spread t
 
 **AI Proposals** lists the verdicts the Triage Engine's AI steps have left for a person to confirm. It appears only when your license includes Sensei.
 
-**MCP** is shown to superusers, and to everyone once the MCP server is enabled. **AI Model Settings** appears only on on-premise instances, because DefectDojo manages the model credentials on Cloud.
+**MCP** is shown to superusers, and to everyone once the MCP server is enabled. **AI Model Settings** appears on on-premise instances. On Cloud, DefectDojo manages the model credentials, so it appears only on an instance that [brings its own model](/sensei/ai_model_settings/#bring-your-own-model-on-defectdojo-cloud).
 
 ## Act
 

docs/content/sensei/ai_model_settings.md

@@ -20,9 +20,36 @@ hardening suggestions and runtime checks. Every provider below works for all of
 You reach it from the sidebar under **Sensei + AI > AI Model Settings**. You need a global
 **Maintainer** or **Owner** role to change it.
 
-> **On-premise only.** This page exists only on **on-premise** ("local") deployments, where you
-> bring your own model. On DefectDojo **Cloud** the LLM is managed for you and this page is not
-> shown.
+> **Where this page appears.** Every **on-premise** ("local") deployment has this page, because
+> there you always bring your own model. On DefectDojo **Cloud**, DefectDojo manages the model by
+> default and the page is not shown. Cloud customers can also bring their own model: see
+> [Bring your own model on DefectDojo Cloud](#bring-your-own-model-on-defectdojo-cloud).
+
+## Bring your own model on DefectDojo Cloud
+
+A DefectDojo Cloud instance can run Sensei, and the in-app AI features listed above, on your own
+model provider account instead of the model DefectDojo provides. This is an enterprise option
+that DefectDojo turns on for your instance. To request it, contact
+[hello@defectdojo.com](mailto:hello@defectdojo.com).
+
+Once it is on, **AI Model Settings** appears in the sidebar and works as described on this page,
+with these differences:
+
+- **Your instance uses only your model.** It never falls back to the model DefectDojo provides.
+  Until you save a working configuration, Sensei scans and fixes, and the other AI features, are
+  refused with a message that points you to this page.
+- **Credentials are required.** A Cloud instance has no ambient cloud identity of yours to fall
+  back on, so every provider needs its own secret: an API key for Claude or OpenAI, an **AWS
+  Access Key ID** and **Secret Access Key** for Amazon Bedrock, or a **Service Account Key
+  (JSON)** for Google Vertex AI. The "leave the keys blank" setups described below for Bedrock and
+  Vertex apply only on-premise.
+- **The API Base URL must be a public address.** A base URL that points at a private network
+  address, loopback or a cloud metadata service is refused when you save or test it, and again
+  every time the model is called. A custom Amazon Bedrock endpoint is not available on Cloud:
+  leave Bedrock's **API Base URL** blank.
+
+Model traffic goes from your DefectDojo Cloud instance to your own provider account, and your
+provider's data terms apply to those requests.
 
 ## Providers