The infrastructure owner

The Azure subscription, the cluster, the Key Vault, the database, DNS, and every byte of data. Decides who may sign in, who administers, when updates land.

The platform provider

Builds the portal image, publishes the plugins, serves the registry, keeps the chart and the runbooks. Sees no customer data and holds no customer credential.

What crosses

Signed images and plugin bundles, pulled by the instance with a token the owner holds. Nothing is pushed into the owner's cloud from outside.