One instance. Yours.
Each client organisation gets its own installation, its own database, its own object storage. Not a tenant in a shared platform with your data separated by a column. Run it on our infrastructure or on yours — the same four images, upgraded at one version, with the operational commands built into the image that runs the service.