The standard model for on-premise is an annually licensed managed service. We deploy, manage and monitor the platform on the customer's resources (usually AWS account).
Great questions on credential management and transformations. These are not in the offering today, but they are on our near-term roadmap and we are very excited about their potential. As you've alluded to, there's a lot we can do there.