diff --git a/terraform/ecs.tf b/terraform/ecs.tf
index d6e3d6f..79ecbef 100644
--- a/terraform/ecs.tf
+++ b/terraform/ecs.tf
@@ -1,11 +1,11 @@
 # ---------------------------------------------------------------------------
-# Hosting for the two long-running containers: Fusion (the gateway) and the
-# Presidio detector. Kept intentionally simple for a demo: default VPC, public
-# subnets, Fargate. For a first pass you can also run both containers locally
-# and skip this file entirely (see README "Lightweight path").
+# Hosting for the Presidio detector only. Fusion is a shared SaaS instance and is
+# NOT deployed here. Because Fusion SaaS calls the detector over the internet, the
+# analyzer port is public in this demo (lock it down / add auth for anything real;
+# better: fold detection behind the /tokenize endpoint so only that is public --
+# see CLAUDE.md task T3).
 #
-# NOTE: var.fusion_image_uri and var.presidio_image_uri must be set first
-# (scripts/deploy.sh builds+pushes Presidio; you supply the Axway image).
+# For a laptop-only rehearsal you can skip this file and run Presidio via docker.
 # ---------------------------------------------------------------------------
 
 data "aws_vpc" "default" { default = true }
@@ -27,18 +27,11 @@ resource "aws_security_group" "svc" {
   description = "Demo services SG"
   vpc_id      = data.aws_vpc.default.id
   ingress {
-    description = "Fusion gateway"
-    from_port   = 8080
-    to_port     = 8080
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"] # DEMO ONLY - lock down for anything real
-  }
-  ingress {
-    description = "Presidio analyzer"
+    description = "Presidio analyzer (public for SaaS Fusion demo - restrict for real use)"
     from_port   = 5001
     to_port     = 5001
     protocol    = "tcp"
-    self        = true
+    cidr_blocks = ["0.0.0.0/0"]
   }
   egress {
     from_port   = 0
@@ -66,61 +59,26 @@ resource "aws_iam_role_policy_attachment" "ecs_exec" {
   policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
 }
 
-# Task role for Fusion: it needs to invoke Bedrock/AgentCore and read/write the vault.
-resource "aws_iam_role" "fusion_task" {
-  name = "${local.name}-fusion-task"
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect    = "Allow"
-      Principal = { Service = "ecs-tasks.amazonaws.com" }
-      Action    = "sts:AssumeRole"
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "fusion_task" {
-  name = "${local.name}-fusion-task-policy"
-  role = aws_iam_role.fusion_task.id
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      { Effect = "Allow", Action = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query"], Resource = [aws_dynamodb_table.vault.arn] },
-      { Effect = "Allow", Action = ["bedrock:InvokeModel", "bedrock-agentcore:*"], Resource = "*" }
-    ]
-  })
-}
-
-locals {
-  services = {
-    fusion   = { image = var.fusion_image_uri, port = 8080, task_role = aws_iam_role.fusion_task.arn, tag = local.onprem_tag }
-    presidio = { image = var.presidio_image_uri, port = 5001, task_role = aws_iam_role.ecs_exec.arn, tag = local.onprem_tag }
-  }
-}
-
-resource "aws_ecs_task_definition" "svc" {
-  for_each                 = local.services
-  family                   = "${local.name}-${each.key}"
+resource "aws_ecs_task_definition" "presidio" {
+  family                   = "${local.name}-presidio"
   requires_compatibilities = ["FARGATE"]
   network_mode             = "awsvpc"
   cpu                      = 512
   memory                   = 1024
   execution_role_arn       = aws_iam_role.ecs_exec.arn
-  task_role_arn            = each.value.task_role
   container_definitions = jsonencode([{
-    name         = each.key
-    image        = each.value.image
+    name         = "presidio"
+    image        = var.presidio_image_uri
     essential    = true
-    portMappings = [{ containerPort = each.value.port }]
+    portMappings = [{ containerPort = 5001 }]
   }])
-  tags = each.value.tag
+  tags = local.onprem_tag
 }
 
-resource "aws_ecs_service" "svc" {
-  for_each        = local.services
-  name            = "${local.name}-${each.key}"
+resource "aws_ecs_service" "presidio" {
+  name            = "${local.name}-presidio"
   cluster         = aws_ecs_cluster.this.id
-  task_definition = aws_ecs_task_definition.svc[each.key].arn
+  task_definition = aws_ecs_task_definition.presidio.arn
   desired_count   = 1
   launch_type     = "FARGATE"
   network_configuration {
@@ -128,5 +86,5 @@ resource "aws_ecs_service" "svc" {
     security_groups  = [aws_security_group.svc.id]
     assign_public_ip = true
   }
-  tags = each.value.tag
+  tags = local.onprem_tag
 }