When using Key Vault or Secret Manager, is it assumed that the application is deployed on cloud (or) on premise? My assumption is - we use Kay vault, only if our application