> For the complete documentation index, see [llms.txt](https://docs.teleskope.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.teleskope.ai/setup/deployment/architecture.md).

# Architecture and Data Flow

## Application plane and data plane

| Plane             | Responsibilities                                                                       | Placement                                                                                                                |
| ----------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Application plane | UI, APIs, connector configuration, scheduling, resource metadata, and findings storage | Your Teleskope environment: hosted by Teleskope for SaaS, or in your infrastructure for a customer-hosted deployment     |
| Data plane        | Discover sources, read content, classify data, and execute enabled remediation actions | Workers in the Teleskope environment, or Outposts inside your network; classification placement is configured separately |

## Reference architecture

Cloud and SaaS connectors read sources from workers in your Teleskope environment. Private sources can be reached directly over a configured network path or through an Outpost inside your network. Both options report to the same application plane.

![Teleskope architecture: cloud and SaaS sources are accessed by workers in the Teleskope environment; private sources are accessed either over direct network connectivity or through an Outpost inside the customer network.](https://2383928706-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgO8NOoWqwRd6MduHoEy7%2Fuploads%2Fgit-blob-c85053afcf1aa37c965fbb0635474b1da14ca388%2Fplatform-architecture.png?alt=media)

The Teleskope environment is hosted by Teleskope for SaaS, or runs in your infrastructure for customer-hosted deployments. The diagram shows representative connectors, not the full [data store coverage](broken://pages/XwTytliM1xF2cbdQEPFA).

## Private network access

* **Direct network access:** Workers in your Teleskope environment connect to private sources over a network path you configure, such as VPC/VNet peering, a VPN, or private connectivity through [AWS Direct Connect](https://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html) or [Azure ExpressRoute](https://learn.microsoft.com/en-us/azure/expressroute/expressroute-introduction). The path must connect the worker network to the source network, with routing, DNS resolution, and firewall rules configured for source access. Connector credentials are still required.
* **Outpost:** Workers inside your network read private sources and connect outbound to your Teleskope environment. This option does not require an inbound path from Teleskope to your source network.

Direct connectivity provides access to your sources; it does not move processing into the source network. Confirm the network design for your deployment with Teleskope. Contact Teleskope for Outpost classification placement and data handling.

## Source access and data flow

| Source path                                                        | Where content is read and classified                                            | Connection requirements                                                                                                                          |
| ------------------------------------------------------------------ | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| Cloud sources, such as S3 and cloud databases                      | Workers in your Teleskope environment read and classify content                 | Source API access; databases also require a network path to their configured port                                                                |
| SaaS sources, such as Microsoft 365 and Box                        | Workers in your Teleskope environment read and classify content                 | Outbound HTTPS to provider APIs, with the connector's required authorization                                                                     |
| Private sources via direct network access                          | Workers in your Teleskope environment read and classify content                 | A configured private network path, source DNS resolution, and access to the required source ports                                                |
| Private sources via Outpost, such as SMB and on-premises databases | The Outpost reads sources locally. Contact Teleskope for classification options | Source connectivity inside your network and outbound connections from the Outpost to Teleskope; no inbound connection from Teleskope is required |

Resource metadata and classification findings are stored in the application plane. With local Outpost classification, those results still leave the Outpost. Requested previews can include matched context, and findings can themselves contain sensitive information.

Contact Teleskope for the detailed SaaS + Outpost diagram, classification modes, and network destinations and ports. Operational logs and metrics are covered separately in [Telemetry and Monitoring](/setup/deployment/deployments/telemetry-and-monitoring.md).

## Access boundaries

Deployment-management access and connector access serve different purposes. Management roles provision and maintain infrastructure; connector credentials determine which source data Teleskope can read or modify. Scope each separately and grant write permissions only for enabled remediation actions.