Architecture and Data Flow

Application plane and data plane

Plane	Responsibilities	Placement
Application plane	UI, APIs, connector configuration, scheduling, resource metadata, and findings storage	Your Teleskope environment: hosted by Teleskope for SaaS, or in your infrastructure for a customer-hosted deployment
Data plane	Discover sources, read content, classify data, and execute enabled remediation actions	Workers in the Teleskope environment, or Outposts inside your network; classification placement is configured separately

Reference architecture

Cloud and SaaS connectors read sources from workers in your Teleskope environment. Private sources can be reached directly over a configured network path or through an Outpost inside your network. Both options report to the same application plane.

Teleskope architecture: cloud and SaaS sources are accessed by workers in the Teleskope environment; private sources are accessed either over direct network connectivity or through an Outpost inside the customer network.

The Teleskope environment is hosted by Teleskope for SaaS, or runs in your infrastructure for customer-hosted deployments. The diagram shows representative connectors, not the full data store coverage.

Private network access

• Direct network access: Workers in your Teleskope environment connect to private sources over a network path you configure, such as VPC/VNet peering, a VPN, or private connectivity through AWS Direct Connect or Azure ExpressRoute. The path must connect the worker network to the source network, with routing, DNS resolution, and firewall rules configured for source access. Connector credentials are still required.

• Outpost: Workers inside your network read private sources and connect outbound to your Teleskope environment. This option does not require an inbound path from Teleskope to your source network.

Direct connectivity provides access to your sources; it does not move processing into the source network. Confirm the network design for your deployment with Teleskope. For Outpost classification placement and data handling, see the Outpost guide.

Source access and data flow

Source path	Where content is read and classified	Connection requirements
Cloud sources, such as S3 and cloud databases	Workers in your Teleskope environment read and classify content	Source API access; databases also require a network path to their configured port
SaaS sources, such as Microsoft 365 and Box	Workers in your Teleskope environment read and classify content	Outbound HTTPS to provider APIs, with the connector's required authorization
Private sources via direct network access	Workers in your Teleskope environment read and classify content	A configured private network path, source DNS resolution, and access to the required source ports
Private sources via Outpost, such as SMB and on-premises databases	The Outpost reads sources locally. See Outpost data handling for classification options	Source connectivity inside your network and outbound connections from the Outpost to Teleskope; no inbound connection from Teleskope is required

Resource metadata and classification findings are stored in the application plane. With local Outpost classification, those results still leave the Outpost. Requested previews can include matched context, and findings can themselves contain sensitive information.

See the Outpost guide for the detailed SaaS + Outpost diagram, classification modes, and network destinations and ports. Operational logs and metrics are covered separately in Telemetry and Monitoring.

Access boundaries

Deployment-management access and connector access serve different purposes. Management roles provision and maintain infrastructure; connector credentials determine which source data Teleskope can read or modify. Scope each separately and grant write permissions only for enabled remediation actions.