Network Diagram

​

Network Architecture

• End-to-end encryption
• Clear ingress/egress boundaries
• Optional VPC containment

​

Hosted Deployment

┌────────────┐
│   Client   │
└────┬───────┘
     │ HTTPS
┌────▼───────┐
│ Isofold Edge Proxy │
└────┬───────┘
     │ Internal (TLS)
┌────▼────────────┐
│ Rewrite Engine  │
│ Cost Estimator  │
│ Verifier (opt)  │
└────┬────────────┘
     │
┌────▼────────┐
│ Warehouse   │
│ (e.g. BQ)   │
└─────────────┘

• All inbound connections are TLS-encrypted
• Internal services are not exposed externally
• Result data is never stored

​

Self-Hosted Deployment

┌────────────┐
│   Client   │
└────┬───────┘
     │
┌────▼────────────┐
│ Isofold Proxy   │
│ (in your VPC)   │
└────┬────────────┘
     │
┌────▼────────┐
│ Warehouse   │
│ (Aurora, BQ)│
└─────────────┘

• TLS is optional but recommended
• No traffic exits your infrastructure
• Logging and metrics are fully under your control

​

Perimeter Recommendations

• Terminate TLS at the proxy or upstream load balancer
• Deploy the proxy close to the warehouse (same region or VPC)
• Use DNS-based routing to isolate team environments
• Audit connections using your existing observability stack

​

Data Egress Considerations

• BigQuery: Isofold calls Google APIs on your behalf. Use service account scoping and allowlisting.
• Snowflake: Proxy acts as a passthrough; no state is stored.
• Aurora: Use internal DNS routing and security groups to ensure isolation.