# Architecture AvertGate uses a hybrid architecture: inspection runs in the customer's own network, while management lives in the cloud. ## Two planes | | Data plane | Control plane | | --- | --- | --- | | Where | Customer machine / network (on-premise, stdio) | Hosted web app and database | | What runs | MCP proxy, reverse proxy, SDK; inspectors; policy engine | Dashboard, policy management, agent registry, event viewing | | What it sees | Tool calls, results, file contents, SQL queries | Only redacted audit events | ## What leaves your network? Tool calls, results, file contents and queries are **processed inside the customer network**. Only *redacted* audit events go to the control plane: which tool, redacted arguments, the decision and the rule. This reduces latency and eases KVKK/GDPR compliance. The one exception is the AI Guard: if you point it at a cloud provider (TypeSafe's cloud endpoint is the default provider setting), the content being inspected goes to that provider. A local model (Ollama or vLLM) keeps it inside. The AI Guard is off unless you enable it. ## Data flow table | Data | Where it is processed | Sent to the dashboard? | Can it reach a third party? | | --- | --- | --- | --- | | Tool-call arguments, results, file contents, SQL queries | Customer network (the gateway) | No | Only if the AI Guard uses a cloud provider (see below) | | Audit event (tool, decision, rule, reason) | The gateway, local audit log | Yes; arguments **redacted** | No | | AI Guard: inspected content | Off by **default**. With a local model (Ollama/vLLM) inside your network; with a cloud provider, at the provider | No | **Yes**, the content goes to the provider if you choose a cloud one | | Slack approval message | From the gateway to Slack | No | **Yes; arguments are written to Slack unredacted** | | Policy | Managed in the dashboard, fetched by the gateway at start | Dashboard to gateway | No | > **Slack approvals do not redact arguments**: The approval message shows the call's arguments as they are, so the approver sees what they are approving. If you put tools whose arguments may carry personal data or secrets (for example `send_email`) behind approval, restrict the Slack channel accordingly. ## Policy and event flow 1. At boot the gateway calls `GET /api/gateway/resolve` with the agent key to fetch that agent's policy. 2. At runtime events are sent in batches (up to 100) to `POST /api/events/ingest`. 3. When a policy changes in the dashboard the gateway picks up the new version. You can also run fully local without a cloud connection: a local file via `POLICY_PATH` and a local SQLite audit log. ## Delivery formats - Standalone executable: built for the operating system it is compiled on (`avertgate.exe` on Windows, `avertgate` on macOS and Linux). Each OS and CPU architecture needs its own build; contact sales for ready-made packages. - Enterprise Docker image `avertgate/gateway`. - `npx @avertgate/cli` for quick POCs. ## Air-gapped environments For the AI Guard you can use local Ollama or vLLM instead of a cloud model, keeping the entire path inside your network.