Your data does not have to move

The useful data is behind a firewall and the tools are not. That leaves three options, and everyone in the room already knows all of them.

• Copy it to the cloud. Fast to say, slow to clear. The systems worth asking about are the ones whose data is hardest to get permission to move.
• Open a path inward. A VPN, a jump host, an allowlist. Each is a project with a security review attached, and it ends with an inbound door somebody now owns.
• Do nothing. Which is what usually happens, and why the question gets asked once a quarter in a meeting instead of once an hour by whoever needs it.

The gateway takes the fourth option. The data stays where it is and the connection runs the other way.

The line runs one way. No inbound port, no database user, and nothing crosses back except the answer to something you asked.

The node holds a read-only copy of what you point it at and answers questions against it locally. A question travels in, an answer travels out. The underlying rows stay on your machine unless you ask for them.

• Your ERP, as something you can query. A read-only copy, kept current, that takes SQL your ERP's own query interface will not accept. Window functions, ranking across the whole population, cohorts.
• Documents. Scanned invoices and delivery notes live as blobs that SQL cannot reach. On the node they are files, joined to the business objects they belong to.
• Databases and internal APIs. The systems that never got an integration because the integration was never worth a quarter of work.
• Machines and sensors. The same node, the same tunnel. On the roadmap rather than shipped, and marked that way on purpose.

Measured on a production system rather than estimated. Your estate is a different shape, so treat these as evidence that it is quick, not as a quote.

Self-serve enrollment is not open yet. Nodes are set up with us today, which is also how the first one got built.

• No inbound port. The node makes an outbound connection. Your firewall gains no new opening and there is nothing on the internet pointing at your machine.
• Read-only at the source. It issues SELECT statements through the application layer. It holds no write authorisation.
• No database access. No database user is created and no database port is opened. That matters for licensing as much as for security, since direct database access is the part your agreement restricts.
• It runs on your hardware. A virtual machine you own, patch and can unplug. Pull the power and the connection is gone.
• A named account you control. Created, scoped, revoked and audited like any other user in the system.
• Nothing is trained on your data.