> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment Architecture

> Reference architectures for multi-region cloud, on-premises Kubernetes, and isolated air-gapped topologies.

Snapsec supports modular deployment topologies scaling from single-node instances to distributed multi-cluster setups.

***

## Distributed Enterprise Topology

```mermaid theme={null}
flowchart TD
    subgraph Corporate_Cloud["Customer Public Cloud (AWS / GCP / Azure)"]
        SaaS_GW["Ingress Controller & Load Balancer"]
        App_Cluster["Snapsec Core Application Cluster"]
        DB_Cluster[("Managed PostgreSQL + Redis")]
    end

    subgraph VPC_Private["Customer Private VPC / Data Center"]
        Forwarder1["Snapsec Scanner Forwarder (Internal Network)"]
        Private_Apps["Private APIs & Databases"]
        Forwarder1 --> Private_Apps
    end

    subgraph Secure_Enclave["Isolated / Air-Gapped Network"]
        AirGap_Instance["Snapsec Air-Gapped Standalone Node"]
        Offline_Apps["Classified / Offline Workloads"]
        AirGap_Instance --> Offline_Apps
    end

    App_Cluster --> DB_Cluster
    SaaS_GW --> App_Cluster
    Forwarder1 -.->|Outbound mTLS Only| App_Cluster
```

***

## Key Components

1. **Snapsec Core Cluster**: Manages UI, API Gateway, risk computation, notification dispatch, and tenant governance.
2. **Scanner Forwarders / Workers**: Lightweight, containerized sensor nodes deployed inside private networks to scan internal resources without exposing inbound firewall ports.
3. **mTLS Control Tunnel**: Scanner forwarders establish outbound-only TLS 1.3 tunnels to the core platform, receiving scan jobs and streaming encrypted findings back.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.