Deployment Topologies

Arbitex supports three deployment topologies. All three provide the same enforcement capabilities — DLP inspection, policy evaluation, multi-provider routing, and tamper-evident audit logging — with different data residency, operational, and compliance characteristics.

flowchart LR
    subgraph SaaS["SaaS"]
        direction TB
        A1["Your Apps"] --> G1["Arbitex Cloud\n(gateway + control plane)"]
        G1 --> P1["LLM Providers"]
    end

    subgraph Hybrid["Hybrid Outpost"]
        direction TB
        A2["Your Apps"] --> O["Outpost\n(your VPC)"]
        O --> P2["LLM Providers"]
        O -."mTLS\npolicy + audit sync".-> CP["Arbitex Cloud\n(control plane only)"]
    end

    subgraph AirGap["Air-Gap"]
        direction TB
        A3["Your Apps"] --> G3["Full Platform\n(your infra, offline)"]
        G3 --> P3["LLM Providers\n(internal)"]
    end

---

Topology comparison

	SaaS	Hybrid Outpost	Air-Gap
Where prompts travel	Through Arbitex Cloud	Stay in your VPC	Stay in your infrastructure
Control plane operated by	Arbitex	Arbitex	You
DLP runs on	Arbitex Cloud	Your VPC (local)	Your infrastructure
Policy management	Cloud Portal + API	Cloud Portal, synced every 60 s via mTLS	Local admin API and portal
Audit log stored	Arbitex Cloud (90-day hot, 2-year archive)	Local buffer → Cloud every 30 s	Local PostgreSQL only
Internet required	Yes	Outbound to api.arbitex.ai only	No
Operates when Cloud is unreachable	No	Yes (cached policy bundle)	Always
Plan required	Developer Free / Pro / Team / Enterprise	Enterprise Outpost	Contact sales
Time to deploy	Minutes	30–60 minutes	Varies

---

SaaS

The managed cloud deployment. Your applications send requests to the Arbitex Cloud gateway endpoint. Arbitex operates the full stack — gateway, DLP, policy engine, and audit log. You configure everything through the Cloud Portal or admin API.

Architecture

flowchart LR
    Apps["Your Applications"] -->|"HTTPS POST /v1/chat/completions"| GW["Arbitex Gateway\nhttps://gateway.arbitex.ai"]
    GW --> DLP["DLP Pipeline"]
    DLP --> PE["Policy Engine"]
    PE --> RP["Provider Routing"]
    RP --> Providers["LLM Providers\n(OpenAI, Anthropic, ...)"]
    PE --> AL["Audit Log\n(Arbitex Cloud)"]
    AL --> SIEM["Your SIEM\n(optional)"]

What stays in your network

Nothing. Prompts, responses, and metadata all pass through Arbitex Cloud. If your security policy prohibits AI traffic from leaving your network, use Hybrid Outpost instead.

What goes to Arbitex

• All request and response content (DLP inspection and routing run in Arbitex Cloud)
• Audit log metadata (stored for 90 days hot, 2 years in compliance archive)
• Configuration: provider credentials (encrypted at rest, AES-256), policy packs, user and group memberships

Latency

Leg	Typical range
Your app → gateway.arbitex.ai	Varies by region
Gateway DLP pipeline	+5–30 ms (Tier 1/2 only) or +150 ms (Tier 3 DeBERTa)
Gateway → LLM provider	Varies by provider

DLP Tier 3 (DeBERTa) adds ~150 ms and is only invoked when Tier 1 and Tier 2 produce inconclusive results.

Compliance implications

• Data resides in Arbitex’s Azure infrastructure (US East by default; EU region available on Enterprise)
• Arbitex holds a copy of all prompts and responses for the audit retention period
• Suitable for: general enterprise use, teams without strict data residency requirements
• Not suitable for: regulated industries requiring data to remain within your environment (use Hybrid Outpost or Air-Gap)

Network requirements

Direction	Destination	Port
Outbound from your apps	gateway.arbitex.ai	443 HTTPS
Outbound from your apps	api.arbitex.ai (admin API)	443 HTTPS

No inbound connections from Arbitex to your network are required.

Getting started

→ Quickstart — send your first request in five minutes using the SaaS endpoint

---

Hybrid Outpost

The data-plane-in-your-VPC deployment. The Outpost container runs inside your network and handles every request locally: DLP inspection, policy evaluation, provider routing, and audit logging. Only metadata (policy sync requests and audit entries) crosses the boundary to Arbitex Cloud.

Architecture

flowchart TD
    subgraph VPC["Your VPC"]
        Apps["Your Applications\n:8300"] --> BE["Outpost Backend\n(proxy + DLP + policy engine)"]
        Admin["Admin Browser\n:3100"] --> FE["Admin Portal"]
        FE -->|"/api/ reverse proxy"| BE
        BE --> PG["PostgreSQL\n(config + audit log)"]
        BE --> RD["Redis\n(rate limiting)"]
        BE -->|"POST /detect"| NER["NER GPU :8200\n(optional)"]
        BE -->|"POST /validate"| DEB["DeBERTa :8201\n(optional)"]
        BE -->|"direct from your network"| LLM["LLM Providers"]
    end

    BE -."mTLS outbound only\npolicy sync every 60 s\naudit sync every 30 s".-> Cloud["Arbitex Cloud\napi.arbitex.ai"]

What stays in your network

• All prompts and responses
• Full DLP processing (including GPU-accelerated Tier 2/3 if enabled)
• Policy evaluation decisions
• Audit log (buffered locally, metadata forwarded to Cloud periodically)
• Provider credentials

What goes to Arbitex

• Policy bundle updates (the Outpost pulls via mTLS every 60 seconds)
• Audit event metadata (forwarded in batches every 30 seconds for Cloud Portal visibility)
• Outpost health heartbeats (version, uptime, cert expiry, resource usage — sent every 60 seconds)
• Certificate renewal requests (automated, outbound only)

Latency

The Outpost adds no network round-trip to Arbitex Cloud on the request path. All processing happens locally.

Component	Typical latency
Tier 1 DLP (regex)	+1–2 ms
Tier 2 DLP (NER, GPU)	+15–30 ms
Tier 3 DLP (DeBERTa, GPU)	+100–200 ms
Policy evaluation	+2–5 ms

Compliance implications

• Prompts and responses never leave your VPC
• Suitable for: HIPAA, FedRAMP, financial services with data residency requirements, EU organizations subject to GDPR data transfer restrictions
• Audit metadata forwarding to Cloud can be disabled with AUDIT_CLOUD_SYNC_ENABLED=false — audit log stays fully local; Cloud Portal audit view becomes unavailable
• mTLS certificates expire every 90 days; the Outpost renews them automatically with a 30-day overlap period

Network requirements

Direction	Source	Destination	Port	Purpose
Inbound (VPC internal)	Your apps	Outpost	8300	Proxy requests
Inbound (VPC internal)	Admin browsers	Outpost	3100	Admin portal
Outbound	Outpost	api.arbitex.ai	443	Policy sync, audit sync
Outbound	Outpost	your-platform-host	443	Certificate renewal (the control-plane host issued to you at provisioning — the value of PLATFORM_MANAGEMENT_URL)
Outbound	Outpost	LLM provider APIs	443	Model proxying

All connections originate from the Outpost. No inbound connections from Arbitex Cloud to your VPC are required.

Offline resilience

If the Outpost loses connectivity to Arbitex Cloud:

• Enforcement continues — the last cached policy bundle remains active indefinitely
• Audit events buffer locally — queued to JSONL on a mounted volume; forwarded in order when connectivity is restored
• Certificate renewal pauses — plan for connectivity before the 90-day cert expiry; certificates remain valid up to 90 days from issuance

Getting started

→ Outpost Deployment Guide — full deployment instructions for Docker Compose and Kubernetes

---

Air-Gap

The fully offline deployment. The complete Arbitex platform runs on your infrastructure with no outbound connections to Arbitex Cloud. Required for classified environments, disconnected networks, and air-gapped security zones.

Architecture

flowchart LR
    subgraph Infra["Your Air-Gapped Infrastructure"]
        Apps["Your Applications"] --> BE["Platform Backend\n(gateway + DLP + policy engine)"]
        Admin["Admin Browser"] --> FE["Admin Portal"]
        FE --> BE
        BE --> PG["PostgreSQL"]
        BE --> RD["Redis"]
        BE --> NER["NER (optional)"]
        BE --> DEB["DeBERTa (optional)"]
        BE --> LLM["Internal LLM\nor air-gap-accessible provider"]
    end

What stays in your network

Everything. No data leaves your infrastructure under any circumstances.

What goes to Arbitex

Nothing. There is no outbound connection.

Latency

Same as Hybrid Outpost — all processing is local with no external network hops.

Compliance implications

• Suitable for: government classified networks, defense contractors, financial institutions with strict network segmentation, any environment where outbound internet is prohibited
• Policy updates, software updates, GeoIP database updates, and DLP model updates must all be applied manually as part of a controlled media transfer process
• Audit log is stored locally in PostgreSQL only; no Cloud Portal visibility
• No automatic certificate renewal — external LLM provider mTLS certificates must be managed manually if applicable

Key operational requirements

Requirement	Notes
Container images	Load from signed tarballs: docker load < arbitex-platform-x.y.z.tar.gz
Policy updates	Transfer signed policy bundle files via secure media; apply via admin API
DLP model updates	Transfer ONNX model files; reload via admin API or restart
GeoIP database updates	Replace MMDB file at /etc/arbitex/geoip/GeoLite2-City.mmdb
Software updates	See Upgrade Guide — Air-Gap

Getting started

Contact your Arbitex account team for the air-gap deployment package and signed container images.

---

Choosing a topology

If you need…	Use
Fastest deployment, zero infrastructure to manage	SaaS
Data residency — prompts must not leave your network	Hybrid Outpost
Fully offline, no external connections ever	Air-Gap
HIPAA / FedRAMP / EU data sovereignty	Hybrid Outpost or Air-Gap
Full operational control of the control plane	Air-Gap
Evaluate the gateway before committing to infrastructure	SaaS (Developer Free plan)

All three topologies support:

• Identical API surface (/v1/chat/completions, admin API)
• All supported AI providers
• DLP Tier 1/2/3 (Tier 2/3 require GPU)
• Full policy engine capabilities
• SIEM integration (Splunk HEC, syslog)
• HMAC-chained audit log integrity

---

See also

• Quickstart — send your first request in five minutes
• Upgrade Guide — upgrade procedures for all three topologies
• Outpost Deployment Guide — detailed Hybrid Outpost setup
• Routing and Failover — provider configuration and failover chains
• Audit Log — storage, integrity verification, SIEM integration