On-prem runtime security: what leaves your network
Does data leave your network with an on-prem integration runtime? It depends on the design. With the Neblex On-Prem Worker, our local integration runtime (often called an on-prem integration agent), the Neblex cloud gets run status, diagnostics, record counts and integrity receipts over one outbound encrypted connection on port 443. Records go only to the systems each flow is built to reach. AI…
On-prem integration runtime security involves careful consideration of what data leaves the network and what the runtime needs from outside. The Neblex On-Prem Worker, an example of such a runtime, communicates with the Neblex cloud using one outbound encrypted connection on port 443. It sends run status, diagnostics, record counts, and integrity receipts, while record contents remain on the local machine unless a flow explicitly shares data through the Neblex cloud, such as via a webhook or form.
The runtime opens a single outbound WebSocket connection to the cloud, using TLS 1.3 with a post-quantum key exchange. It does not expose any ports to the internet. The On-Prem Worker proves its identity through two keys generated on its own machine. The runtime's sole listener during a standalone installation is a local console bound to 127.0.0.1, inaccessible from other machines.
In a cluster, other members can also connect to it. Each run's results are reported locally, with records staying with the runtime unless explicitly sent to a destination system. The runtime can continue functioning even if the internet connection drops, maintaining its processing and reporting locally until the connection is restored.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
