The agent is only needed for Agent mode — when your databases are in a private network or VPC. If you’re connecting cloud services with public endpoints (Snowflake, BigQuery, RDS public, etc.), you can use Hosted mode and skip agent installation entirely. See Execution Modes.
Why an agent?
When you need sync to stay in your network — private VPC, on-prem, or compliance — the agent runs in your infrastructure. Row data moves from source to destination there. The control plane handles scheduling and receives metadata (row counts, status), not the synced rows. For cloud sources with public endpoints, you can skip the agent and use Hosted mode.What the agent does
- Receives jobs from the Zwiron control plane via an encrypted, persistent connection
- Connects to your databases using credentials decrypted locally with the agent’s RSA key
- Reads data from sources using optimized batch queries or change data capture
- Writes data to destinations using high-throughput bulk loading where available
- Reports progress — row counts, bytes moved, timing — back to the dashboard in real time
- Manages its own keys — generates an RSA key pair on first install; used to encrypt credentials and authenticate with the control plane
Agent lifecycle
Credentials and security
When you save an Agent-mode connection in the Zwiron dashboard:- Credentials are encrypted with the agent’s public RSA key
- Atlas stores the ciphertext; the agent also keeps a local encrypted copy
- When a job runs, the agent decrypts credentials in memory for the sync — plaintext is not sent back to Zwiron
- Zwiron cannot read Agent-mode passwords without the agent’s private key
- Deleting an agent makes its local credential material irrecoverable
- For Hosted mode, credentials are encrypted and used on Zwiron’s infrastructure — see Connections
Multiple agents
You can run multiple agents — one per environment, one per network segment, or one per team. Each agent is independently registered and shows up in Settings → Agents. Use cases for multiple agents:- Separate staging and production agents
- One agent in your AWS VPC, another for on-prem databases
- Isolated agents per team for access control