> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zwiron.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Hosted vs Agent Execution Modes

> Run Zwiron pipelines on hosted infrastructure or inside your network with an agent — how to choose.

Every Zwiron pipeline runs in one of two execution modes. You choose the mode when creating a job.

***

## Agent mode

**Your pipeline runs on the agent you've deployed inside your network.**

The agent receives the job instructions from the Zwiron control plane, connects to your source and destination using locally stored credentials, executes the data transfer, and streams progress back.

**Use Agent mode when:**

* Your databases are inside a private network or VPC
* Your data must not leave your infrastructure
* You need to connect to on-premises systems
* You want full control over compute resources

**Requirements:**

* At least one [Zwiron Agent](/getting-started/install-agent) installed and connected
* The agent must be able to reach both the source and destination

***

## Hosted mode

**Your pipeline runs on Zwiron's cloud infrastructure, orchestrated via Temporal for durability.**

You don't need to install or manage an agent. Zwiron runs the pipeline engine on your behalf.

**Use Hosted mode when:**

* Your source and destination are cloud services accessible over the internet (e.g. Snowflake, BigQuery, RDS with a public endpoint)
* You want zero-infrastructure setup
* You want Zwiron to handle retries, checkpointing, and durability automatically

**How it works:**

* Zwiron decrypts and uses your credentials in a secure, isolated execution environment
* Pipelines are orchestrated via Temporal — crashes and retries are handled automatically
* Progress is streamed to your dashboard in real time

**Firewall / allowlists:** If your database requires IP allowlisting (Cloud SQL Authorized Networks, security groups, Azure firewall), whitelist **all** of [Zwiron's static egress IPs](/concepts/network-access). Missing even one HA address causes intermittent failures.

<Warning>In Hosted mode, your connection credentials are decrypted and used by Zwiron's infrastructure. If you need Agent-mode handling (RSA ciphertext; plaintext only on your agent during sync), use Agent mode instead.</Warning>

***

## Comparison

|                              | Agent mode                  | Hosted mode                     |
| ---------------------------- | --------------------------- | ------------------------------- |
| **Where pipeline runs**      | Your network / VPC          | Zwiron cloud                    |
| **Infrastructure to manage** | Agent binary                | None                            |
| **Private network access**   | ✅ Yes                       | ❌ No                            |
| **Data leaves your network** | No                          | Yes (in transit only, over TLS) |
| **Setup required**           | Install agent               | None                            |
| **Orchestration**            | Agent manages execution     | Temporal (durable, auto-retry)  |
| **Best for**                 | On-prem, private cloud, VPC | Cloud-to-cloud pipelines        |

***

## Switching modes

You can change the execution mode of an existing job by editing it. The change takes effect on the next run.

If you switch from Agent to Hosted mode, ensure your source and destination are reachable from Zwiron's cloud (i.e. they have public endpoints or are accessible via allow-listed IPs).