Skip to main content
Zwiron moves data between systems in one of two ways: Hosted (Zwiron runs the sync) or Agent (the sync runs in your network). Pick the mode that matches your security and network needs.

​
Two execution modes

See Execution modes for the full comparison.

​
Agent architecture

​
The Agent

A lightweight binary that runs inside your network. It:
  • Connects outbound to Zwiron (no inbound ports required)
  • Receives pipeline instructions from the control plane
  • Reads from your source and writes to your destination
  • Streams progress and metrics back to the dashboard
  • Decrypts connection credentials locally for the sync (RSA key unique to the agent)

​
The Control Plane

The Zwiron cloud service you use in the web app. It:
  • Schedules pipeline jobs
  • Dispatches jobs to the right agent (or hosted workers)
  • Collects progress and metrics
  • Stores pipeline configuration and encrypted connection material
In Agent mode, synced row data does not pass through the control plane — only metadata (row counts, timing, status).

​
Hosted data flow

  1. Zwiron schedules the job on hosted workers
  2. Credentials are decrypted inside an isolated execution environment
  3. The worker reads from the source and writes to the destination
  4. Progress is reported to the dashboard
  5. Row data is not retained as a warehouse after the job completes
Use Hosted when sources and destinations are reachable over the internet and you do not need sync to stay inside your network.

​
Agent data flow

  1. Zwiron schedules the job and sends it to the assigned agent
  2. The agent connects to your source using locally decrypted credentials
  3. Schema discovery — table structure (columns, types, primary keys)
  4. Data read — batches (incremental) or changelog stream (CDC)
  5. In-memory processing on the agent — no durable copy of row data on Zwiron
  6. Write to destination in high-throughput batches
  7. Progress reported — row counts, bytes, and status to the dashboard

​
Security model

​
Agents and connections

Each Agent-mode connection is tied to a specific agent. When you test or run that connection, traffic goes through that agent. This lets you:
  • Use different agents for different environments (staging vs. production)
  • Keep production traffic on a dedicated agent in your production VPC
  • Run agents in different network segments

​
What Zwiron does NOT do

  • Does not keep a warehouse of your synced rows. Data is moved for the job; it is not retained as a long-term copy of your tables.
  • Does not require inbound access for Agent mode. The agent only makes outbound connections.
  • Does not claim credentials never touch Zwiron in every mode. Hosted mode stores and uses encrypted credentials on Zwiron. Agent mode uses RSA so only your agent can decrypt for syncs.
Last modified on July 14, 2026