> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zwiron.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How Zwiron Works

> Architecture of Zwiron: hosted sync vs agent mode, pipelines, CDC, catalog, and quality in one product.

Zwiron moves data between systems in one of two ways: **Hosted** (Zwiron runs the sync) or **Agent** (the sync runs in your network). Pick the mode that matches your security and network needs.

***

## Two execution modes

|                     | Hosted                                                         | Agent                                           |
| ------------------- | -------------------------------------------------------------- | ----------------------------------------------- |
| **Where sync runs** | Zwiron infrastructure                                          | Your VPC / on-prem                              |
| **Row data path**   | Through Zwiron while the job runs                              | Source → destination inside your network        |
| **Credentials**     | Encrypted at rest on Zwiron; used in isolated job environments | RSA-encrypted; agent decrypts locally for syncs |
| **Best for**        | Cloud sources/destinations with public endpoints               | Private networks, on-prem, sync-must-stay-local |

See [Execution modes](/concepts/execution-modes) for the full comparison.

***

## Agent architecture

```
Your Network
┌─────────────────────────────────────────────────────┐
│                                                     │
│   ┌──────────┐        ┌────────────────────────┐   │
│   │ Source   │──────▶│   Zwiron Agent          │   │
│   │ Database │        │   (runs on your server) │   │
│   └──────────┘        └────────────┬───────────┘   │
│                                    │               │
│   ┌──────────┐                     │               │
│   │Destination◀─────────────────────               │
│   │ Warehouse│                                     │
│   └──────────┘                                     │
└─────────────────────────────────────────────────────┘
                         │ (outbound only, TLS)
                         ▼
               ┌─────────────────┐
               │  Zwiron Control │
               │  Plane (Atlas)  │
               │                 │
               │  - Scheduling   │
               │  - Monitoring   │
               │  - Dashboard    │
               └─────────────────┘
```

### The Agent

A lightweight binary that runs **inside your network**. It:

* Connects outbound to Zwiron (no inbound ports required)
* Receives pipeline instructions from the control plane
* Reads from your source and writes to your destination
* Streams progress and metrics back to the dashboard
* Decrypts connection credentials locally for the sync (RSA key unique to the agent)

### The Control Plane

The Zwiron cloud service you use in the web app. It:

* Schedules pipeline jobs
* Dispatches jobs to the right agent (or hosted workers)
* Collects progress and metrics
* Stores pipeline configuration and encrypted connection material

In **Agent mode**, synced row data does not pass through the control plane — only metadata (row counts, timing, status).

***

## Hosted data flow

1. Zwiron schedules the job on hosted workers
2. Credentials are decrypted inside an isolated execution environment
3. The worker reads from the source and writes to the destination
4. Progress is reported to the dashboard
5. Row data is not retained as a warehouse after the job completes

Use Hosted when sources and destinations are reachable over the internet and you do not need sync to stay inside your network.

***

## Agent data flow

1. Zwiron schedules the job and sends it to the assigned agent
2. The agent connects to your source using locally decrypted credentials
3. Schema discovery — table structure (columns, types, primary keys)
4. Data read — batches (incremental) or changelog stream (CDC)
5. In-memory processing on the agent — no durable copy of row data on Zwiron
6. Write to destination in high-throughput batches
7. Progress reported — row counts, bytes, and status to the dashboard

***

## Security model

| Concern               | Hosted                                             | Agent                                                           |
| --------------------- | -------------------------------------------------- | --------------------------------------------------------------- |
| Credentials           | Encrypted at rest on Zwiron; used only for the job | RSA ciphertext on Atlas; plaintext only on the agent during use |
| Row data in transit   | TLS to sources/destinations via Zwiron workers     | TLS inside your network; control plane sees metadata only       |
| Agent ↔ Control plane | N/A                                                | Outbound TLS; agent holds a unique RSA key pair                 |
| Inbound access        | N/A                                                | Not required — agent only makes outbound connections            |

***

## Agents and connections

Each Agent-mode connection is tied to a specific agent. When you test or run that connection, traffic goes through that agent. This lets you:

* Use different agents for different environments (staging vs. production)
* Keep production traffic on a dedicated agent in your production VPC
* Run agents in different network segments

***

## What Zwiron does NOT do

* **Does not keep a warehouse of your synced rows.** Data is moved for the job; it is not retained as a long-term copy of your tables.
* **Does not require inbound access for Agent mode.** The agent only makes outbound connections.
* **Does not claim credentials never touch Zwiron in every mode.** Hosted mode stores and uses encrypted credentials on Zwiron. Agent mode uses RSA so only your agent can decrypt for syncs.