Bring Your Own Cloud

For customers with strict security and data protection requirements, Traversal offers a BYOC (Bring Your Own Cloud) deployment option on AWS. Deployed inside of your cloud account, this option provides a private, fully segregated, single-tenant, and shared-nothing deployment of Traversal. Connections to your private data sources go through the Traversal Connector over encrypted network paths.

​

Architecture

Traversal BYOC is deployed, fully-managed, and operated by Traversal inside of a separate, dedicated cloud account that you own; for example, a separate AWS account part of your AWS organization. This separation helps protect the security of your systems and applications while giving Traversal the access it needs to run and maintain the service. Access to your private data sources and environments can be made through the Traversal Connector architecture (pictured above) and through dedicated, secure, PrivateLink service endpoints to cross the VPC boundary. Apart from system and usage telemetry, your BYOC deployment doesn’t talk to Traversal’s SaaS. Data that Traversal stores is kept in your cloud account. It leaves your environment only to services you configure, such as your LLM provider (unless you use Bedrock in your own account), Slack, or the tools you integrate.

​

Networking

The entirety of the Traversal BYOC environment is deployed in a dedicated VPC, with all relevant infrastructure spread across multiple availability zones and hosted in private subnets. Traversal requires a dedicated /20 Class A CIDR block for its VPC, with at least three /22 private subnets — one per distinct availability zone — for its deployment and operations. Public subnets, when used, are sized as /24 and fit within the remaining /22 of address space.

​

Compute

All compute powering Traversal’s services, data stores, data pipelines, agentic workflows, and applications, runs on cloud instances (in AWS, EKS-on-EC2) and managed cloud services inside of the provided, dedicated cloud account.

​

AI models and inference

Traversal uses frontier AI models (LLMs) to power its AI SRE agent. At your discretion, those models can be cloud-hosted (from LLM providers directly), routed through a private gateway, or fully hosted in your cloud environment (in AWS, with Bedrock).

​

Access control

Your users sign in with single sign-on (SSO) through your identity provider. Deployment and management of infrastructure, as well as operational access by Traversal, is performed through a cross-account IAM AssumeRole, scoped to the dedicated AWS account that hosts your Traversal BYOC deployment. Access by Traversal operators for maintenance and support is made through a secure and audited Tailscale-based VPN, limited to authorized Traversal personnel. Sign-in requires SSO with two-factor authentication. Traversal’s roles in your account use temporary AWS credentials that expire after one hour. You can review the exact trust and permission policies in the Traversal BYOC AWS CloudFormation Template before you deploy it.

​

Monitoring and revoking Traversal’s access

Because the BYOC account is yours, AWS CloudTrail in that account records each session Traversal starts and the API calls made in it. You run CloudTrail and your own security monitoring for the account, such as GuardDuty, Security Hub, and AWS Config. You can revoke Traversal’s access at any time by deleting Traversal’s IAM roles in the account or denying them with a service control policy. Deleting the CloudFormation stacks leaves the roles in place, so delete the roles directly. Without access, Traversal can’t upgrade, support, or recover your deployment.

​

Telemetry

Two categories of telemetry data leave your BYOC deployment: system telemetry, used to monitor and support your deployment, and usage telemetry, used for product analytics, customer success, and billing. They’re handled differently.

​

System telemetry

By default, system telemetry (metrics, logs, and traces about your Traversal deployment) is sent to Traversal’s centralized observability solution outside of your environment. If needed, some telemetry attributes can be redacted or filtered before leaving your BYOC deployment. If your requirements call for it, you can instead opt to keep system telemetry and monitoring entirely within your environment. In that configuration, alerts derived from that telemetry must still be allowed to egress to Traversal’s on-call solution (PagerDuty), so Traversal operators can be notified of and respond to issues affecting your deployment.

​

Usage telemetry

Regardless of your system telemetry configuration, Traversal always collects the following usage telemetry, which leaves your environment:

• Client-side user analytics — events generated by user interactions in the web app
• Server-side user analytics — user events and feedback signals, such as thumbs up/down reactions
• Usage data — investigations initiated, follow-ups initiated, and activity of Traversal workers

Telemetry is sent over HTTPS to authenticated endpoints.

​

Data security

All data stored by Traversal in databases, network-attached storage volumes, and cloud storage buckets remains in your AWS account dedicated for Traversal’s BYOC deployment. Data is encrypted at rest and in transit using your cloud provider’s encryption (AES-256 at rest, TLS 1.3 in transit).

​

Network security

Within the Traversal platform, all service-to-service traffic is encrypted in transit with TLS. External ingress from Traversal Connectors and Processors, including telemetry, uses mTLS by default to authenticate both endpoints. Connections to your private data sources and environments go through the Traversal Connector.

​

Ingress

By default, no inbound connections to your Traversal BYOC deployment can be made from the public internet. Your access and connection to Traversal is routed through your private network. The following inbound connections (through secure PrivateLink service endpoints) must be established and allowed:

• From your users to Traversal’s web application and API;
• From your Traversal Connector to the Edge Controller in your Traversal BYOC deployment;
• If deployed, from your Traversal Processor to your Traversal BYOC deployment’s data ingest endpoint.

If you use the Traversal Slack integration, inbound webhook connections from Slack to the Traversal API in your BYOC deployment must be allowed. This is typically https://slack.<customer>.traversal.com.

​

Egress

To ensure the proper operation of your Traversal BYOC deployment, the following outbound connections must be allowed:

• To login.traversal.com and *.auth0.com for authentication;
• To telemetry.traversal.com for reporting usage telemetry, and — unless you’ve opted to keep system telemetry within your environment — system telemetry, to Traversal;
• To *.rudderstack.com for user telemetry;
• To *.pagerduty.com for monitoring and alerting;
• To api.sendgrid.com for transactional email delivery;
• To *.tailscale.com for Traversal’s Tailscale-based operational VPN (required for upgrades, maintenance, and support);
• To *.okta.com for authentication of Traversal operators with our identity provider;
• To *.letsencrypt.org for issuance of SSL/TLS certificates;
• To *.github.com and *.githubusercontent.com for pulling Traversal platform repositories (required for deployment and upgrades);
• To *.ghcr.io and *.docker.io (and *.cloudflare.docker.com for Docker Hub image layers) for pulling third-party Docker images;
• To *.pypi.org and files.pythonhosted.org for pulling Python dependencies;
• If configuring integrations with any third-party vendor, to their endpoint domains:
  • To *.slack.com for the Traversal Slack app
  • To api.anthropic.com and/or api.openai.com for access to our LLM providers if you’re not using Bedrock

Additionally, you must ensure that the following domains and endpoints are reachable by your end users:

• Your Traversal BYOC deployment at <customer>.traversal.com and api.<customer>.traversal.com;
• login.traversal.com and *.auth0.com for authentication;
• *.rudderstack.com for user telemetry.

​

Deployment

To deploy Traversal BYOC, after establishing your agreement with Traversal and reviewing the responsibility matrix below, you must: Traversal then proceeds with the deployment of its platform and provides you with an access endpoint URL – typically https://<customer>.traversal.com. Following this initial deployment, and depending on the needs of your environment, you will:

​

Operations

Traversal manages and operates BYOC deployments the same way it operates its SaaS: it monitors the deployment, tunes it, and deploys updates.

​

Responsibility matrix