The VPC question your security team asks after you sign the contract
The architecture slide said self-hosted. The arrow pointed at a vendor control plane. The review stopped for six weeks. This is the question that caused it, and the four flows that answer it.
Self-hosting · 2026-11-03 · Sumeta engineering
"Self-hosted" usually means the data plane runs in your environment. The question your reviewer asks is about the control plane — configuration, schema metadata and logs. If those live with the vendor, your rows may be local and your schema may not.
The slide, and the question
The diagram showed a box labelled "self-hosted" inside the customer VPC, and an arrow to a vendor service labelled "console". The reviewer asked one question: does our schema metadata leave the environment? Nobody in the room could answer without a call, and the procurement clock stopped.
The lesson is not that the vendor was dishonest. It is that "self-hosted" is a spectrum, and a single word cannot carry the answer a security review needs.
The four flows
| Flow | What it carries | Question to ask | How to verify |
|---|---|---|---|
| Source data | Rows read from your databases | Does it leave the environment? | Egress packet capture during a run |
| Query results | Rows written to targets | Only to targets we configure? | Target-side audit log |
| Schema and metadata | Table definitions, types, mappings | Where is this stored? | Inspect the control-plane store |
| Logs and alerts | Job logs, errors, telemetry | Do logs ship anywhere? | Check log shipping config |
A vendor can legitimately answer "no" to flow one and "yes" to flow three. That is what a hybrid deployment is. The failure mode is collapsing the four into one answer.
Three deployment forms
| Form | Data plane | Control plane | Typical contract language |
|---|---|---|---|
| Fully managed | Vendor | Vendor | SaaS with a region commitment |
| Hybrid | Customer | Vendor | Self-hosted data plane, managed control plane |
| Fully self-hosted | Customer | Customer | Software deployed in customer environment |
Bridge is the third row: both planes run in the customer's environment. Configuration, metadata and job logs live in the deployment, and activation is a licence key rather than a live call to a vendor service. For isolated networks, change sets cross a security gateway by file exchange with no inbound connection.
The twelve questions (preview)
The full checklist is a separate post. The first four are enough to settle the architecture question in a review:
- Do extraction, transformation and load all execute inside our VPC?
- Where is schema metadata stored, and can we inspect it?
- Can the platform run with no outbound traffic except our targets?
- If we go to an isolated network, what carries data across the boundary?
Answer the question with evidence
Run a pipeline with egress instrumentation and show your reviewer the four flows yourself.