Skip to main content

Customer VPC deployment

In the Customer VPC model, every Zingle component runs inside your own cloud account or VPC. Zingle connects to your data warehouse and Git provider over your internal network, and your code, credentials, and data stay within your security boundary.

This is Zingle's primary deployment model for teams with data-residency, network-isolation, or regulatory requirements.

What runs inside your boundary​

All of the following run in your environment:

  • The web app and backend/API.
  • The agent runtime that drafts changes.
  • The metadata store (models, lineage, sessions, configuration).
  • The warehouse and Git connectors.

Data boundary​

Because Zingle runs in your VPC:

  • Repository code is cloned and processed inside your environment.
  • Warehouse credentials and Git tokens are stored encrypted at rest inside your environment.
  • Warehouse queries run from inside your network directly against your warehouse.

The one flow that leaves your environment (unless configured otherwise) is LLM inference. See below.

LLM inference

Zingle's agents call a large language model to reason about your project. This can be configured to use AWS Bedrock - so inference runs within AWS under your account's terms and your data is not used to train foundation models - or a direct model-provider API.

Prerequisites​

  • A cloud account / VPC to host the Zingle services.
  • Network reachability from the Zingle services to:
    • Your data warehouse.
    • Your Git provider.
    • The configured LLM endpoint (e.g. AWS Bedrock).
  • A warehouse role provisioned for Zingle with least-privilege grants (see Production safety model).
  • A Git connection (see GitHub).

Setup​

A Customer VPC installation is set up together with the Zingle team, who work with you to provision the services in your environment, connect your warehouse and Git, and validate the deployment. Contact Zingle to start a VPC deployment.

What this model gives you​

  • Code, credentials, and data remain within your boundary.
  • Warehouse and Git traffic stays on your internal network.
  • You control the network egress allowed from the Zingle services.