For the organizations Procela is built for, one constraint dominates every architecture decision: the data cannot move. Export-controlled engineering data, CUI, and regulated health and financial records can't be copied to a vendor's cloud for processing. So Procela is designed around a simple principle — governance comes to the data, not the other way around.
The no-egress principle
Procela's edge connector runs inside your environment. It reads schema, table, and column metadata where the data lives and sends only that metadata — asset structure, classifications, lineage, policy state — back to the platform. Source records never cross your perimeter. This is what makes Procela a fit for ITAR, CMMC, CUI, and HIPAA programs where data residency is non-negotiable.
How the edge connector works
The connector deploys via Kubernetes or Helm into your infrastructure — a VPC, an on-premise cluster, or a secured enclave. Rather than pulling data out to scan it, it reads catalog metadata and row counts in place: only structural metadata is returned, never the underlying values.
Identity: outbound HTTPS with a bearer token
The connector pairs with the platform using a one-time pairing code, then authenticates every request with a bearer token over outbound HTTPS. Because the connection is outbound-only, you don't open inbound ports into your environment. The connector's identity is also the anchor for the audit trail — every action it takes is attributable to a named principal.
Tamper-evident audit trail
Procela records an append-only, hash-chained audit trail of what the connector does: what was scanned, what was classified, what policies were recorded. Because the trail is tamper-evident, an auditor can trust that what they're reading is what actually happened.
What actually leaves the perimeter
Only metadata: asset identifiers, classifications, ownership and stewardship assignments, policy decisions, and lineage. No column values, no records, no file contents. If it would be sensitive to move, it doesn't move.
Deployment topologies
- Cloud VPC. A connector in your AWS VPC reads metadata from supported sources like Redshift and RDS Postgres in-region.
- On-premise. A connector inside your data center reaches legacy databases that never touch the internet.
- Hybrid. Multiple connectors across environments report into one governance program, giving you a single view without consolidating the data.
The result
You get a unified, audit-ready governance program across every source — while your data stays exactly where your security and compliance teams require it to be.