# Deployment

The managed control plane, and how the agent runs on your own infrastructure.

## Control plane topologies

The control plane is built to run as a managed service on Scaleway in Amsterdam, behind Cloudflare, and production is not live yet. Need the control plane inside your own boundary, in a private cloud or on-premise? [Contact us](/contact/) to discuss it.

## Agent deployment modes

The agent is a single binary and runs wherever your data lives. Install it on a host through one of its native channels (the install script, apt or yum, Homebrew, Scoop, or a release archive) and run it as a service; [Install the agent](/docs/guides/cli/install/) walks through each.

Running the agent as a container or on Kubernetes is on the roadmap. The identity model, protocols, and plugin catalog will be the same in every mode.

## Connectivity

The agent connects outbound only: no inbound firewall rules are required on your network, the agent opens no listening port, and its connectors listen on the loopback interface by default. Its connection to the hosted control plane uses TLS. For your sources and data platform, set a TLS mode on each database connection: with none set, a run reads a PostgreSQL source without TLS (`sslmode=disable`). Every public host of the platform is on the control-plane side. By default, connector plugins run as local subprocesses on the agent host and connect to the sources and data platforms you configure; a connector configured with the `grpc` registry runs at the address you give it instead.