Skip to main content
Grand Central iPaaS uses a network architecture split between Azure tenancies with public and private networking components to establish secure boundaries.

​
Network architecture

The platform operates across two Azure tenancies and the customer’s backend:

​
Service mesh (Istio)

Istio manages all application traffic, providing:
  • Mutual TLS (mTLS): Encryption between services is enabled by default.
  • Traffic management: Fine-grained routing, load balancing, and failover.
  • Observability: Distributed tracing and metrics collection without code changes.

​
Egress controls

Outbound traffic from the cluster is restricted by default. To allow applications to communicate with external APIs, you must explicitly define:
  • ServiceEntries: Declare external services that applications can access.
  • Egress Gateways: Route outbound traffic through controlled exit points.
This ensures data does not leave the secure perimeter without authorization.

​
Ingress and egress flow

​
Internal ingress (EBP client)

Traffic from the EBP client interface connects via Azure PrivateLink:
This path stays entirely within Azure’s backbone network with no internet exposure.

​
External ingress (Fintech / Open Banking)

External traffic traverses multiple security layers:

​
Egress flow

Outbound traffic to customer backends flows through:

​
Connectivity options

Grand Central supports three primary connectivity options: Best for: Azure-to-Azure connectivity, cross-region integrations Use separate endpoints for ingress and egress traffic with complete Azure backbone isolation.

​
Site-to-site VPN

Best for: On-premises connectivity, initial go-live, smaller branch connections Quick setup with encrypted IPSec tunnels. Performance depends on internet conditions.

​
Internet connectivity

Best for: End-user traffic, third-party services, public APIs Requires IP allowlisting or mTLS. Maximum flexibility with higher operational overhead.

​
Azure ExpressRoute

Best for: High bandwidth, low latency on-premises connectivity For mission-critical workloads requiring dedicated connectivity:
  • Direct connection from cloud to on-premises infrastructure
  • Site-to-site VPN as failover
  • PrivateLink for cloud backbone connectivity

​
Web Application Firewall

Staging and UAT runtimes are protected by Azure Application Gateway with WAF enabled in Prevention mode. This shields APIs from common web vulnerabilities including OWASP Top 10 attacks.

​
Private connectivity

Critical infrastructure components access Azure services via Private Links:
  • Azure Key Vault
  • Azure Storage Accounts
  • Azure Container Registry
This ensures traffic stays on the Azure backbone network and is never exposed to the public internet.

​
Security controls summary

​
Next steps

Security architecture

Learn about Zero Trust security and access controls

High availability

Explore resilience and disaster recovery

Platform architecture

Understand the complete platform architecture