| Public internet (default) | The appliance reaches your control plane over public HTTPS. The connection is mutually-TLS authenticated end-to-end. | Adoption-friendly default. The customer is comfortable with outbound HTTPS from their environment. | None directly. Common starting posture; the customer’s egress proxy and TLS-inspection appliances handle policy. |
| AWS PrivateLink | The appliance reaches your control plane over an AWS PrivateLink endpoint. Cross-region attachments supported. Requires both the customer environment and your control plane to be on AWS. | The customer wants no public-internet path between their environment and you. | Eliminates a common third-party-risk finding: there is no public route by which a compromised credential could reach your surface. The PrivateLink endpoint is documentation-friendly evidence for the customer’s auditor. |
| Tailscale | You operate a Tailscale tailnet. Both your control plane and the customer’s appliance join it, and the connection travels the tailnet. | The customer prefers Tailscale to public-internet egress, or the appliance lives somewhere outbound HTTPS is awkward (heavily-restricted on-prem environments, lab segments, etc.). | Eliminates the public path with a control the customer’s security team already understands. Tailnet membership and ACLs become the authorization boundary. |
