Data sovereignty has never been more important for organizations, and at Airbyte, it’s always a point of discussion. Here are some of the most common statements we hear about data sovereignty from our customers:
“No sensitive data over the public internet.” “Data can’t leave our AWS account.” “Nothing gets processed on vendor infrastructure.” The tricky part is that there are two viable options for Airbyte users to handle data sovereignty requirements. There is Airbyte Pro with AWS PrivateLink as an add-on, or Enterprise Flex.
Both deployment models handle data sovereignty differently. PrivateLink changes the network path between Airbyte and your systems, while Airbyte still runs the syncs. Flex changes where the syncs run: inside your cloud, your VPC, or your data center. For some teams, PrivateLink may be enough, and for others, Flex is critical.
This guide will help you evaluate both deployments and understand which is best for your use case.
What PrivateLink does on Airbyte Pro Airbyte Pro is the enterprise version of Airbyte Cloud (Standard and Plus) with enhanced features and a different pricing model. Like the Standard and Plus plans, syncs run on Airbyte’s managed data plane. By default, that data plane reaches your sources and destinations over the internet, usually through IP allowlisting or an SSH tunnel.
If you are an AWS shop, you can use PrivateLink to avoid exposing your data plane to the internet. Traffic between Airbyte and your environment stays on AWS’s private network. This means your databases and warehouses don’t need public IPs or internet-facing firewall rules.
Airbyte runs its PrivateLink infrastructure in us-east-1 and eu-west-3. Cross-region PrivateLink means your resources can stay in whatever AWS region they reside in today.
However, there are some caveats you should be aware of:
We primarily support AWS PrivateLink. If you have an Azure or GCP instance, you’ll need to speak to your Airbyte representative. It’s only available for the US and EU regions. PrivateLink is an add-on on Airbyte Pro, priced separately from the plan. PrivateLink is ideal for AWS-centric teams whose sovereignty requirement is avoiding a public network path. Your private network must be in the EU or the US, and the syncs still go through Airbyte’s infrastructure.
What Enterprise Flex does Flex splits Airbyte into two separate planes, a significantly more complex hybrid deployment compared to Airbyte Pro with PrivateLink.
The control plane, managed by Airbyte, holds the UI, the API, the Terraform provider, and job scheduling. The data plane runs the sync containers and is the only part that connects to your sources and destinations.
A Flex data plane can run in your cloud, your VPC, or on-prem, and comes with the full Airbyte connector library. These are the primary reasons an organization chooses Flex:
Connections to the control plane from the data plane are outbound only, so you don’t open inbound firewall rules or expose an endpoint to Airbyte. Credentials stay in your own secrets manager. All records are extracted, processed, and loaded only inside your network. The control plane only receives metadata, such as job definitions and status, and connection configurations like table and column names. Flex also gives you the flexibility (humor us) to configure different deployments for separate data planes, based on the level of data sensitivity. Each workspace maps to one region and one data plane, so you can keep less sensitive workspaces on an Airbyte-managed data plane. For example, if your EU data needs to stay on-premises for GDPR compliance, but your US data doesn’t, you can sync your US data in a separate, Airbyte-managed data plane.
This gives you more configurability and reduces operational workloads. Plus, the Airbyte-managed data plane lets you use cool Airbyte features like semantic search that are only available on our cloud infrastructure.
There is some level of operational burden for the data planes that you host yourself. You have to run a Kubernetes cluster (EKS on EC2, GKE, or AKS), deploy the airbyte-data-plane Helm chart, and pay for that compute. You also need to manually upgrade the data plane and your connector versions.
Because the data plane already sits in your network, most Flex customers don’t need PrivateLink. It’s available as an add-on for cases like a workspace on an Airbyte-managed data plane that needs a private route into your VPC.
Which one fits your requirement We made this table to help you evaluate the two options in a straightforward fashion.
Requirement Pro with PrivateLink Enterprise Flex “No traffic over the public internet” Yes, for AWS-hosted resources Yes “Data must stay in the US or EU” Yes, on Airbyte’s managed US and EU data planes Yes “Data must stay in a region Airbyte doesn’t host (non-US/EU)” No Yes, with a data plane you run in that region “Data can’t be processed on vendor infrastructure” No Yes “Our sources are on-prem or outside AWS” Only through public endpoints with IP allowlisting or SSH tunnels Yes “Our stack runs on Azure or GCP” No, primarily AWS only, but talk to your Airbyte representative Yes, on AKS or GKE “No inbound connections from a vendor” No. Airbyte connects in through a VPC endpoint service you grant it Yes. The data plane only connects outbound “Credentials must live in our vault” No Yes, with your own secrets manager “We don’t want to run Kubernetes” Yes No. You run the data plane cluster
Cost differences Pro and Flex both use capacity-based pricing on Data Workers, so you pay for compute capacity, not data volume. Neither plan charges per connection. Flex includes all the enterprise features of Pro, along with its signature hybrid deployment architecture.
PrivateLink is an add-on on either plan, though very few Flex users will need it.
In general, Flex is more expensive than Pro, even with the PrivateLink add-on. This is due to the considerably higher complexity of deployment, support, and visibility into data planes. Please talk to us for a demo or a quote, or if you still have questions. You can also visit our pricing page for more details, including on capacity-based pricing.
FAQ Can I start on Pro with PrivateLink and move to Flex later? Yes. Pro customers can upgrade to Enterprise Flex. Flex includes every Pro feature, so the move adds deployment options without taking anything away.
Can some workspaces run on Airbyte’s data plane and others on mine? Yes. In Flex, each workspace uses one region and one data plane. Keep less sensitive workspaces on an Airbyte-managed data plane and put sensitive ones on a data plane you run.
What reaches the control plane under Flex? Job definitions and status updates, sent over an outbound-only connection from your data plane, plus connection configuration such as table and column names. Audit logs of configuration changes are stored in the control plane for 365 days. Records, buffers, and credentials stay in your environment, and data plane logs go to the log collector you configure.
Is PrivateLink available on Azure and GCP? PrivateLink supports AWS today. If your resources run on Azure or GCP, talk to sales.
Do I need PrivateLink if I’m on Flex? Usually not, because the data plane already runs inside your network. PrivateLink is an add-on for specific cases, like a workspace on an Airbyte-managed data plane that needs a private route into your VPC.
Does Flex limit which connectors I can use? No. All 700+ connectors run on a Flex data plane inside your boundary.
