> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> Understanding Formal's technical architecture with Control Plane, Connectors, and Satellites

## Overview

At the heart of Formal is [the Formal Connector](/docs/guides/core-concepts/connectors), an easily deployed, cloud-native reverse proxy. Organizations can use the Formal Connector to understand and control their data. The Connector is deployed as a container in your infrastructure.

Formal's architecture relies on two main parts: the Control Plane and the Connector (the data plane). The Control Plane cannot interact with the Customer's data, only the Connector can.

## Minimal Architecture Diagram

At a minimum, Formal consists of a Connector deployed in your own infrastructure:

```mermaid theme={null}
flowchart LR
    subgraph customer["Your VPC"]
        connector["Formal Connector"]
        database[("Database Resource")]
        ssh["SSH Resource"]
    end

    subgraph formal["Formal VPC"]
        control["Control Plane"]
    end

    connector <--> ssh
    connector <--> database
    control <--> connector
    User <--> connector
```

The Connector needs to have network access to [https://api.joinformal.com](https://api.joinformal.com) (the Control Plane), which is hosted in Formal's infrastructure. This enables you to manage your Connectors via the REST API, Terraform provider, and the Formal console ([https://app.formal.ai](https://app.formal.ai)).

## Satellites

Formal has [three Satellite types](/docs/guides/core-concepts/satellites): Data Classifiers, Policy Data Loaders, and Data Discovery satellites. These satellites also are deployed in your infrastructure.
You may add these satellites if you want to leverage additional functionality in your Connector.
You can deploy any mixture of these three satellites: each satellite should be able to operate without the others.
The data discovery satellite, however, can use the data classifier satellite to be able to perform labelling.

```mermaid theme={null}
flowchart TB
    subgraph customer["Your VPC"]
        connector["Formal Connector"]
        database[("Database Resource")]
        classifier["Data Classifier Satellite"]
        discovery["Data Discovery Satellite"]
        loader["Policy Data Loader Satellite"]
    end

    subgraph formal["Formal VPC"]
        control["Control Plane"]
    end

    connector <--> control
    connector <--> classifier
    discovery <--> classifier
    loader <--> connector
    database <--> connector
    database <--> discovery
```

Do note that the satellites require network access to the Control Plane directly as well.

## Within the Connector

The Formal Connector will interpret network traffic, identify the user, evaluate policies against requests and responses, and potentially call the policy data loader and data classifier satellites to make policy decisions. The Connector also logs and records sessions that are viewable via the Control Plane.

<img src="https://mintcdn.com/formal/fJsHlx-X_b_ATHwb/assets/images/formal_connector.png?fit=max&auto=format&n=fJsHlx-X_b_ATHwb&q=85&s=a0ce589e22c0f53cf9312dd6f0e02e8c" width="2194" height="1016" data-path="assets/images/formal_connector.png" />