Infrastructure architecture
ReferenceDeployment trust boundaries
Customer SAP, customer Azure, and Skynome SaaS are separate ownership planes. Business payload stays customer-controlled. Only sanitized evidence is pushed outward.
Architecture diagram
Default route: 1 select → 4 extract → 7 log · 2 land → 5 observe → 8 outbound · 3 queue → 6 score → 9 portal
Data or evidenceIdentity or control
Callout 1
ECC or S/4HANA
Customer-owned data
SAP decides what leaves. Azure credentials are excluded by the default design.
Need this architecture for your internal review?
Request an editable .drawio source stencil for internal architecture validation.
Detail
Solid teal is data or evidence. Dashed grey is identity or a control dependency. Arrow 1: business payload remains customer controlled. Arrow 2: sanitized evidence is pushed outward.
- SFTP TCP 22 — file collection, restricted account, verified host key
- HTTPS 443 — SAP→CPI (MDG), CPI→Azure landing, SHIR→ADLS, Connector→Azure APIs, Connector→Skynome ingest
- No inbound ICM from the internet to SAP
- No connector → SAP authentication path
- Azure secrets on S/4 by default
- Governance connector holding SAP credentials
- Business PII in GRS telemetry payloads
- ODP-RFC / RODPS_REPL_* in Skynome patterns