Architecture

PAM uses a proxy-based architecture. Nothing connects directly to your databases or servers: everything goes through the Gateway. This keeps your infrastructure isolated while providing secure, auditable access.

Components

Infisical Platform — the control plane. Stores account credentials, manages permissions, and hosts the web interface.

Gateway — a lightweight service you deploy in your private network. It proxies connections to your databases and servers, injects credentials, and records sessions.

Client — a user's browser (Web Access) or the CLI. Connects to the Gateway through an encrypted tunnel. An AI agent connects through the CLI, which holds the tunnel on its behalf.

Actor — the user or machine identity the session belongs to. Permissions, policies, and the audit trail all follow the actor.

How a Connection Works

When an actor connects to an account:

1. Access is requested — a user clicks Launch in the browser, or the CLI command runs
2. Infisical checks permissions — verifies the actor has a membership with the right role
3. Template rules are enforced — MFA, reason requirement, session duration
4. Approval is checked — a gated account also needs an approved access request
5. Connection is established — an encrypted tunnel is created between the client and Gateway
6. Gateway fetches credentials — retrieves them from Infisical
7. Gateway connects to the target — using the credentials
8. Traffic flows through the Gateway — the actor interacts with the database/server
9. Session is recorded — Gateway captures and uploads session activity, attributed to the actor

The actor never sees the credentials. The database/server never sees the actor directly.

Network Security

The Gateway uses outbound connections only:

• No inbound ports — your firewall doesn't need to allow any inbound traffic
• Outbound to Infisical — for credential retrieval and session uploads
• Outbound to your infrastructure — to connect to databases and servers

<Tip> Your databases and servers stay completely isolated from the internet. The Gateway sits inside your network and reaches out; nothing reaches in. </Tip>

Encryption

All connections are encrypted:

• Client to Gateway — end-to-end encrypted tunnel
• Gateway to Infisical — TLS
• Session recordings — encrypted before upload

The Relay server (which routes traffic between clients and Gateways) cannot decrypt or inspect the traffic passing through it.

Recording Architecture

Recording happens at the Gateway:

1. Traffic flows through the Gateway
2. Gateway captures session events
3. Events are encrypted and cached locally
4. Events upload to Infisical in real-time
5. If connectivity drops, recording continues locally and syncs when restored

This ensures no data is lost, even during network issues.

Deployment Options

Setup	Use case
Single Gateway	Small environments, single network
Gateway per network	Multiple VPCs or on-prem segments
Gateway Pool	High availability, load balancing

For deployment instructions, see Deploy a Gateway.

Next Steps

<CardGroup cols={2}> <Card title="Deploy a Gateway" icon="server" href="/documentation/platform/gateways/gateway-deployment"> Deploy a Gateway in your network. </Card> <Card title="Launch Your First Session" icon="rocket" href="/documentation/platform/pam/quick-starts/launch-first-session"> Connect to a database in under 10 minutes. </Card> </CardGroup>