Network Security & Connectivity

gateway architecture to ensure secure and predictable communication with external systems that require strict firewall rules, tavio routes all outgoing api traffic through specific regional proxy gateways this architecture allows your clients or third party vendors to whitelist specific ip ranges for ingress traffic without opening their networks to the entire public internet inbound api connections data which is being pushed to tavio environments via e g web hooks are routed through a static set of gateway proxies to ensure that our clients, our platform partners, and our partners' clients are able to maintain static destination ips for their integration data static egress ips the tavio platform uses regional proxy gateways for funneling outbound traffic to its destination thus tavio ensures that the source ip address of your integration requests remains constant, satisfying the security requirements of legacy hris or erp systems that rely on ip based access control lists (acls) the on premises agent for data residing behind corporate firewalls—such as on premises sql databases or internal file servers—tavio utilizes a secure on premises agent this lightweight software component acts as a bridge between the cloud platform and the internal network using a strictly outbound only architecture encrypted tunneling the agent establishes a secure, persistent websocket connection using tls 1 3 over standard tcp port 443 zero inbound ports because the agent initiates the connection from inside the network out to the tavio platform, there is no need to open risky inbound firewall ports or configure complex vpns this design drastically reduces the network's attack surface while allowing your cloud based workflows to interact with on premises data as if it were a modern api sftp security for integrations requiring file based transfers, tavio provides a fully managed, hosted sftp service that is tightly integrated with the platform’s security model granular access control access to the sftp service is governed by directory specific api tokens you can generate credentials that restrict a user or system to specific folders (e g , /inbound only), ensuring that an external system cannot access files outside its designated scope authentication options the service supports both standard basic authentication (username/password) and ssh key authentication, allowing you to enforce higher security standards for automated file transfers directory isolation just as with other data, the file system is isolated per environment credentials created in a staging environment provide access only to that specific environment's directories, preventing accidental data leakage into production