End-to-end flows between Serval and Customer applications
The diagram below highlights system boundaries, data transmission paths, and key security controls within Serval. Hover over a component to isolate its flows, or over a line to trace it. Customer applications are provided as examples only — Serval can be connected with as many or as few external applications as needed.System boundaries, data transmission paths, and security controls within Serval
Hybrid self-hosted deployments
In a Hybrid Self-Hosted deployment the Credential Proxy runs on the Serval worker inside your own infrastructure. Integration credentials live in a Kubernetes Secret on that worker and never leave your network. The worker opens an outbound HTTPS connection to Serval Cloud; the workflow engine sends it signed integration requests, the worker injects the credential and makes the call, and the result flows back. Everything else — the web app, the workflow engine, inbound webhooks, and application storage — stays in Serval Cloud.Hybrid self-hosted: the Credential Proxy and integration credentials live on your worker