Skip to main content
Virtual Data Platform

A virtual layer over the systems you already have.

Virtual Data Platform routes every request through a validated, per-user path to the source and streams results back — live, governed and across networks. The interactive diagram shows the full request lifecycle.

Virtual Data Platform architectureHow a query travels from your tools through the Azure platform to data at your locations and back.Your toolsPlatform (Your tenant)Your locationsissues tokensvalidates tokenEntra IDyour identity providerExcel Add-inR packagePython packagePower BIODataAI via MCPUniversal ConnectorDispatchermodeling logicRPythonPer-user sandboxready in <100 msone isolated sandbox per user — many run in parallelMessageQueueAgentProxy · gRPCbidirectional gRPC stream— connected outbound by the AgentYour HQAgentSAP BWSAP HANASQL ServerYour subsidiaryAgentSnowflakeSalesforceSharePointWorkday+ moreYour toolsExcel · R · Python · Power BI · OData · MCPPlatform (Your tenant)Entra IDDispatcherPer-user sandboxready in <100 msmodeling logic · R · PythonYour locationsAgentoutbound onlyno inbound firewall rulesSAP · Snowflake · SharePoint · + more
  • TLS on every connection
  • end-to-end encrypted
  • outbound only — no inbound rules
Every request carries a Microsoft Entra ID token — your identity provider remains the root of trust. The Dispatcher validates the token and the request, then provides a private sandbox. The platform routes it to the Agent at the right one of your locations; the Agent — connected outbound only — translates the user's identity to whatever the source speaks (SAP Logon Ticket, SAML, legacy credentials), queries the system and streams results back end-to-end encrypted into the user's sandbox — one of many running in parallel, one per active user. The sandbox is the brain of the request: it executes the modeling logic and combines data across systems in a secure in-memory database at memory speed. For the Portal, the Excel add-in, R and Python, that encryption extends all the way into the client. Nothing is written to disk. Nothing is exposed. Your HQ runs SAP BW, SAP HANA, SQL Server, each connected through its Handler to the Agent, which holds one outbound gRPC stream to the platform. Your subsidiary runs Snowflake, Salesforce, SharePoint, Workday, each connected through its Handler to the Agent, which holds one outbound gRPC stream to the platform.

Virtual data layer

Datasets and Models are defined once and executed at the source on demand — nothing is persisted on the platform.

Real-time access

Requests hit the live source system; only the relevant data is retrieved, with pass-through filters pushed down.

Distributed & cross-network

Agents at each location connect outbound; the platform never reaches into your networks.

Security by architecture

The shape of the system is itself a security control. These properties are inseparable from the architecture — not features bolted on afterwards.

  • Outbound-only Agents

    Agents connect outbound and wait for work — there are no inbound ports to open in your firewall.

  • Per-user sandboxes

    Every request runs in a private sandbox that spins up on demand and is torn down after. Isolation is the default, not a setting.

  • No data at rest

    Results are combined in memory and never written to disk — there is no second copy to breach, govern or audit.

  • Per-tenant endpoints

    Every customer connects through their own tenant endpoint — a visible isolation boundary, not a shared door.

  • Encrypted in transit

    Payloads are encrypted end-to-end; the decryption key is generated in your client and never leaves it.

Security by architecture — see the full mechanism How Agents reach across networks

See your own data live in 30 minutes.

Start with a live demo — we'll show your use case in Excel, Power BI, R, or through an AI assistant. Then take it further with a free trial in your own isolated tenant.

Book a live demoRequest free trial
Virtual Data Platform