Skip to main content
PAM uses a proxy-based architecture. Nothing connects directly to your databases or servers: everything goes through the Gateway. This keeps your infrastructure isolated while providing secure, auditable access.

​
Components

Infisical Platform — the control plane. Stores account credentials, manages permissions, and hosts the web interface. Gateway — a lightweight service you deploy in your private network. It proxies connections to your databases and servers, injects credentials, and records sessions. Client — a user’s browser (Web Access) or the CLI. Connects to the Gateway through an encrypted tunnel. An AI agent connects through the CLI, which holds the tunnel on its behalf. Actor — the user or machine identity the session belongs to. Permissions, policies, and the audit trail all follow the actor.

​
How a Connection Works

When an actor connects to an account:
  1. Access is requested — a user clicks Launch in the browser, or the CLI command runs
  2. Infisical checks permissions — verifies the actor has a membership with the right role
  3. Template rules are enforced — MFA, reason requirement, session duration
  4. Approval is checked — a gated account also needs an approved access request
  5. Connection is established — an encrypted tunnel is created between the client and Gateway
  6. Gateway fetches credentials — retrieves them from Infisical
  7. Gateway connects to the target — using the credentials
  8. Traffic flows through the Gateway — the actor interacts with the database/server
  9. Session is recorded — Gateway captures and uploads session activity, attributed to the actor
The actor never sees the credentials. The database/server never sees the actor directly.

​
Network Security

The Gateway uses outbound connections only:
  • No inbound ports — your firewall doesn’t need to allow any inbound traffic
  • Outbound to Infisical — for credential retrieval and session uploads
  • Outbound to your infrastructure — to connect to databases and servers
Your databases and servers stay completely isolated from the internet. The Gateway sits inside your network and reaches out; nothing reaches in.

​
Encryption

All connections are encrypted:
  • Client to Gateway — end-to-end encrypted tunnel
  • Gateway to Infisical — TLS
  • Session recordings — encrypted before upload
The Relay server (which routes traffic between clients and Gateways) cannot decrypt or inspect the traffic passing through it.

​
Recording Architecture

Recording happens at the Gateway:
  1. Traffic flows through the Gateway
  2. Gateway captures session events
  3. Events are encrypted and cached locally
  4. Events upload to Infisical in real-time
  5. If connectivity drops, recording continues locally and syncs when restored
This ensures no data is lost, even during network issues.

​
Deployment Options

For deployment instructions, see Deploy a Gateway.

​
Next Steps

Deploy a Gateway

Deploy a Gateway in your network.

Launch Your First Session

Connect to a database in under 10 minutes.