My company has strict data privacy laws, so our vectors must stay on local hardware. Can I host Qdrant in our local data center but connect to it from a web app hosted on Azure? What are the security implications for this kind of hybrid cloud setup?
3 answers
Yes, this is entirely possible, but you need a robust networking strategy. You should look into setting up a Site-to-Site VPN or a dedicated circuit like Azure ExpressRoute to ensure the connection between your Azure frontend and the on-prem Qdrant instance is encrypted and stable. From a security perspective, you must ensure that the database is not exposed to the public internet. Use mutual TLS (mTLS) for authentication to ensure that only your specific application can communicate with the vector store. Additionally, consider the latency; if your data center is far from the Azure region, your search UI might feel sluggish.
Have you verified if the egress costs from your local data center will be a concern given the size of the vector payloads?
Just use a reverse proxy like Nginx in front of your database to add an extra layer of security and logging.
Danielle is right. Nginx can also help with basic load balancing if you eventually decide to run a cluster of nodes on your local hardware.
We have a flat-rate contract with our ISP, so egress isn't the main issue, but I am worried about the bandwidth for large batch uploads. If we re-index 100,000 vectors, the pipe might get choked. We are looking into scheduling those updates during off-peak hours to avoid impacting the live search performance for our internal staff.