Documents and data
Hybrid integration of an on-premises ERP
The on-premises ERP exchanges data with cloud services through a secure channel and a queue, without opening it to the internet.
Fictional scenario. An example situation that illustrates the approach. It is not a client project and describes no measured results.
Business problem
A fictional company runs its ERP on its own server while new applications are in the cloud. Integrations are nightly scripts nobody monitors.
Assumptions
- The ERP has a database or an API for reading.
- An outbound VPN or private link is possible.
- There is a cloud subscription.
Constraints
- The ERP is never exposed publicly.
- Nightly scripts are replaced gradually.
- No change to the ERP schema.
Reference architecture
Components by stage — an illustration, not a running system and not a certified design.
01Source
- On-premises ERP
- Integration agent
02Channel
- Private link or VPN
- Message queue
03Processing
- Transformations
- Validation
04Target
- Cloud services
- Data warehouse
The diagram as a list
| Stage | Components |
|---|---|
| Source | On-premises ERP, Integration agent |
| Channel | Private link or VPN, Message queue |
| Processing | Transformations, Validation |
| Target | Cloud services, Data warehouse |
Interfaces
| From | To | Via |
|---|---|---|
| ERP | Agent | Change reads |
| Agent | Queue | Outbound TLS connection |
| Queue | Cloud services | Subscription |
Data flow
- The agent reads changes from the ERP.
- It publishes events to the queue.
- The cloud side validates and transforms.
- Errors go to a separate queue.
- Monitoring tracks delays.
Security boundaries
- Outbound connections only from the local network.
- Certificates and keys in a secrets store.
- Minimal read permissions in the ERP.
Where a person approves
- A new data flow is approved by the data owner.
- Writing back to the ERP — only by explicit decision.
Delivery phases
01 · Discovery
Flows, volumes and windows.
02 · Pilot
One read-only flow.
03 · Migration
Replacing scripts one by one.
04 · Operation
Delay and error monitoring.
Limitations
- Depends on the stability of the link.
- Old ERP versions limit change reads.
Trade-offs
- Queue vs direct calls — resilience vs simplicity.
- Gradual migration — longer but safer.
Related services
Related assessments
Integration patterns used
Facing something similar?
We start with an assessment of where you are and propose a realistic first phase.