> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Networking and security

> Outbound network posture, airgapped operation, privilege model, and data residency.

## Outbound

* Only one destination: `DAG_SHIP_URL` (the Hilt ingest PrivateLink endpoint in your account). Traffic is HTTPS with your CA chain; the endpoint presents an ACM certificate issued against your private zone.
* No DNS leakage to public resolvers is required. The ingest domain is in a private Route 53 zone associated with your VPC, so resolution happens inside your VPC and the TCP path rides the PrivateLink endpoint service to the ingest NLB.
* **Firewall rule:** allow the agent's source CIDR to reach the PrivateLink endpoint on TCP/443. For cross-VPC rollouts the PrivateLink consumer endpoint is the gateway; for same-VPC rollouts traffic is purely intra-VPC.

## Airgapped / offline

* The release includes a static binary and a `docker save`-able image; nothing at runtime fetches updates.
* In file mode (`DAG_SHIP_URL` unset), the agent writes JSONL locally and your existing log shipper takes it from there.

## Privilege model

| Path | Requires |
| :- | :- |
| VM / systemd | Must run as root; systemd unit uses default privileges + `LimitMEMLOCK=infinity` |
| Kubernetes DaemonSet | `securityContext.privileged: true` + `hostPID` + `hostNetwork` |
| Docker standalone | `--privileged` + `--pid=host` |

## Data residency

Events never leave your AWS account. Hilt does not receive, mirror, or have out-of-band access to agent events.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.