Outbound only
Every agent keeps one WebSocket to BridgeStick over HTTPS on port 443. HTTPS_PROXY is honored; nothing listens on the agent's machine.
Links
Reach private networks without opening a port.
A link is one of your private networks: a plant, a data center, a VPC. Install the BridgeStick agent there with one command. It dials out over HTTPS, runs the work next to your SAP system or database, and never lets your rows cross BridgeStick.
Your network
SAP
SQL Server
PostgreSQL- Files
Rows are read and written here
BridgeStick agents
bridgestickdPrimary
bridgestickdStandby
bridgestickd · two or more for high availability
Firewall: no inbound port
Outbound HTTPS · port 443
BridgeStick cloud
- Plans and schedules
- Monitors and alerts
- Gets counts, cursors, progress and errors
How a link works
Four steps, one command.
- 01
Create a link and an auth key
In BridgeStick, add a link for the network and an auth key: one-off or reusable, with an expiry, pre-approved or not.
- 02
Run one command there
On a machine inside the network:
curl … | sh,apt install bridgestickor PowerShell. The agent joins the link and dials out. - 03
Allow what it may reach
bridgestick allow add sap.corp.local:44300— hosts, networks, ports and folders. Until you add a rule, it reaches nothing. - 04
Pick the link as the network
Choose the link as the Network of a source or a destination. Its connections now run in the agent, next to the data.
Remote execution
The work runs where the data is.
BridgeStick resolves the plan and keeps cursors, checkpoints and job state; the agent reads the source pages and writes them to the destinations itself, returning only counts, cursor values, the next position and any write errors.
| Connection | Who moves the data | Data through BridgeStick |
|---|---|---|
| Private → private (one link) | The agent, inside the network | None |
| Private → public | The agent writes directly | None |
| Public → private | The agent reads directly | None |
| Public → public | BridgeStick's cloud | The rows written |
| Data API or Explore of a private source | Agent → BridgeStick → your client | The rows served |
| Comparison of a link's connection | Agent → BridgeStick | The rows compared |
Ends in two different private networks cannot share one connection: their rows would have to cross BridgeStick. Use ends of one link, or two connections.
Built in
Everything a link needs to be trusted.
Signed identity
On joining, the agent makes its own key, which never leaves its machine. Every connection proves it afresh: no password or token travels after that.
Auth keys your way
One-off or reusable, with an expiry, pre-approved or waiting for approval, ephemeral or not. A spent or revoked key joins nothing.
Approval and revocation
Approve each new agent, or revoke one: its session closes at once. Ephemeral agents are removed when they go offline.
High availability
Several agents per link. The one connected longest is the primary; when it drops or misses three heartbeats, 15 seconds apart, the next takes over.
Allow lists on the agent
Before a connector opens, every host and port it will reach is resolved and checked against the agent's own list. Anything else is refused.
Live usage and cost
See what each link moved inside the network and through BridgeStick, and the estimated egress cost, day by day.
A link down is not a source down
When no agent is connected, its sources show the link as offline: they do not trip the circuit breaker, and you are told once when it goes and once when it is back.
Why not a VPN?
A link is not a tunnel. That is the point.
A VPN or a tunnel carries traffic between networks. A link carries orders: the agent does the work where it stands.
| Aspect | VPN or tunnel | BridgeStick link |
|---|---|---|
| Firewall | An inbound port or a site-to-site agreement | Outbound HTTPS only |
| What is reachable | Whole subnets, by network rules | Only the hosts, ports and folders on the agent's allow list |
| Data path | Every row crosses the tunnel | Rows stay inside the network |
| Egress | Paid on every byte that leaves the cloud | Next to none: a few tens of MB a month of control traffic |
| TLS | To a forwarded address, where certificate names may not match | To the real host name: certificates check as anywhere |
| Availability | One gateway, unless you build more | Several agents, automatic failover |
FAQ
About links.
- Do I need to open a port in my firewall?
- No. The agent only makes outbound HTTPS connections, on port 443, to BridgeStick. Nothing listens on its machine, and an HTTPS proxy is used when
HTTPS_PROXYnames one. - What happens when an agent goes down?
- With two or more agents on a link, the next one takes over: the primary is the agent connected longest, and when it disconnects or misses three heartbeats (15 seconds apart), new calls go to the next. A read in flight is tried again, and a sync continues from its last checkpoint on its next run.
- Can BridgeStick reach anything else in my network?
- No. Each agent enforces its own allow list — hosts, networks, ports and folders you add with
bridgestick allow add— and it starts empty. A connector whose targets are not on the list is refused, whatever BridgeStick asks. - Which systems can run the agent?
- Linux (x86_64 and ARM64), macOS on Apple silicon and Windows (x64). It installs with
curl … | sh, from BridgeStick's signed apt repository on Debian and Ubuntu, or with PowerShell, and runs as a service: systemd, launchd or a Windows scheduled task. - How is an agent identified?
- By a key it makes when it joins, which never leaves its machine. BridgeStick keeps only the public half; each connection proves the agent holds the key, and revoking the agent closes its session at once.
Bridge your data with nothing bent on the way.
Create your space, connect a source and run your first sync — free during early access. When your systems are private, an agent is one command away.