Kamba — Symphony
Deployment Architecture
Kamba operates exclusively within Symphony's approved infrastructure perimeter — isolated from Symphony's own internal systems, and isolated from the outside world. Nothing enters. Only user-initiated, allowlisted data queries leave.
Kamba operates exclusively inside Symphony's AWS VPC — the same infrastructure Scotiabank has already reviewed, approved, and deployed. It is isolated in two directions simultaneously: inward, with no lateral access to Symphony's own databases, services, or core infrastructure; and outward, with no access to any system outside Symphony's VPC except user-initiated, explicitly allowlisted data provider endpoints. Kamba cannot reach Scotiabank's internal network, the public internet, or any other environment independently. It accepts zero inbound connections. All egress is user-initiated and governed by Symphony's own network controls.
Symphony's AWS VPC.
WSS:// · outbound
No data persists beyond a single request lifecycle. All scratch files, query data, and results are wiped automatically. No external volumes or persistent storage attached.
by design, not by configuration.
Outbound: port 443 allowlist only
endpoints only
Symphony core infrastructure
of all network traffic
Contained entirely within Symphony's perimeter.
Kamba Engine opens an outbound WebSocket (WSS) to Symphony Messaging to receive and respond to user queries. This connection stays entirely within Symphony's VPC. No inbound connections are accepted by the container.
The only traffic that leaves Symphony's VPC is outbound HTTPS to data providers explicitly connected by the user. No provider is reachable without a deliberate user action to connect it. Every active endpoint is enforced at the Security Group and Network ACL layer — no other external destination is reachable.
Transient storage is scoped to individual request lifecycles. No PII, query data, or results survive beyond a single message. Nothing is written to external storage.
Kamba is isolated from Symphony's own internal systems (no lateral access to Symphony databases, services, or core infrastructure) and from everything outside Symphony's VPC (no independent access to Scotiabank's internal network, the public internet, or any unapproved destination). The container exists in its own sealed subnet with no path in or out except what is explicitly defined.
Kamba works with any institutionally approved LLM. The model receives only the user's natural language query — never the underlying data. Data retrieval, validation, and synthesis happen entirely within Kamba's engine inside Symphony's VPC. The LLM interprets intent; it never sees or processes client data.
Egress from the container flows through Symphony's own Security Groups and Network ACLs. Scotiabank's approved vendor controls are enforced at the network layer on every connection Kamba makes — internal connectors are read-only and admin-provisioned; external connectors are user-connected with no provider active by default.
trusted secure messaging infrastructure.
Symphony Communications is purpose-built for regulated financial institutions — banks, asset managers, broker-dealers — where data confidentiality is non-negotiable. Scotiabank has already completed its vendor due diligence and approved Symphony as a platform. Kamba runs entirely within that approved perimeter, inheriting its security architecture by design.