> ## Documentation Index > Fetch the complete documentation index at: https://docs.e6data.com/llms.txt > Use this file to discover all available pages before exploring further. # Architecture > How a Serverless e6data deployment on Azure works - managed compute in e6data's subscription, your ADLS Gen2 data read keylessly via Workload Identity. In a **Serverless** deployment on Azure, e6data runs and manages the compute. You grant e6data read-only, keyless access to your data; everything else is handled by the platform. Azure Serverless deployment architecture ## Where things run Compute runs in the **e6data-managed Azure subscription** (AKS across three availability zones). A public load balancer fronts ingress (HTTPS / gRPC, with SSO and JWT), and engine egress leaves through a NAT gateway. Your **ADLS Gen2** storage is reached **read-only** via Workload Identity / OIDC federation - no keys are stored. The platform syncs releases and status with the Control Plane at `app.e6.run`. ## Where your data lives Your data stays in **your Azure account**. e6data does not copy or move it - the engine reads directly from your ADLS Gen2 storage using a federated identity you grant, with only the **Storage Blob Data Reader** role. You can revoke access at any time by removing the role assignment. ## The two planes | Plane | What it does in a Serverless deployment | | - | - | | Control Plane | The shared e6data Console where you manage your organization, workspaces, account, and billing. | | Compute Plane | The per-workspace environment (opened with **Open**) where you manage catalogs and clusters and run queries. The compute is managed by e6data. | ## See also * [Configure Azure access](/platform/deploy/azure-serverless/configure-azure-access) * [Deployment models](/platform/deployment-models) * [FAQs](/platform/deploy/azure-serverless/faqs) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.