# Managed Dedicated: GCP Architecture

A Managed Dedicated instance on Google Cloud runs in its own VPC network, in a
Google Cloud project that Zuplo manages, in the region you choose. Zuplo
provisions, operates, scales, and upgrades the instance. You don't need a Google
Cloud project to use it, but you need one to connect it to backends in your own
VPC.

For the components that make up every Managed Dedicated instance, see
[Architecture](../architecture.mdx).

## Availability

The gateway runs across multiple zones in your region. If one zone fails, the
other zones keep serving traffic.

To run in more than one region, contact your account manager.

## Inbound traffic

Clients reach the gateway through a public load balancer. Zuplo terminates TLS
and manages the certificates, including for your
[custom domains](../custom-domains.mdx).

To put a CDN or WAF, such as Cloud CDN with Google Cloud Armor, in front of the
gateway, make sure clients can't bypass it and call the gateway directly. Have
the CDN add a shared secret header that the gateway checks, or authenticate the
CDN with
[client mTLS](../../articles/securing-the-gateway-with-client-mtls.mdx).

## Outbound traffic and IP addresses

The gateway reaches the internet through Cloud NAT. By default, these outbound
IP addresses aren't reserved and can change. If your backend or a third-party
API allowlists callers by IP address, ask your account manager to reserve
outbound addresses for your instance before you rely on them.

## Connecting to your backends

The gateway can call any backend it can reach over the internet. To keep backend
traffic off the public internet, use Private Service Connect or VPC Network
Peering. See [GCP Private Networking](./private-networking.mdx).

However your backend is reached, make sure it only accepts requests from your
gateway. See [Securing your backend](../../articles/securing-your-backend.mdx).