Plan the Control Path First

SafeSquid becomes a production control only when the proxy is sized, reachable, monitored, and able to preserve enforcement evidence. Poor planning causes dropped sessions, weak audit trails, certificate failures, and emergency routing changes during rollout. This page is the map. Each stage links to the page that carries the detail.

Work the stages in order

Stage	Decide	Detail
1. Architecture	Where traffic is intercepted	Choose an Architecture
2. Scope	What the first deployment must prove	Pilot Versus Production
3. Capacity	What to measure, then what to buy	Resource Planning, Sizing
4. Network	Which ports and endpoints, to which scopes	Ports and Firewall Rules
5. Evidence	How long logs survive, and who owns them	Log-Retention Planning
6. Licence	Which tier the design assumes	Licensing Requirements
7. Readiness	Everything confirmed before an installer runs	Deployment Checklist

Decisions made out of order tend to be remade. Sizing before the architecture is chosen, or policy design before the licence tier is settled, produces rework that surfaces during rollout rather than during planning.

Choose the deployment scenario

Choose new appliance deployment

New VM or hardware appliance

Use the Appliance Builder when a dedicated disk and bootable ISO workflow are approved.

Confirm the appliance has approved CPU, RAM, disk, NIC, and rebuild ownership.If the disk cannot be dedicated, choose cloud or managed Linux instead.

Choose cloud or hybrid egress

Cloud or hybrid egress

Use cloud deployment when security groups, route tables, snapshots, and egress paths are owned.

Confirm security groups, routes, snapshots, and egress paths have named owners.If egress ownership is unclear, pause deployment until network ownership is assigned.

Choose managed Linux server

Existing managed Linux server

Use Linux install only when OS hardening, dependencies, monitoring, and rollback are already owned.

Confirm OS lifecycle and rollback are approved by the server owner.If dependency drift is likely, use Appliance Builder for a cleaner baseline.

Choose cluster or DR design

Cluster or DR design

Add HA or DR planning when uptime requirements need failover, configuration sync, and tested restore.

Confirm RTO, RPO, failover, restore, and configuration-sync requirements are documented.If HA ownership is missing, keep the first deployment single-node until DR controls are approved.

Capture planning evidence

Store these artifacts before installation begins:

Sizing worksheet or change record.
Network placement diagram.
Firewall and routing approval.
Log retention target.
Activation key storage reference.
Rollout and rollback plan.
DR or rebuild assumptions.

Detailed evidence lists live with each stage. This is the set that must exist before an installer runs.

Troubleshoot planning gaps

Symptom	Likely cause	Fix
Sizing cannot be approved	User, throughput, or inspection scope is unknown	Run a pilot and record peak concurrent connections; see Resource Planning
Logs cannot be retained	Disk or SIEM ownership is unclear	Assign a retention owner and capacity target; see Log-Retention Planning
HTTPS rollout stalls	Root CA deployment path is missing	Choose GPO, MDM, or approved manual trust deployment before enabling inspection
HA design is unclear	Failover and synchronization requirements are undefined	Document routing, health checks, same-key activation, and restore steps
Decisions keep being revisited	Stages were worked out of order	Return to the stage table above and settle architecture before capacity

Next steps

Choose an Architecture - start here for a new deployment.
Deployment Checklist - convert the plan into install readiness checks.
Production-Readiness Checklist - the condition the deployment must eventually meet.

Getting started

Plan and prepare

Deploy locally

Deploy on cloud

Connect clients

Activate your license

Deployment modes

Scaling and high availability

Backup and disaster recovery

Performance and capacity

Validate the deployment

Upgrade SafeSquid

Deployment Overview

Plan the Control Path First

Work the stages in order

Choose the deployment scenario

New VM or hardware appliance

Cloud or hybrid egress

Existing managed Linux server

Cluster or DR design

Capture planning evidence

Troubleshoot planning gaps

Next steps

​Plan the Control Path First

​Work the stages in order

​Choose the deployment scenario

New VM or hardware appliance

Cloud or hybrid egress

Existing managed Linux server

Cluster or DR design

​Capture planning evidence

​Troubleshoot planning gaps

​Next steps

Plan the Control Path First

Work the stages in order

Choose the deployment scenario

Capture planning evidence

Troubleshoot planning gaps

Next steps