Technology partner
Secure connectivity for your Databricks platform and AI workloads
The lakehouse is live, but the plants, the partners and the company you just acquired still can't reach it. Each one means VPN hardware at the site, firewall rules at both ends and another round of questions from the auditors, so the migration stalls on the network. TechFabric builds and runs the platform on Databricks, and GABRL carries the data to it over an encrypted tunnel that exists only for the session.
TechFabric is a GABRL partner. We build Databricks platforms, AI agents and custom software, and GABRL by DEVIS connects them to the sites, partners and systems they depend on over zero-trust, post-quantum tunnels that exist only for the session. GABRL is a product of Development Infostructure (DEVIS). GABRL on devis.com
The problem
Where data projects stall
The platforms we build pull data from every part of the business. Getting that data across sites, partners, acquisitions and factory floors is usually where the project slows down, and the platform is rarely the reason.
VPN sprawl
Site-to-site VPNs mean hardware at every location, firewall rules at both ends, and a standing connection that stays open to attack long after the pipeline that needed it has finished.
Detours through a vendor cloud
Cloud security brokers route your traffic through their own infrastructure. Every pipeline run pays the extra hop, and your data crosses a network you don't run.
Plant data stuck behind the firewall
Plant-floor telemetry is the data operations wants most and the data security teams are most reluctant to expose. So it stays in a historian and never reaches the platform.
The auditor's question
HIPAA, PCI and CMMC reviews all ask who could have seen this data in transit. A connection that is always open makes that a hard question to answer cleanly.
The joint solution
What each company does
The platform and the software on it
Senior engineers, embedded in your team, building the platform, the agents and the products your business runs on.
- Lakeflow pipelines and Unity Catalog governance on Databricks
- AI agents and models that act on governed data
- Custom software, APIs and durable workflows on Temporal
- 80 Databricks-certified engineers, embedded in your team
The secure transport
A zero-trust network overlay with post-quantum cryptography and no hardware to install.
- Direct peer-to-peer IPsec tunnels with AES-256-GCM, and no vendor cloud in the path
- Post-quantum key exchange and signatures on every session (ML-KEM-1024 and ML-DSA-87)
- Keys and certificates made for one session, held in memory, then discarded
- A control plane in your own cloud or data centre that never sees your traffic
How it works
How a GABRL session works
Once a session ends there's nothing left open for an attacker to find, and no certificate worth stealing. The steps below follow DEVIS's own description of GABRL.
- 01
Authenticate
Each endpoint proves its identity to the control plane, and policy decides which peers it may reach. Until that authentication succeeds, a GABRL endpoint answers nothing at all, so a scan finds no open port to probe.
- 02
Certify
A certificate is generated for this session only and signed with ML-DSA-87, a post-quantum signature scheme. It's never reused, so there's nothing to replay later.
- 03
Connect
The two endpoints open a direct peer-to-peer IPsec tunnel with a hybrid post-quantum key exchange, then encrypt the data with AES-256-GCM. Traffic goes straight between them, with no proxy or broker in the path.
- 04
Move the data
Pipelines, file transfers and queries run over the tunnel, encrypted at Layer 3 beneath the applications. Each end runs a GABRL endpoint, and DEVIS says the applications need no code changes.
- 05
Close
When the session ends, its keys and certificate are discarded. Nothing is left standing for anyone to find, and the next transfer starts again from step one.
Fits your stack
How it sits beside your security stack
GABRL is an overlay. It adds a short-lived, quantum-resistant transport layer for the flows that need it and leaves your inspection and access tools where they are.
In a new environment
New plants, new ventures and new data platforms can start with GABRL as the connectivity layer from the first day. There's no VPN hardware to buy and no firewall rules to write, so there's nothing old to unwind later.
Alongside an SSE you already run
Keep Zscaler, Netskope or your SSE for internet access, inspection and data loss prevention. GABRL carries the flows those tools handle badly, such as plant telemetry going to the cloud, partner data exchange and acquisition onboarding, directly between the two ends and outside any vendor cloud.
Where it fits
Six data flows into the platform
On the platform side, each of these is the same data integration and Unity Catalog work we already do. GABRL changes how the data gets there.
Branch and plant ingestion
Every location lands its data in the lakehouse with no VPN appliance to buy and no firewall ticket to wait on.
Machine telemetry
Production-floor and IoT data reaches the platform while the OT network stays isolated and unreachable from outside.
Acquisition onboarding
An acquired company's systems connect to your platform without merging the two networks, and disconnect just as cleanly if the deal changes.
HIPAA-regulated data
Patient data moves between facilities and into analytics over tunnels that leave no standing connection behind.
Partner data exchange
Data shared across organisations, with policy deciding which partner endpoints may reach which sources, and no permanent link between the two networks.
Inside your own boundary
The control plane and every endpoint run in your own cloud or data centre, and DEVIS describes GABRL as following NIST SP 800-207 for zero trust.
Beyond Databricks
AI agents and the software around the platform
GABRL works at the network layer and, according to DEVIS, needs no code changes in the applications that use it. So the tunnel that carries a pipeline can carry any application traffic, and these are the places in the rest of our work where we'd reach for it.
Agents that reach private systems
An agent that calls tools on an ERP, a database or an internal API usually forces a choice between exposing that system and leaving the agent blind. We'd route each agent's tool calls over GABRL to only the systems its policy allows, and the targets stay unreachable to everything else.
Agentic AI development
Models on the plant floor
A model running beside a production line, in a clinic or on a vehicle has to send results back and take updates. GABRL runs on x86 and ARM, so we'd connect the device to a gateway or a model endpoint in your own network without a connection that stays open between runs.
Machine learning
Products that connect to customer systems
A product that has to read each customer's on-premises database usually means one VPN per customer and a network review per deal. We'd put a GABRL endpoint beside the customer's system, so onboarding a customer becomes one install and a policy change.
Platform and SaaS development
Integrations with an ERP still on-premises
Plenty of ERPs still run in a data centre. We'd land a GABRL tunnel from the ERP on an integration host in your own cloud, which then talks to the hosted services, so reporting and a move to the cloud can start without opening the ERP to the internet.
ERP integration
Workflows that cross networks
A Temporal workflow often has steps that call a system in another network, such as a lender's core platform or a warehouse controller. We'd give those calls a direct, short-lived path over GABRL, and Temporal retries the step if a session drops.
APIs and durable systems
Migrations that move in waves
Halfway through a migration, the applications already in the cloud still need the databases left in the data centre. GABRL can carry that traffic for the months the two halves run side by side, with no site-to-site VPN to tear down afterwards.
Cloud migration
Engagement model
From assessment to production in three phases
The first real flow is running in the pilot about six weeks after we start.
- Phase 1
Connectivity assessment
2 weeks, fixed fee
We inventory your data sources, network paths and compliance obligations, pick the flows GABRL should carry first, and finish with a written rollout plan.
- Phase 2
Pilot
4 weeks
One real flow, usually a plant, a partner, an acquisition or an agent's tools, connected end to end into your Databricks workspace or the system it serves, with performance and policy tested on it.
- Phase 3
Production rollout
Scoped per estate
The remaining sources onboarded in waves, the policy handed to your team as code, and runbooks your own people can operate after we leave.
FAQ
GABRL and TechFabric: common questions
What is GABRL?
GABRL is a post-quantum zero-trust network overlay made by DEVIS. It opens a direct, encrypted peer-to-peer tunnel between two endpoints for the length of one session, then discards the keys and certificate. It's software only, running on bare metal, a virtual machine or a container, on x86 or ARM.
Is GABRL only for Databricks workloads?
No. GABRL works at the network layer and, according to DEVIS, needs no code changes in the applications that use it, so the same tunnel carries an agent's tool calls, a SaaS product's connection to a customer system or an ERP integration as readily as a pipeline.
Where does the GABRL endpoint sit on the Databricks side?
We'd put it inside the network your classic Databricks compute already runs in, or a network peered with it, so pipelines on that compute reach their sources through it.
Serverless compute runs on Databricks-managed infrastructure where you can't install an endpoint, so a flow that has to travel over GABRL lands on classic compute or a gateway in your network first. The assessment decides which flows that applies to.
Does GABRL replace our VPN or our SSE platform?
It doesn't replace a secure service edge. Keep Zscaler, Netskope or your current SSE for internet access, inspection and data loss prevention. Where we'd start is the site-to-site VPN traffic that only exists to move data to the platform, such as plant telemetry, partner exchange and acquisitions, because those are the flows the SSE tools handle worst.
What does post-quantum mean here?
Every GABRL session uses ML-KEM-1024 (FIPS 203) for key exchange and ML-DSA-87 (FIPS 204) for signatures in a hybrid exchange, then AES-256-GCM for the data. Those are the NIST standards designed to hold up against a future quantum computer, which matters for data that someone could record in transit today and try to decrypt years from now.
Does our data pass through DEVIS or TechFabric?
No. The tunnel runs directly between your source and your platform. According to DEVIS, the GABRL control plane runs in your own cloud or data centre and never sees or routes application traffic, even if it were compromised, and endpoints keep talking to authorised peers if the control plane is unreachable.
How long until the first data flow is live?
The connectivity assessment takes two weeks and the pilot takes four, so the first real flow is running in the pilot about six weeks after we start. The rest of the estate is scoped from the assessment and onboarded in waves once the pilot has shown the flow holds up.
Talk to an engineer about your first flow
Bring the sites and the compliance questions. A senior engineer will work through which flows to move first and where the control plane should run.