At a Glance
| Field | Detail |
| Industry | Financial services technology |
| Region | Europe (Frankfurt), eu-central-1 |
| Engagement | AWS platform design, deployment and validation |
| Environments | Shared Services, Production, Development |
| Core workloads | Model training, inference, streaming analytics, event-driven processing |
| Delivery | Teleglobal International, AWS Partner |
A European financial services company needed a production-grade AWS platform capable of running AI training and inference workloads under strict data residency and security requirements. Teleglobal designed and deployed a three-environment architecture in the Frankfurt region, with isolated networks, workload-specific GPU compute, and twelve security and compliance services active before handover.
Delivered
| Measure | Detail |
| 3 isolated environments | Shared Services, Production and Development, each in its own VPC |
| 4 node group types | CPU, memory, GPU inference and GPU training, scaled independently |
| 12 security services | Configured, integrated and reporting before handover |
| 100% private workloads | No compute exposed directly to the internet |
| 1 jurisdiction | All data, logs and model endpoints resident in Frankfurt |
| Multi-AZ | Every environment spans multiple Availability Zones |
About the client
The client operates an AI-driven financial services platform serving customers across Europe. Its product set spans automated decisioning, document and image processing, and fraud detection, all of which depend on machine learning models running against sensitive customer data.
Growth had outpaced the infrastructure underneath it. The company needed a platform that could train and serve models at scale, satisfy European data residency expectations, and stand up to the security scrutiny that comes with enterprise and regulated customers.
The challenge
Four constraints shaped the engagement, and each one ruled out a simpler answer.
- Data could not leave Europe. Customer data, model training sets and audit logs all had to remain within European jurisdiction, which fixed the deployment region and ruled out any service dependency outside it.
- Development work could not touch production. Model experimentation is iterative and occasionally destructive. Sharing a network with live decisioning workloads was not acceptable, and neither was the cost of duplicating everything.
- AI workloads have two different compute profiles. Training runs are long, heavy and scheduled. Inference is short, latency-sensitive and constant. Running both on the same undifferentiated GPU pool wastes money on one and starves the other.
- Security had to be demonstrable, not asserted. Enterprise buyers and regulators ask for evidence: audit trails, encryption key ownership, threat detection and access records. A platform that cannot produce them stalls at procurement.
Four key architecture decisions
- Environment Isolation – Separate VPCs for Shared Services, Production and Development keep each environment secure and independent.
- Regional Deployment – All workloads, data and logs stay within AWS Frankfurt to support data residency.
- Workload Optimization – Dedicated CPU and GPU resources separate application, inference and training workloads for better performance and cost control.
- Security & Compliance – Encryption, secrets management, logging and compliance controls were built in before handover.
The solution
Compute and containers
Amazon EKS clusters run the containerised workloads in Production and Development, with all nodes inside private subnets. Amazon ECR holds container images with scanning and versioning, so the same validated image is promoted between environments rather than rebuilt. Backend and AI services that were not a fit for containers run on EC2 inside the same private network.
AI and machine learning
Amazon SageMaker Studio provides the notebook environment for experimentation and model development. Amazon Bedrock supplies managed access to foundation models, which lets the team use large models for language and document tasks without operating the serving infrastructure themselves.
Data and analytics
The data layer covers both operational and analytical needs. Aurora PostgreSQL and DynamoDB handle transactional workloads, ElastiCache absorbs read pressure, and Redshift supports analytical queries. Amazon S3 with Object Lock holds training data and artefacts with tamper protection. Streaming runs through Amazon MSK and Kinesis Data Streams, with AWS Glue handling transformation and AppFlow managing ingestion from external systems.
Network and edge protection
Traffic reaches the platform through CloudFront and Route 53, passes AWS WAF rule sets at the Application Load Balancers, and is protected at the network layer by AWS Shield and AWS Network Firewall. Administrative access runs over VPN rather than public endpoints, with Transit Gateway connecting environments where required.
Observability and governance
CloudWatch covers metrics, logs and alarms. AWS X-Ray traces requests across services, and Amazon OpenSearch indexes logs for search and analysis. CloudTrail, AWS Config, Security Hub, GuardDuty, Inspector and Macie run continuously across all three environments, covering audit history, configuration drift, threat detection, vulnerability scanning and sensitive data discovery.
AWS services deployed
| Layer | Services deployed |
| Containers and compute | Amazon EKS, Amazon ECR, Amazon EC2 including GPU instances |
| AI and machine learning | Amazon SageMaker Studio, Amazon Bedrock |
| Databases and storage | Aurora PostgreSQL, DynamoDB, ElastiCache for Redis, Amazon S3 with Object Lock, Amazon EFS |
| Analytics and streaming | Amazon Redshift, Amazon MSK, Kinesis Data Streams, AWS Glue, Amazon AppFlow |
| Networking and edge | Amazon VPC, NAT Gateway, Transit Gateway, VPN, Application Load Balancer, CloudFront, Route 53, PrivateLink |
| Security and compliance | AWS WAF, AWS Shield, Network Firewall, IAM, KMS, Secrets Manager, CloudTrail, AWS Config, Security Hub, GuardDuty, Inspector, Macie |
| Observability | Amazon CloudWatch, AWS X-Ray, Amazon OpenSearch Service |
| Events and automation | AWS Lambda, Amazon EventBridge, Amazon SQS, Amazon SNS, AWS Backup |
Validation and handover
The platform was tested across three dimensions before handover: functional validation that each service performed as designed, security validation that controls were active and reporting, and connectivity validation that routing, VPN access and service-to-service paths worked as architected. Backup jobs were executed and confirmed against EBS, Aurora and S3 rather than assumed from configuration.
Results
| Objective | What was delivered | How it was verified |
| European data residency | Full platform in the Frankfurt region, no cross-border service dependency | Architecture review against the approved design |
| Environment isolation | Three dedicated VPCs with segmented public and private subnets | Connectivity testing across environment boundaries |
| AI workload readiness | Four node group types with separate GPU pools for training and inference | Functional validation of training and inference workloads |
| Security posture | Twelve security and compliance services active and reporting | Security validation and service reporting checks |
| Data protection | Encryption at rest through KMS, S3 Object Lock, centrally managed secrets | Backup jobs executed against EBS, Aurora and S3 |
| Controlled access | Role-based access control with least-privilege IAM, VPN-only administration | Access path testing before handover |
| Operational visibility | Metrics, logs, tracing and search across all three environments | Monitoring and alerting confirmed operational |
The outcome
The client now runs AI training and inference on infrastructure that satisfies European data residency, keeps development away from production, and produces the security evidence enterprise buyers ask for. The architecture leaves room to grow: node groups scale independently, environments are templated, and adding a workload does not require redesigning the network.
About Teleglobal International
Teleglobal International is an AWS Partner that designs and delivers production-grade cloud and AI infrastructure. Working in cloud and IT transformation since 2016, the company supports more than 1.3K clients across BFSI, healthcare, manufacturing and logistics, with delivery from Pune and offices in Mumbai and Gurugram.
To discuss a similar platform build, talk to our team for an architecture review.