Assuming Tragsa is migrating to a hybrid model (on-prem for sensitive data, cloud for burst capacity), here is the recommended architecture: