Cloud-native Master Data Management SaaS architecture spanning customer on-premises estates, managed cloud, and bring-your-own-cloud (BYOC) edge deployments with zero-trust network segmentation. Data flows from customer sources through inbound connectors to a mastering engine performing standardization, matching, and merging, then to outbound connectors and downstream targets, with encryption and key management anchored in customer-owned KMS/HSM. The SaaS control plane remains multi-tenant and customer-data-free, handling only API gateway, identity brokerage, federation governance, and orchestration via REST/GraphQL endpoints. Network isolation uses dedicated VLANs for data plane agents (172.16.20.0/24) and control plane (192.168.30.0/24), with customer firewalls, VPN gateways, and edge routers enforcing trust boundaries. This architecture solves the critical MDM challenge of maintaining data sovereignty while enabling cloud-scale processing, demonstrating hybrid-cloud best practices for regulated industries. Fork this diagram on Diagrams.so to customize network ranges, add region-specific deployments, or integrate your identity provider and KMS endpoints. Consider adding explicit encryption zones and audit logging paths for compliance-heavy use cases.