docs(erp-toolkit): remove internal implementation references

- Replace admin script reference with contact-support guidance for
  secure proxy allowlist management
- Replace AWS-specific terms (Lambda, NAT Gateway, S3) with
  customer-facing language (secure proxy, static IP, storage)

Author: Karl Rankla

docs/integrations/erp-toolkit/configuration.md

@@ -124,7 +124,7 @@ curl -X POST 'https://erp-integration.sls.epilot.io/v1/integrations/{integration
 :::info
 - `file_proxy` — On-demand file serving from external document systems. See the [File Proxy guide](./file-proxy).
 - `managed_call` — Synchronous external API calls with JSONata mapping. See [Managed Call Use Cases](#managed-call-use-cases).
-- `secure_proxy` — Route requests through VPC Lambdas for static IP or VPN access. See [Secure Proxy Use Cases](#secure-proxy-use-cases).
+- `secure_proxy` — Route requests through epilot's secure proxy for static IP or VPN access. See [Secure Proxy Use Cases](#secure-proxy-use-cases).
 :::
 
 ### Enabling/Disabling a Use Case
@@ -326,7 +326,7 @@ Secrets must use `{{env.KEY}}` references to resolve values from the [Environmen
 
 ## Secure Proxy Use Cases
 
-Secure proxy use cases route HTTP requests through VPC-deployed Lambda functions for static IP egress or VPN access to customer private networks.
+Secure proxy use cases route HTTP requests through epilot's dedicated proxy infrastructure, providing either a static IP for egress or VPN access to customer private networks.
 
 ### Creating a Secure Proxy Use Case
 
@@ -349,9 +349,9 @@ curl -X POST 'https://erp-integration.sls.epilot.io/v1/integrations/{integration
 
 | Field | Required | Mutable | Description |
 |-------|----------|---------|-------------|
-| `vpc_mode` | Yes | No (immutable) | `"static_ip"` (NAT Gateway for fixed outbound IP) or `"secure_link"` (VPN for private networks) |
-| `allowed_domains` | No | Admin only | Array of allowed domain patterns. Supports exact match and wildcard prefix (e.g., `*.example.com`). Managed via admin script only. |
-| `allowed_ips` | No | Admin only | Array of allowed IP ranges in CIDR notation (e.g., `10.0.1.0/24`). Required for `secure_link` mode. Managed via admin script only. |
+| `vpc_mode` | Yes | No (immutable) | `"static_ip"` (fixed outbound IP) or `"secure_link"` (VPN for private networks) |
+| `allowed_domains` | No | Read-only | Array of allowed domain patterns. Supports exact match and wildcard prefix (e.g., `*.example.com`). Managed by epilot support. |
+| `allowed_ips` | No | Read-only | Array of allowed IP ranges in CIDR notation (e.g., `10.0.1.0/24`). Required for `secure_link` mode. Managed by epilot support. |
 
 ### Sending a Proxy Request
 
@@ -374,7 +374,7 @@ curl -X POST 'https://erp-integration.sls.epilot.io/v1/secure-proxy' \
 
 - **Domain whitelist**: Controls which hostnames the proxy can reach. Wildcard patterns must have at least 2 suffix labels (e.g., `*.example.com` is valid, `*.com` is rejected).
 - **IP allowlist**: Controls which IP addresses are permitted in `secure_link` mode using CIDR notation. Validation is applied both at the URL level (direct IP targets) and DNS level (resolved IPs must match).
-- Both fields are read-only in the API and can only be managed via the admin script (`scripts/manage-secure-proxy-whitelist.ts`).
+- Both fields are read-only in the API. To add, remove, or change allowed domains or IP ranges, contact epilot support.
 
 ### Security
 
@@ -384,7 +384,7 @@ curl -X POST 'https://erp-integration.sls.epilot.io/v1/secure-proxy' \
 | Domain whitelist | Optional | Required |
 | IP allowlist | N/A | Required |
 | Request size limit | 4 MB | 4 MB |
-| Timeout | 25s (VPC Lambda) / 30s (API Gateway) | 25s (VPC Lambda) / 30s (API Gateway) |
+| Timeout | 30s | 30s |
 
 ## Event Configuration
 

docs/integrations/erp-toolkit/file-proxy.md

@@ -283,7 +283,7 @@ If a JSONata expression produces a string result (e.g., for `filename` or `conte
 
 ## VPC Routing
 
-Some external systems require requests to come from known static IPs (IP allowlisting). Set `requires_vpc: true` to route all HTTP requests through a VPC-deployed proxy Lambda with static outbound IPs via NAT gateway.
+Some external systems require requests to come from known static IPs (IP allowlisting). Set `requires_vpc: true` to route all HTTP requests through epilot's secure proxy with a fixed, allowlistable outbound IP.
 
 ```json
 {
@@ -299,9 +299,9 @@ Some external systems require requests to come from known static IPs (IP allowli
 ```
 
 When VPC routing is enabled:
-- All step HTTP requests are forwarded to the VPC proxy Lambda
-- The VPC proxy makes the actual outbound call from a static IP
-- Large responses (>4.5 MB) are automatically transferred via S3
+- All step HTTP requests are forwarded through the secure proxy
+- The secure proxy makes the actual outbound call from a static IP
+- Large responses (>4.5 MB) are automatically transferred via a short-lived, presigned download URL
 
 ## Credentials and Secrets
 
@@ -390,11 +390,11 @@ See the [Inbound Mapping Specification](./inbound/mapping#file-proxy-url-mapping
 
 ## Large File Handling
 
-Files larger than 5 MB exceed the Lambda response payload limit. In these cases, the proxy automatically:
+Files larger than 5 MB exceed the inline response payload limit. In these cases, the proxy automatically:
 
-1. Uploads the file to a temporary S3 bucket
-2. Returns a `302 Redirect` to a presigned S3 download URL (valid for 5 minutes)
-3. The browser follows the redirect and downloads the file directly from S3
+1. Uploads the file to temporary storage
+2. Returns a `302 Redirect` to a short-lived, presigned download URL (valid for 5 minutes)
+3. The browser follows the redirect and downloads the file directly from the storage location
 
 This is transparent to the user and requires no configuration. Temporary files are automatically cleaned up after 24 hours.
 

docs/integrations/erp-toolkit/overview.md

@@ -34,7 +34,7 @@ The ERP Toolkit is composed of the following components. Each plays a specific r
 | **[JSONata Mapping](#jsonata-mapping)** | Transformation language for inbound and outbound data | Stable |
 | **[File Proxy](./file-proxy)** | Serve files from external archives on demand without migrating them into epilot | Stable |
 | **[Managed Calls](#managed-calls)** | Synchronous external API calls with JSONata mapping via connector integrations | Stable |
-| **[Secure Proxy](#secure-proxy)** | Route HTTP requests through VPC Lambdas for static IP egress or VPN access | Stable |
+| **[Secure Proxy](#secure-proxy)** | Route HTTP requests through epilot's secure proxy for static IP egress or VPN access | Stable |
 | **[Monitoring and ACKs](#monitoring-and-acks)** | Central logging, error tracking, and event replay | In progress |
 | **[Blueprints](https://marketplace.epilot.cloud/en/blueprints)** | Packaged, installable integration setups | Stable |
 | **[Apps](https://marketplace.epilot.cloud/en/apps)** | Custom automation actions and portal extensions for ERP logic | In progress |
@@ -52,7 +52,7 @@ The `/v2/integrations` CRUD API centralizes all integration configuration in one
 - **Inbound use cases** with entity mappings
 - **Outbound use cases** with event mappings
 - **Managed call use cases** for synchronous external API calls (connector integrations)
-- **Secure proxy use cases** for VPC-routed HTTP requests
+- **Secure proxy use cases** for HTTP requests routed through a static IP or VPN
 - **Associated Apps and portal extensions**
 
 Integrations support two types: `erp` (default, for standard ERP flows) and `connector` (for complex proxy integrations with external APIs).
@@ -93,16 +93,16 @@ Key capabilities:
 - **Authentication** — OAuth2 client credentials, API key, or bearer token with automatic token management
 - **JSONata mapping** — Transform request and response payloads using JSONata expressions
 - **Inbound routing** — Optionally queue the response to the inbound pipeline for async entity processing
-- **Secure proxy support** — Route calls through static IP or VPN VPCs when needed
+- **Secure proxy support** — Route calls through a static IP or VPN connection when needed
 
 See the [Configuration Guide](./configuration#managed-call-use-cases) for setup details.
 
 ### Secure Proxy
 
-The Secure Proxy routes HTTP requests through VPC-deployed Lambda functions, providing either **static IP egress** (for IP-allowlisted external APIs) or **VPN access** (for customer private networks). It acts as the single authenticated gateway between epilot and customer networks.
+The Secure Proxy routes HTTP requests through epilot's dedicated proxy infrastructure, providing either **static IP egress** (for IP-allowlisted external APIs) or **VPN access** (for customer private networks). It acts as the single authenticated gateway between epilot and customer networks.
 
-- **Static IP mode** — Routes through a NAT Gateway for a fixed outbound IP address
-- **Secure Link mode** — Routes through a VPN-connected VPC for access to private networks
+- **Static IP mode** — Routes outbound requests from a fixed, allowlistable IP address
+- **Secure Link mode** — Routes through a VPN connection for access to private networks
 - Domain whitelisting and CIDR-based IP allowlisting enforce strict access control
 
 See the [Configuration Guide](./configuration#secure-proxy-use-cases) for setup details.