BP-2731: On-premises architecture diagram

docs/on-premises/architecture.mdx

@@ -9,18 +9,37 @@ On-premises deployments of BloodHound Enterprise give you full control over your
 
 ## Deployment architecture
 
-On-premises deployments of BloodHound Enterprise consist of two primary parts:
+An on-premises deployment of BloodHound Enterprise centers on a dedicated host that runs the application stack and one or more separate collector hosts that gather identity data from your environment.
 
-- **BloodHound Enterprise host** - Runs the BloodHound application, database, and supporting infrastructure
-- **Collector hosts** - Run lightweight collector services (SharpHound, AzureHound, or OpenHound) to gather data from your identity infrastructure
+<Note>
+  The following diagram shows where the components run and how collected data moves toward BloodHound Enterprise. The sections that follow the diagram describe the components and data flow in more detail.
+</Note>
+
+<img
+  src="/images/on-premises/on-prem-architecture-diagram.drawio.svg"
+  alt="A diagram showing the architecture of an on-premises deployment of BloodHound Enterprise"
+/>
+
+
+
+<AccordionGroup>
+  <Accordion title="Who initiates the connection?">
+    Data flows toward BloodHound Enterprise, but the collector initiates every session. The collector pulls data from your environment and then sends the results to BloodHound Enterprise.
+  </Accordion>
+  <Accordion title="Does this create inbound risk for domain controllers?">
+    No. The inbound rules in an on-premises deployment apply to the BloodHound Enterprise host, not to your domain controllers.
+
+    Communication with domain controllers is outbound from a collector that you own, using services and ports that your domain controllers already expose. From a firewall perspective, this typically looks like read-only collector traffic to domain services plus a single HTTPS (`443`) egress path to BloodHound Enterprise.
+  </Accordion>
+</AccordionGroup>
 
 ### Core components
 
 All on-premises deployments include the following core application components:
 
 | Component | Purpose |
 |-----------|---------|
-| **BloodHound Enterprise API** | Application server, UI, graph analysis, and collector ingestion |
+| **BloodHound Enterprise** | Application server, REST API, user interface (UI), graph analysis, and collector ingestion |
 | **PostgreSQL 18.x** | Database server for application data and graph storage |
 
 ### Deployment-specific components