Deploy to your customer’s cloud without relying on them to operate your software.
NOV 17 · AI Infrastructure Night · SF
Infrastructure for software outside your cloud.
Deploy and operate software in remote environments - close to sensitive data, private networks, and latency-critical workloads.
Control plane- Deployments
- 0 connected
- Release
- 3f9a2c1
- Rollout
- Complete
Fix incidents in remote environments without SSH or open ports.
Deploy to remote Linux servers with auto-updates and observability.
$ sudo acme-deploy join
Encrypt your customers’ sensitive data with keys they can revoke.
Ov8FaL oBm nU9yDA5+f s1K7YxWXEtiz BmnU9yD Ov8FaL oBm nU9yDA5+f s1K7YxWXEtiz BmnU9yD A5+fs1 K7Y xWXEti zwpuPc Ih GH0d Sjg Ze/MV A5+fs1 K7Y xWXEti zwpuPc Ih GH0d Sjg Ze/MV qb4R 23k NCTQJOv8F 7YxWXEt izwpuP cl6rIhG qb4R 23k NCTQJOv8F 7YxWXEt izwpuP cl6rIhG H0d dS jgZe Ov8FaL oBmnU 9yDA5+f s1K 7YxWX H0d dS jgZe Ov8FaL oBmnU 9yDA5+f s1K 7YxWX Eti zBmn U9yD A5+fs1K7Y xWXEtiz wpuPc IhGH Eti zBmn U9yD A5+fs1K7Y xWXEtiz wpuPc IhGH 0dSjg Ze/MVqb4R23k NCTQ JOv8F 7Yx WXEtizw 0dSjg Ze/MVqb4R23k NCTQ JOv8F 7Yx WXEtizw
Run AI inference inside your customer’s VPC.
- Amazon Bedrock
- Vertex AI
- Azure AI Foundry
- Open-weight on GPUs
Give each customer a dedicated, isolated deployment, in your cloud or theirs.
customer-1 · EUcustomer-2 · India
customer-3 · UScustomer-4 · UK
customer-5 · Singaporecustomer-6 · Brazil
You send them a Helm chart.Then it’s out of your hands.
# ext-customer-12 organizations
Customer 1’s platform team 10:12 AM
Our data can’t leave our cloud.
Your engineer 10:31 AM
No problem. Here’s our Helm chart.
acme-1.8.0.tgzThursday
Customer 1’s platform team 2:14 AM
Production is down. Can you get on a call?
Customer 1’s platform team started a callJoin
Message # ext-customer-1 is typing
Alien makes their cloud feel like yours.
Auto updates
Release once, every customer updates.
customer-3 INFO POST /v1/ingest 200customer-7 INFO job sync-accounts donecustomer-1 WARN retrying webhook (2/5)customer-9 INFO GET /v1/health 200customer-4 ERROR db connection resetcustomer-5 OFF Logs aren’t collectedcustomer-2 INFO POST /v1/query 200customer-3 INFO POST /v1/ingest 200customer-7 INFO job sync-accounts donecustomer-1 WARN retrying webhook (2/5)customer-9 INFO GET /v1/health 200customer-4 ERROR db connection resetcustomer-5 OFF Logs aren’t collectedcustomer-2 INFO POST /v1/query 200Observability
Their admin sets telemetry: automatic, approval required, or off.
$ alien commands invoke --command reindexcustomer-4 · done in 1.2sRemote commands
Fix issues without logging in.
Build a control plane ⇄ data plane architecture, so one breach or one noisy signup can’t hit every customer.
The same architecture behind
Learn more→
AWS
Databricks
Snowflake
Cloudflare
MongoDB
- 01
One shared deployment
Most SaaS products serve every customer from the same servers, the same cloud quotas, and one database.
One breach exposes everyone. One noisy signup can slow down your biggest customer.
attacker │ ┌─ Your product ────────────────────────┼───────────────────────┐ │ │ │ │ ┏━━━━━━━━━━━━━━━━━┓ │ │ │ ┃ Sign-in and SSO ┃ │ │ │ ┗━━━━━━━━━━━━━━━━━┛ │ │ │ ▼ │ │ ┏━━━━━━━━━┓ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ │ ┃ Web app ┃ ┃ Your API and workers ┃ │ │ ┗━━━━━━━━━┛ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ │ │ │ │ │ ┏━━━━━━━━━┓ │ │ │ │ ┃ Billing ┃ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ │ ┗━━━━━━━━━┛ ┃ Database ┃ ┃ Storage ┃ │ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ │ ┏━━━━━━━━━━┓ customer-1, customer-2, customer-3 │ │ ┃ Settings ┃ │ │ ┗━━━━━━━━━━┛ │ └───────────────────────────────────────────────────────────────┘
attacker │ ┌─ Your product ──────┼──────────────┐ │ ┏━━━━━━━━━━━━━━━━━┓ │ ┏━━━━━━━━━┓ │ │ ┃ Sign-in and SSO ┃ │ ┃ Web app ┃ │ │ ┗━━━━━━━━━━━━━━━━━┛ │ ┗━━━━━━━━━┛ │ │ ┏━━━━━━━━━━┓ │ ┏━━━━━━━━━┓ │ │ ┃ Settings ┃ │ ┃ Billing ┃ │ │ ┗━━━━━━━━━━┛ │ ┗━━━━━━━━━┛ │ │ │ │ │ │ │ │ │ │ │ ▼ │ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ │ ┃ Your API and workers ┃ │ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ │ ┃ Database ┃ ┃ Storage ┃ │ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ └────────────────────────────────────┘
- 02
Control plane ⇄ data plane
Some parts only manage the product, things like sign-in, billing, and settings. They don’t need customer data. This is the control plane.
The parts that process and store customer data are the data plane.
┌─ Control plane ───────┐ │ │ │ ┏━━━━━━━━━━━━━━━━━┓ │ ┌─ Data plane ─────────────────────────┐ │ ┃ Sign-in and SSO ┃ │ │ │ │ ┗━━━━━━━━━━━━━━━━━┛ │ │ │ │ │ │ │ │ ┏━━━━━━━━━┓ │ outbound HTTPS │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ │ ┃ Web app ┃ │◀─────────────────────┼──┃ Your API and workers ┃ │ │ ┗━━━━━━━━━┛ │ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ │ │ │ │ │ │ │ ┏━━━━━━━━━┓ │ │ │ │ │ │ ┃ Billing ┃ │ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ │ ┗━━━━━━━━━┛ │ │ ┃ Database ┃ ┃ Storage ┃ │ │ │ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ │ ┏━━━━━━━━━━┓ │ │ customer-1, customer-2, customer-3 │ │ ┃ Settings ┃ │ └──────────────────────────────────────┘ │ ┗━━━━━━━━━━┛ │ └───────────────────────┘┌─ Control plane ────────────────────┐ │ ┏━━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ │ ┃ Sign-in and SSO ┃ ┃ Web app ┃ │ │ ┗━━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ │ ┃ Settings ┃ ┃ Billing ┃ │ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ └──────────────────┬─────────────────┘ │ outbound HTTPS ▲ │ │ │ ┌─ Data plane ─────┴─────────────────┐ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ │ ┃ Your API and workers ┃ │ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ │ ┃ Database ┃ ┃ Storage ┃ │ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ └────────────────────────────────────┘ - 03
A data plane per customer
single-tenantEach customer can then get their own data plane, with its own servers, quotas, and database. This is called single-tenant.
A breach in one can’t reach the others, and one customer’s traffic can’t slow down another.
╔═ Your cloud ═══════════════════════════════════════════════════════════════════════════════╗ ║ ║ ║ ┌─ Control plane ───────┐ ║ ║ │ │ ║ ║ │ ┏━━━━━━━━━━━━━━━━━┓ │ ┌─ Data plane · customer-1 ────────────┐ ║ ║ │ ┃ Sign-in and SSO ┃ │ │ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━┛ │ │ │ ║ ║ │ │ │ │ ║ ║ │ ┏━━━━━━━━━┓ │ outbound HTTPS │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ ║ ║ │ ┃ Web app ┃ │◀─────────────────────┼──┃ Your API and workers ┃ │ ║ ║ │ ┗━━━━━━━━━┛ │ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ │ │ │ │ │ ║ ║ │ ┏━━━━━━━━━┓ │ │ │ │ │ ║ ║ │ ┃ Billing ┃ │ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┗━━━━━━━━━┛ │ │ ┃ Database ┃ ┃ Storage ┃ │ ║ ║ │ │ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ │ │ │ ║ ║ │ ┃ Settings ┃ │ └──────────────────────────────────────┘ ║ ║ │ ┗━━━━━━━━━━┛ │ ║ ║ └───────────────────────┘ ║ ║ ║ ╚════════════════════════════════════════════════════════════════════════════════════════════╝ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
╔ Your cloud ════════════════════════════╗ ║ ║ ║ ┌─ Control plane ────────────────────┐ ║ ║ │ ┏━━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Sign-in and SSO ┃ ┃ Web app ┃ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Settings ┃ ┃ Billing ┃ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ └──────────────────┬─────────────────┘ ║ ║ │ ║ ║ outbound HTTPS ▲ ║ ║ │ ║ ║ │ ║ ║ │ ║ ║ ┌─ customer-1 ─────┴─────────────────┐ ║ ║ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ ║ ║ │ ┃ Your API and workers ┃ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Database ┃ ┃ Storage ┃ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ └────────────────────────────────────┘ ║ ╚════════════════════════════════════════╝
- 04
In their cloud
BYOCA data plane can also run inside the customer’s own cloud account. This is called BYOC, bring your own cloud.
Their data never leaves their account.
╔═ Your cloud ════════════════╗ ╔═ customer-1's cloud ════════════════════════╗ ║ ║ ║ ║ ║ ┌─ Control plane ───────┐ ║ ║ ║ ║ │ │ ║ ║ ║ ║ │ ┏━━━━━━━━━━━━━━━━━┓ │ ║ ║ ┌─ Data plane · customer-1 ────────────┐ ║ ║ │ ┃ Sign-in and SSO ┃ │ ║ ║ │ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ │ ║ ║ │ │ ║ ║ │ │ ║ ║ │ ┏━━━━━━━━━┓ │ ║ outbound HTTPS ║ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ ║ ║ │ ┃ Web app ┃ │◀─╬────────────────╬──┼──┃ Your API and workers ┃ │ ║ ║ │ ┗━━━━━━━━━┛ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ │ ║ ║ │ │ │ │ ║ ║ │ ┏━━━━━━━━━┓ │ ║ ║ │ │ │ │ ║ ║ │ ┃ Billing ┃ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┗━━━━━━━━━┛ │ ║ ║ │ ┃ Database ┃ ┃ Storage ┃ │ ║ ║ │ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ │ ║ ║ │ │ ║ ║ │ ┃ Settings ┃ │ ║ ║ └──────────────────────────────────────┘ ║ ║ │ ┗━━━━━━━━━━┛ │ ║ ║ ║ ║ └───────────────────────┘ ║ ║ ║ ║ ║ ║ ║ ╚═════════════════════════════╝ ╚═════════════════════════════════════════════╝ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
╔ Your cloud ════════════════════════════╗ ║ ║ ║ ┌─ Control plane ────────────────────┐ ║ ║ │ ┏━━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Sign-in and SSO ┃ ┃ Web app ┃ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Settings ┃ ┃ Billing ┃ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ └──────────────────┬─────────────────┘ ║ ╚════════════════════╪═══════════════════╝ outbound HTTPS ▲ │ ╔ customer-1's cloud ╪═══════════════════╗ ║ │ ║ ║ ┌─ Data plane ─────┴─────────────────┐ ║ ║ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ ║ ║ │ ┃ Your API and workers ┃ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Database ┃ ┃ Storage ┃ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ └────────────────────────────────────┘ ║ ╚════════════════════════════════════════╝
- 05
Small, with no way in
A data plane often runs where you can’t log in to fix it. That’s why it’s kept small, with few dependencies: less can break.
Ideally it accepts no connections from the internet. It connects out to the control plane, so there’s nothing for an attacker to reach.
╔═ Your cloud ════════════════╗ ╔═ customer-1's cloud ════════════════════════╗ ║ ║ ║ ║ ║ ┌─ Control plane ───────┐ ║ ║ ║ ║ │ │ ║ ║ ║ ║ │ ┏━━━━━━━━━━━━━━━━━┓ │ ║ ║ ┌─ Data plane · customer-1 ────────────┐ ║ ║ │ ┃ Sign-in and SSO ┃ │ ║ ║ │ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ │ ║ ║ │ │ ║ ║ │ │ ║ ║ │ ┏━━━━━━━━━┓ │ ║ outbound HTTPS ║ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ ║ ║ │ ┃ Web app ┃ │◀─╬────────────────╬──┼──┃ Your API and workers ┃ │ ║ ║ │ ┗━━━━━━━━━┛ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ │ ║ ║ │ │ │ │ ║ ║ │ ┏━━━━━━━━━┓ │ ║ ║ │ │ │ │ ║ ║ │ ┃ Billing ┃ │ ║ attacker ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┗━━━━━━━━━┛ │ ║ ───────────────╢ │ ┃ Database ┃ ┃ Storage ┃ │ ║ ║ │ │ ║ blocked ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ │ ║ ║ │ │ ║ ║ │ ┃ Settings ┃ │ ║ ║ └──────────────────────────────────────┘ ║ ║ │ ┗━━━━━━━━━━┛ │ ║ ║ ║ ║ └───────────────────────┘ ║ ║ ║ ║ ║ ║ ║ ╚═════════════════════════════╝ ╚═════════════════════════════════════════════╝ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
╔ Your cloud ════════════════════════════╗ ║ ║ ║ ┌─ Control plane ────────────────────┐ ║ ║ │ ┏━━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Sign-in and SSO ┃ ┃ Web app ┃ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Settings ┃ ┃ Billing ┃ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ └──────────────────┬─────────────────┘ ║ ╚════════════════════╪═══════════════════╝ outbound HTTPS ▲ attacker │ │ blocked ╔ customer-1's cloud ╪══════════╧════════╗ ║ │ ║ ║ ┌─ Data plane ─────┴─────────────────┐ ║ ║ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ ║ ║ │ ┃ Your API and workers ┃ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Database ┃ ┃ Storage ┃ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ └────────────────────────────────────┘ ║ ╚════════════════════════════════════════╝
- 06
Every customer
The hard part is operating all these data planes: deploying, updating, and fixing each one.
Alien does that for you, in your cloud or in your customers’ clouds.
┌─ Control plane ───────┐ │ │ │ ┏━━━━━━━━━━━━━━━━━┓ │ ┌─ customer-3 ─────────────────────────┐ │ ┃ Sign-in and SSO ┃ │ │ │ │ ┗━━━━━━━━━━━━━━━━━┛ │ ┌─ customer-2 ─────────────────────────┐ │ │ │ │ │ │ │ ┏━━━━━━━━━┓ │ ┌─ Data plane · customer-1 ────────────┐ │ │ │ ┃ Web app ┃ │ │ │ │ │ │ ┗━━━━━━━━━┛ │ │ │ │ │ │ │ │ │ │ │ │ ┏━━━━━━━━━┓ │ outbound HTTPS │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ │ │ │ ┃ Billing ┃ │◀─────────────────────┼──┃ Your API and workers ┃ │ │ │ │ ┗━━━━━━━━━┛ │ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ │ │ │ │ │ │ │ │ │ │ │ ┏━━━━━━━━━━┓ │ │ │ │ │ │ │ │ ┃ Settings ┃ │ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ │─┘ │ ┗━━━━━━━━━━┛ │ │ ┃ Database ┃ ┃ Storage ┃ │ │ └───────────────────────┘ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │─┘ │ │ └──────────────────────────────────────┘┌─ Control plane ────────────────────┐ │ ┏━━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ │ ┃ Sign-in and SSO ┃ ┃ Web app ┃ │ │ ┗━━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ │ ┃ Settings ┃ ┃ Billing ┃ │ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ └──────────────────┬─────────────────┘ │ outbound HTTPS ▲ │ ┌─ customer-3 │ ────────────────┐ ┌─ customer-2 ── │ ──────────────┐ │ ┌─ customer-1 ─────┴─────────────┐ │ │ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ │ │ │ ┃ Your API and workers ┃ │ │ │ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ │ │ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ │ │ │ ┃ Database ┃ ┃ Storage ┃ │ │─┘ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │─┘ └────────────────────────────────┘
One shared deployment. Most SaaS products serve every customer from the same servers, the same cloud quotas, and one database.
attacker │ ┌─ Your product ────────────────────────┼───────────────────────┐ │ │ │ │ │ │ │ │ │ │ │ │ │ ▼ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ └───────────────────────────────────────────────────────────────┘
┌─ Control plane ───────┐
│ │
│ │ ┌─ Data plane ─────────────────────────┐
│ │ │ │
│ │ │ │
│ │ │ │
│ │ outbound HTTPS │ │
│ │◀─────────────────────┼── │
│ │ │ │
│ │ │ │
│ │ │ │
│ │ │ │
│ │ │ │
│ │ │ │
│ │ │ │
│ │ └──────────────────────────────────────┘
│ │
└───────────────────────┘
┏━━━━━━━━━━━━━━━━━┓
┃ Sign-in and SSO ┃
┗━━━━━━━━━━━━━━━━━┛
┏━━━━━━━━━┓
┃ Web app ┃
┗━━━━━━━━━┛
┏━━━━━━━━━┓
┃ Billing ┃
┗━━━━━━━━━┛
┏━━━━━━━━━━┓
┃ Settings ┃
┗━━━━━━━━━━┛
┏━━━━━━━━━━━━━━━━━━━━━━┓
┃ Your API and workers ┃
┗━━━━━━━━━━━━━━━━━━━━━━┛
│ │
│ │
┏━━━━━━━━━━┓ ┏━━━━━━━━━┓
┃ Database ┃ ┃ Storage ┃
┗━━━━━━━━━━┛ ┗━━━━━━━━━┛
customer-1, customer-2, customer-3
┏━━━━━━━━━━━━━━━━━━━━━━┓
┃ Your API and workers ┃
┗━━━━━━━━━━━━━━━━━━━━━━┛
│ │
│ │
┏━━━━━━━━━━┓ ┏━━━━━━━━━┓
┃ Database ┃ ┃ Storage ┃
┗━━━━━━━━━━┛ ┗━━━━━━━━━┛
customer-1, customer-2, customer-3
╔═ Your cloud ═══════════════════════════════════════════════════════════════════════════════╗ ║ ║ ║ ┌─ Control plane ───────┐ ║ ║ │ │ ║ ║ │ ┏━━━━━━━━━━━━━━━━━┓ │ ┌─ Data plane · customer-1 ────────────┐ ║ ║ │ ┃ Sign-in and SSO ┃ │ │ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━┛ │ │ │ ║ ║ │ │ │ │ ║ ║ │ ┏━━━━━━━━━┓ │ outbound HTTPS │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ ║ ║ │ ┃ Web app ┃ │◀─────────────────────┼──┃ Your API and workers ┃ │ ║ ║ │ ┗━━━━━━━━━┛ │ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ │ │ │ │ │ ║ ║ │ ┏━━━━━━━━━┓ │ │ │ │ │ ║ ║ │ ┃ Billing ┃ │ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┗━━━━━━━━━┛ │ │ ┃ Database ┃ ┃ Storage ┃ │ ║ ║ │ │ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ │ │ │ ║ ║ │ ┃ Settings ┃ │ └──────────────────────────────────────┘ ║ ║ │ ┗━━━━━━━━━━┛ │ ║ ║ └───────────────────────┘ ║ ║ ║ ╚════════════════════════════════════════════════════════════════════════════════════════════╝ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
╔═ Your cloud ════════════════╗ ╔═ customer-1's cloud ════════════════════════╗ ║ ║ ║ ║ ║ ┌─ Control plane ───────┐ ║ ║ ║ ║ │ │ ║ ║ ║ ║ │ ┏━━━━━━━━━━━━━━━━━┓ │ ║ ║ ┌─ Data plane · customer-1 ────────────┐ ║ ║ │ ┃ Sign-in and SSO ┃ │ ║ ║ │ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ │ ║ ║ │ │ ║ ║ │ │ ║ ║ │ ┏━━━━━━━━━┓ │ ║ outbound HTTPS ║ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ ║ ║ │ ┃ Web app ┃ │◀─╬────────────────╬──┼──┃ Your API and workers ┃ │ ║ ║ │ ┗━━━━━━━━━┛ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ │ ║ ║ │ │ │ │ ║ ║ │ ┏━━━━━━━━━┓ │ ║ ║ │ │ │ │ ║ ║ │ ┃ Billing ┃ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┗━━━━━━━━━┛ │ ║ ║ │ ┃ Database ┃ ┃ Storage ┃ │ ║ ║ │ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ │ ║ ║ │ │ ║ ║ │ ┃ Settings ┃ │ ║ ║ └──────────────────────────────────────┘ ║ ║ │ ┗━━━━━━━━━━┛ │ ║ ║ ║ ║ └───────────────────────┘ ║ ║ ║ ║ ║ ║ ║ ╚═════════════════════════════╝ ╚═════════════════════════════════════════════╝ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
╔═ Your cloud ════════════════╗ ╔═ customer-1's cloud ════════════════════════╗ ║ ║ ║ ║ ║ ┌─ Control plane ───────┐ ║ ║ ║ ║ │ │ ║ ║ ║ ║ │ ┏━━━━━━━━━━━━━━━━━┓ │ ║ ║ ┌─ Data plane · customer-1 ────────────┐ ║ ║ │ ┃ Sign-in and SSO ┃ │ ║ ║ │ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ │ ║ ║ │ │ ║ ║ │ │ ║ ║ │ ┏━━━━━━━━━┓ │ ║ outbound HTTPS ║ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ ║ ║ │ ┃ Web app ┃ │◀─╬────────────────╬──┼──┃ Your API and workers ┃ │ ║ ║ │ ┗━━━━━━━━━┛ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ │ ║ ║ │ │ │ │ ║ ║ │ ┏━━━━━━━━━┓ │ ║ ║ │ │ │ │ ║ ║ │ ┃ Billing ┃ │ ║ attacker ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┗━━━━━━━━━┛ │ ║ ───────────────╢ │ ┃ Database ┃ ┃ Storage ┃ │ ║ ║ │ │ ║ blocked ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ │ ║ ║ │ │ ║ ║ │ ┃ Settings ┃ │ ║ ║ └──────────────────────────────────────┘ ║ ║ │ ┗━━━━━━━━━━┛ │ ║ ║ ║ ║ └───────────────────────┘ ║ ║ ║ ║ ║ ║ ║ ╚═════════════════════════════╝ ╚═════════════════════════════════════════════╝ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
┌─ Control plane ───────┐
│ │
│ ┏━━━━━━━━━━━━━━━━━┓ │ ┌─ customer-3 ─────────────────────────┐
│ ┃ Sign-in and SSO ┃ │ │ │
│ ┗━━━━━━━━━━━━━━━━━┛ │ ┌─ customer-2 ─────────────────────────┐ │
│ │ │ │ │
│ ┏━━━━━━━━━┓ │ ┌─ Data plane · customer-1 ────────────┐ │ │
│ ┃ Web app ┃ │ │ │ │ │
│ ┗━━━━━━━━━┛ │ │ │ │ │
│ │ │ │ │ │
│ ┏━━━━━━━━━┓ │ outbound HTTPS │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ │ │
│ ┃ Billing ┃ │◀─────────────────────┼──┃ Your API and workers ┃ │ │ │
│ ┗━━━━━━━━━┛ │ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ │ │
│ │ │ │ │ │ │ │
│ ┏━━━━━━━━━━┓ │ │ │ │ │ │ │
│ ┃ Settings ┃ │ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ │─┘
│ ┗━━━━━━━━━━┛ │ │ ┃ Database ┃ ┃ Storage ┃ │ │
└───────────────────────┘ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │─┘
│ │
└──────────────────────────────────────┘
attacker │ ┌─ Your product ──────┼──────────────┐ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ▼ │ │ │ │ │ │ │ │ │ │ │ │ │ └────────────────────────────────────┘
┌─ Control plane ────────────────────┐
│ │
│ │
│ │
│ │
│ │
│ │
└──────────────────┬─────────────────┘
│
outbound HTTPS ▲
│
│
│
┌─ Data plane ─────┴─────────────────┐
│ │
│ │
│ │
│ │
│ │
│ │
└────────────────────────────────────┘
┏━━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━┓
┃ Sign-in and SSO ┃ ┃ Web app ┃
┗━━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━┛
┏━━━━━━━━━━┓ ┏━━━━━━━━━┓
┃ Settings ┃ ┃ Billing ┃
┗━━━━━━━━━━┛ ┗━━━━━━━━━┛
┏━━━━━━━━━━━━━━━━━━━━━━┓
┃ Your API and workers ┃
┗━━━━━━━━━━━━━━━━━━━━━━┛
┏━━━━━━━━━━┓ ┏━━━━━━━━━┓
┃ Database ┃ ┃ Storage ┃
┗━━━━━━━━━━┛ ┗━━━━━━━━━┛
┏━━━━━━━━━━━━━━━━━━━━━━┓
┃ Your API and workers ┃
┗━━━━━━━━━━━━━━━━━━━━━━┛
┏━━━━━━━━━━┓ ┏━━━━━━━━━┓
┃ Database ┃ ┃ Storage ┃
┗━━━━━━━━━━┛ ┗━━━━━━━━━┛
╔ Your cloud ════════════════════════════╗ ║ ║ ║ ┌─ Control plane ────────────────────┐ ║ ║ │ ┏━━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Sign-in and SSO ┃ ┃ Web app ┃ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Settings ┃ ┃ Billing ┃ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ └──────────────────┬─────────────────┘ ║ ║ │ ║ ║ outbound HTTPS ▲ ║ ║ │ ║ ║ │ ║ ║ │ ║ ║ ┌─ customer-1 ─────┴─────────────────┐ ║ ║ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ ║ ║ │ ┃ Your API and workers ┃ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Database ┃ ┃ Storage ┃ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ └────────────────────────────────────┘ ║ ╚════════════════════════════════════════╝
╔ Your cloud ════════════════════════════╗ ║ ║ ║ ┌─ Control plane ────────────────────┐ ║ ║ │ ┏━━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Sign-in and SSO ┃ ┃ Web app ┃ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Settings ┃ ┃ Billing ┃ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ └──────────────────┬─────────────────┘ ║ ╚════════════════════╪═══════════════════╝ outbound HTTPS ▲ │ ╔ customer-1's cloud ╪═══════════════════╗ ║ │ ║ ║ ┌─ Data plane ─────┴─────────────────┐ ║ ║ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ ║ ║ │ ┃ Your API and workers ┃ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Database ┃ ┃ Storage ┃ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ └────────────────────────────────────┘ ║ ╚════════════════════════════════════════╝
╔ Your cloud ════════════════════════════╗ ║ ║ ║ ┌─ Control plane ────────────────────┐ ║ ║ │ ┏━━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Sign-in and SSO ┃ ┃ Web app ┃ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Settings ┃ ┃ Billing ┃ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ └──────────────────┬─────────────────┘ ║ ╚════════════════════╪═══════════════════╝ outbound HTTPS ▲ attacker │ │ blocked ╔ customer-1's cloud ╪══════════╧════════╗ ║ │ ║ ║ ┌─ Data plane ─────┴─────────────────┐ ║ ║ │ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ ║ ║ │ ┃ Your API and workers ┃ │ ║ ║ │ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ ║ ║ │ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ ║ ║ │ ┃ Database ┃ ┃ Storage ┃ │ ║ ║ │ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │ ║ ║ └────────────────────────────────────┘ ║ ╚════════════════════════════════════════╝
┌─ Control plane ────────────────────┐
│ ┏━━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━┓ │
│ ┃ Sign-in and SSO ┃ ┃ Web app ┃ │
│ ┗━━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━┛ │
│ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │
│ ┃ Settings ┃ ┃ Billing ┃ │
│ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │
└──────────────────┬─────────────────┘
│
outbound HTTPS ▲
│
┌─ customer-3 │ ────────────────┐
┌─ customer-2 ── │ ──────────────┐ │
┌─ customer-1 ─────┴─────────────┐ │ │
│ ┏━━━━━━━━━━━━━━━━━━━━━━┓ │ │ │
│ ┃ Your API and workers ┃ │ │ │
│ ┗━━━━━━━━━━━━━━━━━━━━━━┛ │ │ │
│ ┏━━━━━━━━━━┓ ┏━━━━━━━━━┓ │ │ │
│ ┃ Database ┃ ┃ Storage ┃ │ │─┘
│ ┗━━━━━━━━━━┛ ┗━━━━━━━━━┛ │─┘
└────────────────────────────────┘
customer-1Bankus-west-2customer-2Insureruksouthcustomer-3HospitalLinux servers · on-premcustomer-4Governmentus-east-1customer-5Manufacturer
Kubernetes · on-premcustomer-6Telcoasia-southeast1customer-7Retailersouthamerica-east1
us-west-2customer-2Insureruksouthcustomer-3HospitalLinux servers · on-premcustomer-4Governmentus-east-1customer-5ManufacturerKubernetes · on-premcustomer-6Telcoasia-southeast1customer-7Retailersouthamerica-east1Wherever your customers’ data
has to stay
- AWS
- Google Cloud
- Azure
- On-prem
Sell to customers whose data can’t leave their cloud.
4821-0392-7716- region
eu-central-1- owner
customer-2
Their account, their region
Data stays where it is.
- setupupdatesdata none
Least privilege
No access to customer data.
- acme accessgrantedrevoked
Revocable anytime
They can end access whenever.
- healthy ·
3f9a2c1· 2s agoUpdates and telemetry built in
Every deployment reports in.
Their admin sets it up from your page.With their own cloud credentials. You never get their login.
Deployment UX→deploy.acme.dev/deploy#…
Deployment namecustomer-1
Platform
Configure
Install method
CloudFormationAWS stack launch
AWS- Review the stackOptional, but useful before handing this to an AWS admin.Review the CloudFormation template
- Choose regionThe AWS Console opens in this region.us-east-1 · N. Virginia
- Launch in AWSCloudFormation creates the resources and registers the deployment.Launch in AWS Console
After AWS finishes, return here to watch status and logs.
TerraformReviewable Terraform module
AWS- Prepare TerraformCreate the deployment and its credentials first.Prepare Terraform
- Review generated resources
- Create main.tfSave it in your Terraform project.main.tfgenerated for customer-1
- Plan and apply
export TF_VAR_token='…' terraform init terraform apply
Review the plan before approving resource creation.
CLITerminal-based setup
AWS- Install CLIOn a machine with access to the target environment.
curl -sSL '<install-url>' | bash
- ConfigureSave these values next to the CLI.deployment.tomlgenerated for customer-1
- Deploy to AWS
export ACME_DEPLOYMENT_TOKEN='…' acmectl deploy \ --config deployment.toml
After the deploy finishes, this page shows status and logs.
Google LoginGuided Google Cloud authGoogle Cloud- Connect Google CloudUse an account that can create service accounts, IAM bindings, APIs, and resources.Continue with Google
- Choose projectcustomer-1-prod
- Choose regionus-central1 · Iowa
- Start deploymentStart deployment
A dedicated Google Cloud project is recommended.
TerraformReviewable Terraform module
Google Cloud- Prepare TerraformCreate the deployment and its credentials first.Prepare Terraform
- Review generated resources
- Create main.tfSave it in your Terraform project.main.tfgenerated for customer-1
- Plan and apply
export TF_VAR_token='…' terraform init terraform apply
Review the plan before approving resource creation.
CLITerminal-based setup
Google Cloud- Install CLIOn a machine with access to the target environment.
curl -sSL '<install-url>' | bash
- ConfigureSave these values next to the CLI.deployment.tomlgenerated for customer-1
- Deploy to Google Cloud
export ACME_DEPLOYMENT_TOKEN='…' acmectl deploy \ --config deployment.toml
After the deploy finishes, this page shows status and logs.
TerraformAzure-ready Terraform module
Azure- Prepare TerraformCreate the deployment and its credentials first.Prepare Terraform
- Review generated resources
- Create main.tfSave it in your Terraform project.main.tfgenerated for customer-1
- Plan and apply
export TF_VAR_token='…' terraform init terraform apply
Review the plan before approving resource creation.
CLITerminal-based setup
Azure- Install CLIOn a machine with access to the target environment.
curl -sSL '<install-url>' | bash
- ConfigureSave these values next to the CLI.deployment.tomlgenerated for customer-1
- Deploy to Azure
export ACME_DEPLOYMENT_TOKEN='…' acmectl deploy \ --config deployment.toml
After the deploy finishes, this page shows status and logs.
MachinesConnect Linux hosts to this environment
On-Prem- Set up machinesSet up machines
- Connect machinesRun this on each Linux host you want to join.
curl -fsSL '<install-url>' \ | sudo bash -s -- join \ --token '<join-token>'
Waiting for the first machine to join. This list updates live.
HelmKubernetes chart install
Kubernetes- Prepare valuesSave these generated values.values.yamlgenerated for customer-1
- Install chartRun this from the target cluster context.
helm install acme <chart> \ --namespace acme \ --create-namespace \ --values values.yaml
Every helm upgrade reuses the same values.yaml.
Ship to remote environments at the speed of light.
fix: retry webhook delivery
3f9a2c1 · main$ alien release
- customer-1
- customer-2
- customer-3
- customer-4
$ alien release3f9a2c1 · 1,240 deploymentsOne command
From your laptop or CI.
- pushthrough a role they grantpulltheir Operator connects out
Zero credentials
Alien never holds keys to their cloud.
e1c58faerrors3f9a2c1Roll back
Rollback
Pin or roll back any deployment.
Build against one set of well-tested primitives.
All resources→- AWS
- Google Cloud
- Azure
- Kubernetes
- Your laptop
WorkerLambdaStorageS3QueueSQSVaultSSM Parameter Store
$ alien dev✓ api✓ data✓ tasks✓ secretsThe whole stack on your laptop. No cloud account.Encrypt customer data with a key they control.Give them a cryptographic kill switch for their data.
Customer-managed keys→Q3 numbersReadable
Hi Bob, the Q3 numbers are attached.Revenue closed at $41.2M, up 18%.Please keep this internal.
Your customer’s cloudtry it
Run AI models in your customers’ clouds.
Local AI models→Your productone request
POST ai.alien.dev/customer-1/v1/chat/completions{ "model": "byo/claude-opus-5", "messages": [ … ]}AI Gateway
- Customer 11,285 requests todayAmazon Bedrockus-east-1 · billed to them
- Customer 2913 requests todayVertex AIeurope-west1 · billed to them
- Customer 3406 requests todayAnthropicbilled to them
Start from a working example.
See all examples→- Query a private databaseA connector queries the database inside the customer's network.Read the example →
- Remote tools for an AI agentYour agent sends tool calls. A worker runs them next to the files.Read the example →
- Chat with a private PostgresThe chat app, database, and AI model run in the customer's account.Read the example →
- Webhooks and an APIWebhooks land in the customer's cloud. Your backend queries them.Read the example →
- Kubernetes agentAn agent in the customer's cluster reads the Kubernetes API.Read the example →
- GitHub integrationThe agent and the GitHub token stay in the customer's account.Read the example →
╔═ Your cloud ═════════╗ ╔═ Customer network ═════════════════════════════════╗ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ┏━━━━━━━━━━━━━━┓ ║ query → rows ║ ┏━━━━━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━━━━━━━━━━━━━┓ ║ ║ ┃ Your backend ┃ ║◀─────────────────────╬──┃ connector (Worker) ┃ ┃ credentials (Vault) ┃ ║ ║ ┗━━━━━━━━━━━━━━┛ ║ ║ ┗━━━━━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━━━━━━━━━━━━━┛ ║ ║ ║ ║ ║ ║ ║ ║ ┏━━━━━━━━━━━━┓ ┏━━━━━━━━━━━━━━━━━━━━━┓ ║ ║ ║ ║ ┃ cache (Kv) ┃ ┃ customer's database ┃ ║ ║ ║ ║ ┗━━━━━━━━━━━━┛ ┗━━━━━━━━━━━━━━━━━━━━━┛ ║ ║ ║ ║ ║ ╚══════════════════════╝ ╚════════════════════════════════════════════════════╝ ░░░░░░░░░░░░░░░░░░░░░░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
╔═ Your cloud ═════════╗ ╔═ Customer cloud ═══════════════════════════════════╗ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ┏━━━━━━━━━━┓ ║ execute-tool ║ ┏━━━━━━━━┓ ┏━━━━━━━━━━━━━━━━━┓ ║ ║ ┃ AI agent ┃ ║◀─────────────────────╬──┃ worker ┃ ┃ files (Storage) ┃ ║ ║ ┗━━━━━━━━━━┛ ║ ║ ┗━━━━━━━━┛ ┗━━━━━━━━━━━━━━━━━┛ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ╚══════════════════════╝ ╚════════════════════════════════════════════════════╝ ░░░░░░░░░░░░░░░░░░░░░░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
╔═ Your cloud ═════════╗ ╔═ Customer cloud ═══════════════════════════════════╗ ║ ║ ║ ║ ║ ║ ║ Users reach the app over HTTPS ║ ║ ║ ║ ║ ║ ┏━━━━━━━━━━┓ ║ updates ║ ┏━━━━━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━━━━━━━┓ ║ ║ ┃ Releases ┃ ║◀─────────────────────╬──┃ app (Next.js chat) ┃ ┃ db (Postgres) ┃ ║ ║ ┗━━━━━━━━━━┛ ║ ║ ┗━━━━━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━━━━━━━┛ ║ ║ ║ ║ ║ ║ ║ ║ ┏━━━━━━━━━━┓ ║ ║ ║ ║ ┃ llm (AI) ┃ ║ ║ ║ ║ ┗━━━━━━━━━━┛ ║ ║ ║ ║ ║ ╚══════════════════════╝ ╚════════════════════════════════════════════════════╝ ░░░░░░░░░░░░░░░░░░░░░░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
╔═ Your cloud ═════════╗ ╔═ Customer cloud ═══════════════════════════════════╗ ║ ║ ║ ║ ║ ║ ║ Webhooks: POST /webhooks/:source ║ ║ ║ ║ ║ ║ ┏━━━━━━━━━━━━━━┓ ║ commands ║ ┏━━━━━━━━━━━━━━┓ ┏━━━━━━━━━━━━━┓ ║ ║ ┃ Your backend ┃ ║◀─────────────────────╬──┃ api (Worker) ┃ ┃ events (Kv) ┃ ║ ║ ┗━━━━━━━━━━━━━━┛ ║ ║ ┗━━━━━━━━━━━━━━┛ ┗━━━━━━━━━━━━━┛ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ╚══════════════════════╝ ╚════════════════════════════════════════════════════╝ ░░░░░░░░░░░░░░░░░░░░░░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
╔═ Your cloud ═════════╗ ╔═ Customer cluster ═════════════════════════════════╗ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ║ ┏━━━━━━━━━━┓ ║ inventory, commands ║ ┏━━━━━━━┓ ┏━━━━━━━━━━━━━━━━┓ ║ ║ ┃ Your API ┃ ║◀─────────────────────╬──┃ agent ┃ ┃ Kubernetes API ┃ ║ ║ ┗━━━━━━━━━━┛ ║ ║ ┗━━━━━━━┛ ┗━━━━━━━━━━━━━━━━┛ ║ ║ ║ ║ ║ ║ ┏━━━━━━━━━━━━━━━┓ ║ releases, logs ║ ┏━━━━━━━━━━┓ ║ ║ ┃ Alien Manager ┃ ║◀─────────────────────╬──┃ Operator ┃ ║ ║ ┗━━━━━━━━━━━━━━━┛ ║ ║ ┗━━━━━━━━━━┛ ║ ║ ║ ║ ║ ╚══════════════════════╝ ╚════════════════════════════════════════════════════╝ ░░░░░░░░░░░░░░░░░░░░░░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
╔═ Your cloud ═════════╗ ╔═ Customer cloud ═══════════════════════════════════╗ ║ ║ ║ ║ ║ ║ ║ Calls GitHub with the customer token ║ ║ ║ ║ ║ ║ ┏━━━━━━━━━━━┓ ║ commands → metrics ║ ┏━━━━━━━━━━━━━━━━┓ ┏━━━━━━━━━━━━━━━━━━━━━━┓ ║ ║ ┃ Dashboard ┃ ║◀─────────────────────╬──┃ agent (Worker) ┃ ┃ integrations (Vault) ┃ ║ ║ ┗━━━━━━━━━━━┛ ║ ║ ┗━━━━━━━━━━━━━━━━┛ ┗━━━━━━━━━━━━━━━━━━━━━━┛ ║ ║ ║ ║ ║ ║ ┏━━━━━━━━━━━━━━━┓ ║ ║ ║ ║ ┃ Sync workflow ┃ ║ ║ ║ ║ ┗━━━━━━━━━━━━━━━┛ ║ ║ ║ ║ ║ ║ ║ ╚══════════════════════╝ ╚════════════════════════════════════════════════════╝ ░░░░░░░░░░░░░░░░░░░░░░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
