Architecture & data flow

High-level view of the managed Evitrus cloud on evitrus.io for due diligence.

Component diagram

flowchart LR
  subgraph Customer["Customer boundary"]
    K8S[K8s exporter]
    TF[EventBridge ECS]
    GHA[GitHub Action / App]
    SDK[Ingest clients]
    ADM[K8s admission / GHA check]
  end

  subgraph Evitrus["Evitrus cloud EU"]
    ING[Ingest 99.95]
    ID[Identity]
    EVAL[Evaluate 99.5]
    CH[(ClickHouse events)]
    PG[(Postgres identity)]
    UI[Web app]
  end

  K8S & TF & GHA & SDK -->|TLS push Evidence Events| ING
  ADM -->|POST /compliance/evaluate| EVAL
  ING --> CH
  ING -->|cached key reads| PG
  ID --> PG
  EVAL --> CH
  UI --> ID
  UI --> EVAL

Data flow (evidence)

Exporters authenticate with a tenant API key and POST events to ingest. Ingest normalizes each event, seals it with a contentHash, and appends it to ClickHouse before returning 202. Correlation and control evaluation run asynchronously and must not fail ingest. Evaluators call Evaluate with the same engine; a deny is HTTP 409. Unreachable Evaluate fail-opens at the customer edge.

Network

Public HTTPS is offered for the API, the product app, docs, and the marketing site. Datastores are reachable only inside the cluster. Customer exporters initiate outbound HTTPS. The public Gateway routes /ingest to the Ingest service and /compliance/evaluate to Evaluate so those planes do not share a process.