Appendix
Data Inventory
Every store: contents, isolation, encryption, recovery, residency
Every place data rests, what it holds, the unit of isolation, how it is protected, how it is recovered, and where it lives.
| Store | Contents | Isolation unit | Encryption | Durability and recovery | Residency | Chapter |
|---|---|---|---|---|---|---|
| Aurora PostgreSQL | Workspaces, users, apps, releases, manifests, catalog of app databases, encrypted secrets, API key hashes, sessions, cron and webhook definitions, request logs, metrics, billing, audit indexes, settings | Row-level by workspace and app | Customer-managed KMS key at rest; TLS required | Continuous backups with point-in-time recovery; daily cross-region copy, 28 days; weekly restore test | Compute region | 09 |
| App databases (SQLite on S3) | Every app's tables and rows | One file per app database, per release | Server-side encryption at rest; HTTPS only | Flushed within seconds of a write; versioned bucket; DDL on a clone at deploy; prior release's file retained | Workspace's region, with a compute-region working copy while hot | 10 |
| S3 private buckets | App databases, git repository tars and file mirrors, build artifacts, commit diffs, private app files, workspace snapshots, presentation artifacts | Owner-rooted keys per app and store | Server-side encryption; public access blocked; HTTPS only | Versioned; newest prior versions retained; access-logged | One bucket per region | 11 |
| S3 public buckets | Public app files, user uploads, web assets | Owner-rooted keys | Server-side encryption; HTTPS only | Versioned; prior versions expire after seven days | One bucket per region | 11 |
| S3 audit bucket | Audit events as NDJSON, partitioned by workspace and date | Prefix per workspace | Server-side encryption; public access blocked; HTTPS only | Object Lock, COMPLIANCE, one year; no deletion possible before expiry | Compute region | 19 |
| S3 access-log buckets | Server access logs for private buckets | Per source bucket | Server-side encryption | Lifecycle expiry | One per region | 11 |
| Valkey | Cache, pub/sub, ownership records, pool registry, locks and leases, interface sessions, hook tokens, live audit tail, vendor limits | Key namespaces | In-VPC | Rebuildable from Postgres, S3 and pods; Multi-AZ with failover | Compute region | 13 |
| SQS | Work messages | Queue per work type | In transit | Dead-letter queues on ingest paths; visibility heartbeats | Compute region | 13 |
| Shared Qdrant | Vector and lexical indexes for data sources | Tenant per data source | Local NVMe in the cluster | A cache of S3 artifacts; rebuilt on cold read or eviction | Compute region | 33 |
| Dedicated Qdrant | One customer's indexes | Instance per resource, namespace and NetworkPolicy | Local disk in the cluster | A cache of the customer's S3 artifacts; rebuilt when a pod comes up empty | Compute region | 33 |
| Git repositories | Each app's source history | Repository per app | S3 server-side encryption for the durable tar; NVMe scratch on the pod | S3 tar is the source of truth; local copies are caches | Workspace's region, with a compute-region working copy while hot | 14 |
| Secrets Manager | Workspaces' own vendor keys | One bundle per workspace, versioned | AWS-managed encryption | Versioned; cache keyed by version | Compute region | 18 |
| Parameter Store | The platform's operator credentials | Per parameter | AWS-managed encryption | Synced to the cluster on a short interval | Compute region | 18 |
| App secrets (in Postgres) | Builders' secrets, dev and prod values | Per app and key | Envelope-encrypted with KMS before storage | With the platform database | Compute region | 18 |
| Cognito | Platform user identities | User pool | AWS-managed | Deletion protection on | Compute region | 17 |
| Training bases and adapters | Base model weights; per-method LoRA adapters and evaluation reports | Adapters in the app's own file store | S3 server-side encryption | Versioned with the file store | Workspace's region for adapters | 34 |
| Sandbox local disk | Handler files, extracted dependencies, a dev box's working copy | Per microVM | Ephemeral | Dev boxes snapshot their home directory to S3 on shutdown | Compute region while running | 06, 08 |
| CloudWatch Logs | Database audit log, Firehose delivery logs, Container Insights metrics | Log group | AWS-managed | Retention per group | Compute region | 25 |
| CloudTrail bucket | Control-plane API history | Account | Server-side encryption; log-file validation | Retained | Compute region | 25 |
| New Relic, Sentry | Performance telemetry and error reports | Account | Vendor | Vendor retention; both declared in the counterparty registry with their agreements | Vendor | 25 |