CONSOLE V1 / CUSTOMER GUIDE

Private deployment & retention

BYOS is an ownership boundary, not a compliance badge.

Private evaluation profile

The implemented deployment candidate uses a private-compatible Compose stack: Rust API/static console, PostgreSQL operational state, ClickHouse hot analytics, Redpanda durable fan-out, Arroyo streaming, an internal archive service, PyIceberg with a PostgreSQL SQL catalog, and S3-compatible storage. Local evaluation may use a local object store. A container volume is not customer S3 and does not establish S3 compliance. No datastore ports should be exposed. Operator access is private/loopback; public ingress is not required.

Full in-VPC path

The entire product—including authenticated UI/API, state, catalog, checkpoints, audit/observability and optional inference—has an in-VPC deployment requirement/path with customer-controlled storage and no mandatory vendor control plane. Hosted egress is opt-in. Current inference is disabled. A static product site can be hosted separately without receiving SIEM evidence; these docs do not authorize hosting or deployment.

What the evaluator must qualify

Agree on project, selected Region, source scope, networking, permissions, egress, secrets handling and exact cost change set before apply. Pin artifacts and record digests. Qualify tenant isolation, source acknowledgement, independent lane recovery, broker offsets, Arroyo metadata/checkpoints, backup/restore and process restart. The single-node evaluation is not HA. Local tests and one bounded synthetic run are not production cloud qualification.

Retention, holds and recovery

Define raw and normalized retention separately. Qualify Iceberg snapshots/maintenance, Parquet retrieval, object policy, holds and deletion propagation; PostgreSQL raw inbox safety caps are not a long-term retention promise. Specify recovery-point/recovery-time goals and test restore. No generated full OCSF coverage, compliance certification, tamper-proof audit or automatic disaster recovery claim is made.

Acquire without leaking credentials

Provider-native short-lived credentials remain in separately scoped acquisition workers. The console receives non-secret references and a source-scoped ingestion token, not provider access keys. Attach-existing and manual evaluation paths are distinct from future provisioning/OAuth self-service. Approve destinations and egress before introducing any external delivery integration.