Cloud Architecture

How events flow from the daemon through ingestion, scoring, and fleet aggregation

Cloud Architecture

The Quint cloud runs on AWS ECS Fargate at api.quintai.dev. Five services handle the end-to-end pipeline:

Service	Role
ingest	Authenticates deploy tokens, validates events, publishes to SNS
pipeline	Consumes SQS, writes to Postgres actions (partitioned by month)
session-processor	Upserts sessions table from session lifecycle events
alert-processor	Evaluates rules, writes to alerts table
api	Serves dashboard + public API from Postgres + Redis

Ingest pipeline

See Ingestion for the event schema, batch parameters, and overflow/recovery rules.

Data model

Postgres 16 on RDS. Key tables:

Table	Contents
organizations	Tenant root
agents	Persistent agent identities across sessions
sessions	One row per agent invocation, stamped with session_id from the edge
actions	Tool calls + HTTP events, partitioned by created_at month
alerts	Rule-fired alerts
api_tokens	Deploy tokens (SHA256-hashed, Redis-cached)
machines	Registered edge daemons
enforcement_policies	Cloud-authored policies pushed to edge

Row-level security is enabled on all tenant tables using the app.current_org_id session variable.

Authentication

Two paths:

• Daemon → Ingest: Bearer token. Token is SHA256-hashed and looked up in Redis (write-through cache from api_tokens). Token types: install, enrollment, service, personal. Daemon boots with install token, registers, receives a service_token for subsequent calls.
• Dashboard → API: Supabase JWT (cloud mode) or API key (local/CI mode).

See Auth Overview for the full token hierarchy and RBAC for permission scopes.

Multi-tenancy

Every event carries org_id stamped at ingest from the token. Postgres RLS filters on app.current_org_id. Redis keys are org-prefixed. See Multi-tenancy for isolation guarantees.

Fleet aggregation

The Fleet service aggregates agent activity across machines in one org. A detection on one machine is distilled into a ThreatSignature and pushed to every daemon in the fleet in ~30 seconds.

Where to read next

• Sending events from the edge: Ingestion
• How events are scored: Scoring
• Graph-based anomaly detection: Intelligence → Graph
• Dashboard architecture: Dashboard → Architecture