> ## Documentation Index
> Fetch the complete documentation index at: https://quintsecurity.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud Architecture

> How events flow from the daemon through ingestion, divergence detection, and fleet aggregation

# Cloud Architecture

The Quint cloud runs on AWS ECS Fargate at `api.quintai.dev`. Five services handle the end-to-end pipeline:

| Service             | Role                                                              |
| ------------------- | ----------------------------------------------------------------- |
| `ingest`            | Authenticates deploy tokens, validates events, publishes to SNS   |
| `pipeline`          | Consumes SQS, writes to Postgres `actions` (partitioned by month) |
| `session-processor` | Upserts `sessions` table from session lifecycle events            |
| `alert-processor`   | Evaluates rules, writes to `alerts` table                         |
| `api`               | Serves dashboard + public API from Postgres + Redis               |

## Ingest pipeline

```mermaid theme={null}
flowchart LR
    DMN["Edge Daemon<br/>forwarder"] -->|"POST /v1/ingest<br/>Bearer token"| INGEST["Ingest Service"]
    INGEST -->|"SNS FIFO"| FAN["SNS Fan-out"]
    FAN --> SQS1["SQS: pipeline"]
    FAN --> SQS2["SQS: sessions"]
    FAN --> SQS3["SQS: alerts"]
    SQS1 --> PIPE["pipeline svc"]
    SQS2 --> SESS["session-processor"]
    SQS3 --> ALERT["alert-processor"]
    PIPE --> PG[("Postgres")]
    SESS --> PG
    ALERT --> PG
    API["api svc"] --> PG
    API --> REDIS[("Redis<br/>token cache + SSE")]
```

See [Ingestion](/cloud/ingestion) for the event schema, batch parameters, and overflow/recovery rules.

## Data model

Postgres 16 on RDS. Key tables:

| Table                  | Contents                                                              |
| ---------------------- | --------------------------------------------------------------------- |
| `organizations`        | Tenant root                                                           |
| `agents`               | Persistent agent identities across sessions                           |
| `sessions`             | One row per agent invocation, stamped with `session_id` from the edge |
| `actions`              | Tool calls + HTTP events, partitioned by `created_at` month           |
| `alerts`               | Rule-fired alerts                                                     |
| `api_tokens`           | Deploy tokens (SHA256-hashed, Redis-cached)                           |
| `machines`             | Registered edge daemons                                               |
| `enforcement_policies` | Cloud-authored policies pushed to edge                                |

Row-level security is enabled on all tenant tables using the `app.current_org_id` session variable.

## Authentication

Two paths:

* **Daemon → Ingest:** Bearer token. Token is SHA256-hashed and looked up in Redis (write-through cache from `api_tokens`). Token types: `install`, `enrollment`, `service`, `personal`. Daemon boots with install token, registers, receives a `service_token` for subsequent calls.
* **Dashboard → API:** Supabase JWT (cloud mode) or API key (local/CI mode).

See [Auth Overview](/cloud/auth-overview) for the full token hierarchy and [RBAC](/cloud/rbac) for permission scopes.

## Multi-tenancy

Every event carries `org_id` stamped at ingest from the token. Postgres RLS filters on `app.current_org_id`. Redis keys are org-prefixed. See [Multi-tenancy](/cloud/multi-tenancy) for isolation guarantees.

## Fleet aggregation

The [Fleet service](/cloud/fleet) aggregates agent activity across machines in one org. A detection on one machine is distilled into a threat signature and pushed to every daemon in the fleet in \~30 seconds.

## Where to read next

* **Sending events from the edge:** [Ingestion](/cloud/ingestion)
* **Per-action scoring:** [Scoring](/cloud/scoring), a shadow-mode corroborating signal rather than the enforcement mechanism
* **Dashboard architecture:** [Dashboard → Architecture](/dashboard/architecture)