Managed Service

Purple8 Hyper Graph (v0.72.0) and the Purple8 AML Platform are provisioned and operated for the customer as a set of dedicated instances. The operator may be Purple8, a system integrator, or the customer's own platform team. Infrastructure is not shared between customers. This is distinct from SaaS: each customer receives its own instances, storage, keys and network boundary, and can be customized independently.

Scope

Aspect	Responsibility
AWS account	Operator-owned account dedicated to the customer, or the customer's account with delegated operator access
Infrastructure provisioning	Operator, from the Purple8 reference stack
Installation, upgrades, patching	Operator
Monitoring, alerting, on-call	Operator
Backups and disaster recovery	Operator, to S3 within the customer's region
Identity	Customer IdP federated via OIDC or SAML
Customization	Detection configuration, journey templates, UI branding, ontologies; per customer, per instance
Data ownership	Customer. Data export available at any time via REST API and backup manifests.

Operator options

Operator	Account ownership	Typical arrangement
Purple8	Purple8-owned AWS account dedicated to the customer	Full service. Customer has read-only console access and receives audit exports.
System integrator	SI-owned or customer-owned account	SI operates under its own managed-services contract; Purple8 provides software, reference stack and escalation.
Customer platform team	Customer-owned account	Equivalent to Customer VPC with Purple8 reference operations runbooks.

The architecture is identical across operator options. Only the account boundary and IAM trust change.

Fleet model

A managed deployment is a fleet of instances provisioned from one infrastructure template and one release line.

                 Operator control plane
                 (IaC pipeline, image registry, release calendar,
                  centralized monitoring and alert routing)
                          │
        ┌─────────────────┼─────────────────┐
        ▼                 ▼                 ▼
  Instance: customer-A   Instance: customer-B   Instance: customer-C/eu
  us-east-1              us-west-2              eu-west-1
  dedicated account      dedicated account      dedicated account
  or VPC                 or VPC                 or VPC

• Each instance is the Customer VPC reference architecture: ALB, Purple8 Graph primary and follower on EC2 + EBS across two AZs, DocIntel on ECS Fargate, S3 backups, KMS, Secrets Manager, CloudWatch.
• The control plane holds no customer data. It holds infrastructure definitions, container images, and aggregated operational telemetry.
• Instances within one customer may be arranged in any of the three topologies.

Isolation

Boundary	Implementation
Account	Separate AWS account per customer (recommended) or separate VPC per customer within an operator account
Network	No peering between customer VPCs. Ingress via customer-specific ALB and DNS name.
Storage	Dedicated EBS volumes, dedicated S3 backup bucket
Keys	Customer-specific KMS key. Optionally a customer-owned key with a grant to the operator role.
Identity	Customer IdP. Operator uses a separate break-glass path with MFA and session logging.
Telemetry	Metrics and logs aggregated to the control plane contain no graph content. Audit trail remains in the customer instance.

Release management

Item	Practice
Image source	Purple8 signed container images
Rollout	Per instance, scheduled with the customer. Follower upgraded first, then failover, then former primary.
Rollback	Previous image retained; WAL format is backward compatible within a major version
Validation	Health probes (/health, /ready), smoke queries, replication lag check before promotion
Change record	Per-instance change log; customer notified per its change-management process

Availability and resiliency

Identical to Customer VPC: two-AZ primary/replica with SYNC WAL replication, automated failover (replica watchdog + ALB target swap), S3 incremental backups. The operator owns alert response and the post-failover rejoin.

Target	Mechanism
Availability zone loss	Automatic follower promotion
Instance corruption	Restore from S3 incremental backup
Region loss	Optional: ASYNC follower in a second region, or cold restore from cross-region replicated backups. Provisioned per customer requirement; not default, because it moves data across a regional boundary.

Service levels (availability, RPO, RTO, support response) are contractual and are defined per engagement. They are not asserted in this document.

Regions

• Each instance is deployed to the region the customer nominates. All regional AWS services (EBS, S3, KMS, CloudWatch, Bedrock) are confined to that region.
• Customers with multiple jurisdictions receive one instance per region under the One-to-Many topology.
• Operator control plane may be in a different region; it holds no customer data.

Observability

Signal	Path
Metrics	Prometheus /metrics scraped to operator monitoring; customer may also scrape
Logs	CloudWatch Logs in the customer account or instance VPC; subscription filter to customer SIEM on request
Traces	OpenTelemetry export to operator or customer collector
Alerts	PagerDuty, OpsGenie, Slack or webhook to operator on-call; mirrored to customer channel on request
Audit	Immutable graph audit trail; GET /admin/audit; periodic export to customer S3
Change events	Egress sinks to customer SIEM or downstream systems

Customer access

Access	Provided
Investigator UI	Yes, via customer IdP
LCNC admin console	Yes; tenant, user, API key and settings management within the instance
REST API and MCP server	Yes, with customer-issued API keys and RBAC (125 MCP tools across 16 namespaces)
AWS console	Read-only role on request (Purple8-operated account) or full (customer-owned account)
Data export	REST export, backup manifests, S3 bucket access

When to choose Managed Service

• Customer wants a fully operated platform but requires dedicated infrastructure rather than shared multi-tenant SaaS.
• Multiple markets or business lines with divergent regulatory or customization requirements.
• Multiple front-end applications over a common detection engine.
• No internal platform team, or a preference to engage a system integrator.