Purple8 Hyper Graph — Deployment Overview
Release: v0.72.0 (pip install purple8-hyper-graph)
Purple8 Hyper Graph (and the Purple8 AML Platform built on it) is delivered as a single unified application stack with three dedicated-instance deployment models. All models run the same GraphEngine (BrickCoreStorage / Purple8 Cortex), the same infrastructure templates, and the same security controls. They differ in where the stack runs and who operates it.
Purple8 is an approved Red Hat Technology Partner and NVIDIA Inception program member, shipping both standard commercial containers (Dockerfile.commercial) and a certified Red Hat Universal Base Image 9 (ubi9/python-312:9.5) container (Dockerfile.rhel) engineered for Red Hat OpenShift.
Application stack
| Layer | Component | Function |
|---|---|---|
| Presentation | Investigator / App UI | React single-page application. Case investigation, graph exploration, HITL approvals, dashboards. White-label capable. |
| Admin | LCNC Console | Browser-based operations console served by Purple8 Hyper Graph at /lcnc/. Tenants, users, API keys, storage, settings. |
| Core | Purple8 Hyper Graph (v0.72.0) | Graph, vector, document and full-text engine (BrickCoreStorage + BrickWAL + CortexAutoConfig); REST API; MCP server (125 MCP tools across 16 namespaces); Journey Engine (case lifecycle, SLA, HITL); RBAC; audit trail; envelope encryption. Stateful; one primary plus read replicas per instance. |
| Document processing | Purple8 DocIntel | Stateless document intelligence service (70+ formats, 75+ languages). Parses, chunks, extracts entities and relationships, emits to Purple8 Hyper Graph. |
| Inference | LLM and embedding provider | Model-agnostic. Any provider supported by the platform (see Inference providers). |
| Identity | Enterprise IdP | OIDC (with PKCE) and SAML 2.0 federation to the customer's identity provider. Local JWT and API-key authentication also supported. |
| Integration | Ingestion, egress, alerting | REST ingestion API, inbound webhooks, REST polling, outbound HMAC-signed webhooks, Prometheus metrics, OpenTelemetry traces, alert channels. |
Deployment models
| Model | Runs in | Operated by | Data plane isolation | Typical use |
|---|---|---|---|---|
| Self-Hosted | Customer infrastructure (on-premises, private cloud, any public cloud) | Customer | Dedicated | Air-gapped or sovereign environments; existing platform teams |
| Customer VPC | Customer's AWS account and VPC | Customer, or a system integrator on the customer's behalf | Dedicated | Regulated institutions that require data to remain in their own cloud account |
| Managed Service | AWS account operated by Purple8 or a designated operator | Purple8, a system integrator, or the customer's platform team | Dedicated per instance | Institutions that want a fully operated platform without shared infrastructure |
Self-Hosted, Customer VPC and Managed Service each provision one or more dedicated instances. An instance is one Purple8 Graph deployment with its own storage volume, encryption keys, backup target and network boundary. Instances are never shared between customers.
Instance topologies
Within any dedicated-instance model, instances can be arranged in three topologies. These are described in detail in AWS Deployment Patterns.
| Topology | Shape | Purpose |
|---|---|---|
| One-to-One | One customer, one instance | Full isolation; unrestricted customization |
| One-to-Many | One customer, one instance per market or jurisdiction | Data residency; regulatory segregation; common release line |
| Many-to-One | Many front-end applications, one instance | Multiple branded or role-specific UIs over a single data and detection engine |
Topologies compose. A One-to-Many deployment may expose Many-to-One front-ends against each market instance.
Inference providers
Purple8 Graph is model-agnostic. Generation and embedding providers are selected by configuration; no code change is required to switch.
| Provider | Where inference runs | Notes |
|---|---|---|
| Amazon Bedrock | Inside the customer's AWS account and region | Recommended for AWS deployments with data-residency requirements |
| Azure OpenAI | Customer's Azure subscription | |
| Google Vertex AI | Customer's Google Cloud project | |
| OpenAI, Anthropic, Google AI, Mistral, Cohere | Provider's public API | Egress to a third party; subject to customer policy |
| Ollama | Inside the deployment boundary | Local open-weight models; no external egress |
| Hugging Face, SentenceTransformers | Inside the deployment boundary | Local embedding and generation; no external egress |
Purple8 DocIntel uses the same provider set for extraction and classification.
Security controls common to all models
| Control | Implementation |
|---|---|
| Encryption at rest | AES-256-GCM envelope encryption. Data encryption keys held in memory only; wrapped by a key management provider: AWS KMS, Azure Key Vault, Google Cloud KMS, HashiCorp Vault, or local. |
| Encryption in transit | TLS at the load balancer or ingress. TLS on WAL replication links. |
| Authentication | JWT (local users), API keys, OIDC with PKCE, SAML 2.0, social login (optional). |
| Authorization | Four-tier RBAC (viewer, editor, admin, super_admin) with fine-grained permissions; field-level and row-level security policies; per-tool RBAC on the MCP server. |
| Audit | Immutable audit trail stored as graph edges; GET /admin/audit; audit log files. |
| Observability | Prometheus /metrics; OpenTelemetry spans; alert delivery to Slack, PagerDuty, OpsGenie, or any HTTPS webhook. |
| Change events | Outbound HMAC-signed webhooks (egress sinks) for downstream SIEM, case-management or data-warehouse consumers. |
| Backup | Incremental backups to Amazon S3, Google Cloud Storage, Azure Blob Storage, or a local target, with manifests, streaming JSONL mode (P8G_BACKUP_JSONL=1), archive ceiling (P8G_BACKUP_MAX_ARCHIVE_MB), and online integrity scrub (POST /admin/storage/scrub). |
Self-hosted licensing model
Self-hosted deployments use a simple two-tier model:
| Tier | Price | Capacity & Scope |
|---|---|---|
| Developer (Self-Hosted Free) | $0 | Up to 50K nodes, 1 MCP agent, full local GraphEngine (BrickCoreStorage) for development, prototyping, and evaluation. |
| Enterprise / Custom (Self-Hosted) | Custom | Single commercial self-hosted tier — tailored to customer capacity, multi-socket/NUMA cluster topology, Red Hat OpenShift / Kubernetes HA, and enterprise SLA. |
Choosing a model
| Requirement | Recommended model |
|---|---|
| Data must not leave customer-controlled infrastructure | Self-Hosted or Customer VPC |
| Customer has no platform team and requires a fully operated service | Managed Service |
| Multiple jurisdictions with residency constraints | Customer VPC or Managed Service, One-to-Many topology |
| Air-gapped network | Self-Hosted with local inference (Ollama or SentenceTransformers) |
| Evaluation or proof of concept | Self-Hosted (Docker Compose) or Managed Service (single instance) |