> ## Documentation Index > Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Architecture & data flow > Hilt's single-tenant deployment model, component map, per-cloud services, network boundaries, and end-to-end data flow. Hilt deploys as a single-tenant platform inside your own cloud account. Collectors, the ingest endpoint, the streaming buffer, the analytics database, and the dashboard all run in infrastructure Hilt provisions in your account. No platform component is shared across customers, and no component is exposed to the public internet by default. *** ## Deployment model * **One tenant per account.** Each customer receives a dedicated deployment in their own AWS account, GCP project, Azure subscription, or Ali Cloud account. There is no shared multi-tenant plane and no Hilt-side copy of your data. * **Provisioned with Terraform.** Hilt applies a Terraform configuration to create the platform infrastructure (compute, streaming, database, storage, and private networking) in the account you nominate. * **You grant scoped access.** You provide a target account with the agreed IAM (or RAM) permissions per the deployment guide. Hilt operates within that scope. For cloud-specific provisioning and IAM detail, see the deployment guides: [AWS](https://hilt.ai/docs/deployment/aws.md), [GCP](https://hilt.ai/docs/deployment/gcp.md), [Azure](https://hilt.ai/docs/deployment/azure.md), and [Ali Cloud](https://hilt.ai/docs/deployment/ali-cloud.md). *** ## Components A deployment is made up of these logical components, all inside your account: | Component | Role | | :- | :- | | **Collectors** | Agents on your hosts that produce metadata-level telemetry (Linux static binary, macOS managed agent) | | **Ingest endpoint** | Private link endpoint that terminates collector connections; the only inbound path | | **Streaming buffer** | Durable event stream that decouples ingest from processing | | **Enrichment and scoring** | Workloads that normalize, enrich, and score events, and evaluate model drift | | **Analytics database** | Column store that holds normalized telemetry and findings | | **Dashboard** | Web application for investigation, detection rules, and administration, reached over private networking | | **Export pipeline** | Core component; produces anonymized exports on a daily schedule for your review and approval | *** ## Per-cloud services The component roles above map to native managed services on each cloud. All variants keep traffic inside your account with no public internet exposure. | Role | AWS | GCP | Azure | Ali Cloud | | :- | :- | :- | :- | :- | | Platform compute (ingest, dashboard) | ECS Fargate | GKE | AKS | ACK | | Platform compute (enrichment, classification) | EKS | GKE | AKS | ACK | | Event streaming | MSK (Kafka) | Kafka (in-cluster KRaft) | Event Hubs | Message Queue for Apache Kafka | | Private ingest | PrivateLink | HTTPS Gateway (`*.hilt.ai`) | Private Link | HTTPS ingress (`*.hilt.ai`) | | Analytics database | ClickHouse (EC2 instance) | ClickHouse Cloud | ClickHouse (Azure VM) | ClickHouse Cloud | | Dashboard database | RDS (PostgreSQL) | Cloud SQL (PostgreSQL) | Azure Database for PostgreSQL | ApsaraDB RDS (PostgreSQL) | | Object storage | S3 | Cloud Storage | Blob Storage | OSS | | TLS and DNS | ACM, Route 53 | Certificate Manager | ingress-nginx + Kubernetes TLS | ingress-nginx + Let's Encrypt (`*.hilt.ai`) | | Service identity | IAM roles | Workload Identity | Managed Identity | RAM roles | *** ## Network boundaries * **Ingest.** On AWS and Azure, collectors connect to a private link endpoint (PrivateLink / Private Link) in your account. On GCP v1, collectors reach `{name}-ingest.hilt.ai` over Certificate Manager HTTPS Gateways; see [GCP](https://hilt.ai/docs/deployment/gcp.md). On Ali Cloud, collectors reach `{name}-ingest.hilt.ai` over HTTPS through the cluster ingress; see [Ali Cloud](https://hilt.ai/docs/deployment/ali-cloud.md). * **No inbound internet.** No platform component accepts inbound connections from the public internet. * **Controlled outbound.** Outbound internet access is used only where needed for container image pulls, and is configurable to use private registries. * **Single collector destination.** A collector has exactly one outbound destination: the ingest endpoint, over HTTPS on TCP/443. DNS resolves inside your VPC through a private zone, so no DNS query leaks to public resolvers. For the collector's outbound posture, airgapped operation, and privilege model, see [Networking and security](https://hilt.ai/docs/linux-collector/networking-security.md). *** ## Data flow Events travel one direction, from your hosts into your analytics store and dashboard, without leaving your account. ```text theme={null} YOUR CLOUD ACCOUNT ┌─────────────────────────────────────────────────────────────────────┐ │ │ │ Hosts │ │ ┌──────────────┐ │ │ │ Collector │ metadata events │ │ │ (Linux/macOS)│ ──────────────┐ │ │ └──────────────┘ HTTPS 443 │ │ │ (private link)│ │ │ ▼ │ │ ┌──────────────────┐ │ │ │ Ingest endpoint │ │ │ └─────────┬─────────┘ │ │ ▼ │ │ ┌──────────────────┐ │ │ │ Streaming buffer │ (Kafka) │ │ └─────────┬─────────┘ │ │ ▼ │ │ ┌──────────────────┐ │ │ │ Enrichment and │ │ │ │ scoring │ │ │ └─────────┬─────────┘ │ │ ▼ │ │ ┌──────────────────┐ ┌──────────────┐ │ │ │ Analytics database│◀────▶│ Dashboard │ │ │ │ (ClickHouse) │ │(private ALB¹) │ │ │ └─────────┬─────────┘ └──────────────┘ │ │ ┊ │ │ ┊ anonymized, approved │ │ ▼ │ │ ┌──────────────────┐ │ │ │ Export pipeline │ ┄┄▶ to Hilt (approved)│ │ │ (daily schedule) │ │ │ └──────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────┘ ``` ¹ "Private ALB" is AWS-specific; GCP, Azure, and Ali Cloud use Kubernetes ingress load balancers. The dotted path is the only route by which any data leaves your account, and — with approval enabled (the default) — nothing is transferred until you approve each export. See [Data collection and handling](https://hilt.ai/docs/trust-security/data-handling.md) for what flows through this pipeline and [Anonymized data export](https://hilt.ai/docs/on-prem/data-export-overview.md) for the export controls. > [!NOTE] > > Service names vary by cloud (for example, the streaming buffer is MSK on AWS and in-cluster Kafka on GCP), but the data flow and trust boundary are identical: telemetry stays in your account. *** ## Data residency Telemetry does not leave your cloud account. Hilt does not receive, mirror, or hold out-of-band access to your events. The single exception is the [anonymized data export](https://hilt.ai/docs/on-prem/data-export-overview.md), a core pipeline that transfers only anonymized statistical features after your review and approval. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.