Architecture Philosophy
PanOps stores communication data that is, by definition, sensitive. The infrastructure design reflects that. Rather than pooling customers into shared tables protected only by application-layer access controls, PanOps provisions a dedicated AWS account per customer — entirely separate from every other tenant. Isolation is structural, not aspirational.
This means a misconfigured query, a bug in the access control layer, or a compromised service credential cannot expose one customer's data to another.
Infrastructure Architecture
Each customer receives a dedicated AWS sub-account under the PanOps AWS Organization, provisioned automatically via Terraform and AWS Account Factory for Terraform (AFT) in under 30 minutes. Within that account: a dedicated Aurora Serverless v2 instance, a dedicated S3 bucket, a customer-managed KMS key, and a CloudTrail log that only the customer controls.
PanOps's shared compute VPC peers to each customer VPC to run connector workers and inference — but customer VPCs have no internet gateway. Data cannot leave the customer account except through the controlled peering connection to PanOps compute.
Account Architecture
- PanOps Management Account — Control Tower, billing, org-level policies
- PanOps Shared Compute Account — connector workers, LLM inference, NAT Gateway
- Customer Account — Aurora, S3, KMS key, CloudTrail, VPC peered to Shared Compute
- No internet gateway in customer VPCs — data never traverses the public internet within AWS
- Provisioning time under 30 minutes via Terraform + AFT automation
Infrastructure at a Glance
View full technical specifications →