BYOC Architecture

BYOC architecture

note

This page applies to BYOC deployments. To compare the plans, see Deployment models.

A BYOC deployment has two parts:

  • The data plane runs in your cloud account. It holds your SubImage application and your data.
  • The control plane runs in SubImage's accounts. It deploys, upgrades, and monitors the data plane, and holds no copy of your data.
graph LR
    subgraph "SubImage control plane"
        CP[Deployment management<br/>manage.subimage.io]
        SVC[SubImage shared services]
    end

    subgraph "Your cloud account"
        K8S[Kubernetes cluster<br/>SubImage application]
        DB[(Databases and<br/>object storage)]
        G[(Graph<br/>Private Graph only)]
    end

    U[Your users] -->|HTTPS, your domain| K8S
    CP -->|Deploy, upgrade, monitor| K8S
    K8S --> DB
    K8S --> G
    K8S -->|Sign-in, AI, telemetry| SVC
    K8S -->|Read-only scan| C[Your cloud accounts<br/>and tools]

What runs in your account

SubImage creates these resources in your account, in the region you choose:

  • A Kubernetes cluster: Amazon EKS on AWS, Google Kubernetes Engine (GKE) on Google Cloud. It runs the SubImage application, the jobs that sync your data, and the Agent Sandbox.
  • A network for the cluster, with the databases in private subnets.
  • A PostgreSQL database and a Valkey cache.
  • Object storage buckets for application files.
  • Secrets in your cloud secret manager.
  • For BYOC with Private Graph only: three Neo4j servers, their disks, and a backup bucket.

Your users reach the application through an HTTPS load balancer on a domain you choose.

What the control plane does

The control plane:

  • creates and updates the resources listed above;
  • installs and upgrades the SubImage application;
  • watches the health of the deployment.

You manage your deployment at manage.subimage.io. See BYOC onboarding.

Services your deployment uses

Your deployment connects to these services outside your account:

Service Provider What it receives
Deployment management SubImage Infrastructure status and configuration. No application data.
Graph (BYOC plan only) Neo4j AuraDB Your graph: the inventory and relationships of your connected accounts and tools.
Sign-in WorkOS User identities and sign-in events.
AI features OpenAI Chat messages and the data the AI agent reads to answer them.
Error reports Sentry Application errors, with the context of the request that failed.
Product analytics PostHog How users use the interface.
Metrics and logs Grafana Cloud Cluster metrics and application logs.
Private connectivity Tailscale Connection setup for SubImage Outposts. Traffic is encrypted end to end.
SubImage services SubImage Container images, vulnerability intelligence, and credentials for OAuth integrations.

With BYOC with Private Graph, the graph stays in your account and Neo4j AuraDB is not used.

The Data Processing Agreement lists the sub-processors under contract.

What SubImage reads

The deployment reads your cloud accounts and tools in the same way in every model: through read-only roles and tokens that you create and own. The module setup guides list the access for each source. The account that hosts BYOC does not need to be one of the accounts that SubImage scans.

On this page
What runs in your accountWhat the control plane doesServices your deployment usesWhat SubImage reads