Skip to content
Back to

Architecture

Fontana deploys as two cluster layers on each host: one platform cluster for shared edge and stateless services, and one workspace cluster per tenant for the full application stack. That layout is the same on managed cloud, customer VPC, and self-hosted installs.

Topology diagram

Section titled “Topology diagram”

Platform cluster

Section titled “Platform cluster”

Shared across all workspaces on the host:

  • Edge ingress and the static welcome page (routing to workspace URLs)
  • Observability - Grafana/OTLP collection and operator dashboards
  • Docling - shared document parsing for PDF and office uploads
  • OpenSandbox - isolated code execution for agent MCP tooling
  • Platform health checks - service uptime probes for operators

The platform cluster does not hold workspace databases, Vault secrets, or workflow datasets.

Workspace cluster

Section titled “Workspace cluster”

Each workspace is a complete Fontana environment:

Area Components
Application Flow, Convex backend, workflow engine, PyAirbyte connector runtime
Data Postgres, Convex persistence, per-tenant FalkorDB (KG graph), encrypted workflow file store
Security HashiCorp Vault (BYOK, connector secrets), Zitadel identity
Observability observability-api (operational telemetry and security audit ingress)
Health In-cluster probes for Flow, engine, Convex, FalkorDB, Vault, and dependencies

There is no shared database or secret store between workspace clusters. SSO, RBAC, AI configuration, and run data stay inside the workspace boundary unless you configure egress.

What this means for you

Section titled “What this means for you”
  • Blast radius - a compromise or misconfiguration in one workspace does not grant access to another cluster’s data plane.
  • Upgrades - platform and workspace releases can be reconciled independently on the host while preserving per-workspace volumes (see Backup and restore).
  • Compliance narrative - isolation, encryption at rest, and audit routing map cleanly to this two-layer model (see Security and Compliance evidence).
Section titled “Related documentation”