> ## Documentation Index
> Fetch the complete documentation index at: https://platform.atlan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform architecture

> How the Agent Registry is built and operated on AWS, where your data lives, and what reaches it. A logical view for security and architecture reviewers.

Atlan Agent Registry is a multi-tenant SaaS platform hosted on AWS and
operated by Atlan. This page shows the planes it is built from, the trust
boundaries between them, and the path a request takes. It is written for a
reviewer with no access to Atlan's internal systems.

<img src="https://mintcdn.com/atlan-602e2b74/hfXzp2LqZpxU1JCX/assets/architecture/agent-registry-architecture.png?fit=max&auto=format&n=hfXzp2LqZpxU1JCX&q=85&s=b544f0a34501150d5f680e061a8a79d3" alt="Agent Registry architecture: humans and agents reach a global edge, which routes sign-in to a global control plane and requests to a regional context plane; only the context plane reads and writes the regional data plane" width="3840" height="2160" data-path="assets/architecture/agent-registry-architecture.png" />

## How a request travels

1. **Sign in.** People sign in through your identity provider using
   enterprise SSO. Agents, CLIs and integrations use API keys or OAuth
   clients. The platform issues short-lived tokens; Atlan never sees your
   identity-provider password.
2. **Scope to one organization.** The Registry pins every request to one
   organization and one workspace before doing any work. There is no query
   path that crosses organizations.
3. **Read and write through one path.** Only the context plane can reach
   the data plane. Your context is stored encrypted at rest and isolated per
   organization.
4. **Stay in your region.** The context plane and data plane are deployed
   per region. Your context does not leave the region your organization
   runs in.

## The three planes

| Plane         | Scope    | What it does                                                                                                 | What it holds                                                           |
| ------------- | -------- | ------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------- |
| Control plane | Global   | Identity and sign-in, access control, workspaces, roles, credentials for people and agents                   | Identities, permissions, organization metadata                          |
| Context plane | Regional | The Registry: registers, discovers, governs, observes and improves skills, agents and context on your behalf | No durable customer data; processes requests                            |
| Data plane    | Regional | Stores that hold your organization's context                                                                 | Relational database, object storage, encrypted secrets, telemetry store |

The planes run in separate AWS accounts. The context plane is the only plane
with a network path to the data plane.

## Where your data lives

Everything your organization registers lives in the regional data plane.

| Store               | Holds                              | Isolation                                            |
| ------------------- | ---------------------------------- | ---------------------------------------------------- |
| Relational database | Durable context and search indexes | Organization identifier on every record              |
| Object storage      | Skills, files and bundles          | One key prefix per organization                      |
| Encrypted secrets   | Credentials your agents may use    | Envelope encryption, revealed only to your workloads |
| Telemetry store     | Traces and evidence from agents    | Partitioned per organization                         |

All four are encrypted at rest with keys held in the owning AWS account. Data
in transit between your clients and the platform, and between the platform
and the relational database, is encrypted with TLS. Traffic inside the data
plane's private network is bounded by network controls.

## Trust boundaries

* **One public entry.** Humans and agents reach the platform through a
  global edge network. The edge is the only internet-facing entry point;
  databases, Kubernetes APIs and administrative tooling are not reachable
  from the internet.
* **Planes in separate accounts.** Control, context and data planes are
  isolated AWS accounts with no shared credentials. Only the context plane
  holds a path to the data plane.
* **Federated identity everywhere.** People, pipelines and workloads use
  short-lived federated credentials. No long-lived cloud access keys exist
  on the platform.
* **Staff access is time-boxed.** Atlan engineers have no standing write
  access to production and cannot read customer data by default. Elevated
  access is approved per task, expires within hours, and is logged to an
  immutable audit trail.

## Deployment options

| Option                                | Availability |
| ------------------------------------- | ------------ |
| Shared regional deployment (US)       | Available    |
| Additional regions                    | Roadmap      |
| Dedicated data plane per organization | Roadmap      |
| Customer-owned object storage         | Roadmap      |

## What this page does not cover

Internal network topology, account identifiers, address ranges and
operational tooling are intentionally omitted. For the detailed security
overview, sub-processor list, encryption standards and questionnaire
answers, contact your Atlan account team.