> For the complete documentation index, see [llms.txt](https://documentation.grax.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.grax.com/technology/overview/readme.md).

# Architecture

GRAX is a single-tenant backend service that backs up a CRM provider (Salesforce or Veeva Vault CRM) and depends on compute, a PostgreSQL database, blob storage, and network connectivity. The application and the storage bucket can each run in your cloud account or in GRAX's, in any combination.

![](https://609800358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F65JiuVU9UKdqlui90FHW%2Fuploads%2Fgit-blob-9c9eab2eebfef6d92388c6ec38a39ef575574888%2Farchitecture.drawio.svg?alt=media)

## Components

| Component               | Role                                                                     | Requirements                                                                                      |
| ----------------------- | ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------- |
| Compute                 | Runs the GRAX Application; stateless and replaceable                     | [Compute](/technology/requirements/technical-requirements.md#compute)                             |
| PostgreSQL              | Application metadata                                                     | [PostgreSQL](/technology/requirements/technical-requirements.md#postgresql)                       |
| Blob storage            | Backed-up CRM data, metadata, and files; in your cloud account or GRAX's | [Blob Storage](/technology/overview/blob-storage.md)                                              |
| Ingress                 | Users and the CRM provider reach the app                                 | [Application URL](/technology/requirements/network-requirements.md#application-url)               |
| Network security        | Ingress and egress filtering, such as a firewall or VPC gateway          | [Recommended Additions](/technology/requirements/technical-requirements.md#recommended-additions) |
| Egress to `hq.grax.com` | Updates, licensing, telemetry                                            | [Network Requirements](/technology/requirements/network-requirements.md)                          |

{% hint style="warning" %}
Operating outside the requirements linked above causes data integrity issues, data loss, contractual problems, and service outages. In particular:

* Only one GRAX Application may be running for a given license.
* Only one GRAX Application may be talking to the storage bucket and the database.
* Storage bucket performance must be on par with documented S3 performance metrics.
* Egress to `hq.grax.com` must be available at all times, and the GRAX Application must remain online to receive updates. See [Staying Online](/technology/operate/updates-and-availability.md#staying-online).
  {% endhint %}

## Reference Architectures

Diagrams show current defaults, which are subject to change; sizes and plans can be changed when you deploy.

### AWS (GRAX-managed)

A GRAX-managed AWS deployment has no load balancer and no inbound access. Users and the CRM provider reach the app through its secure endpoint, which the app connects out to.

![](https://609800358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F65JiuVU9UKdqlui90FHW%2Fuploads%2Fgit-blob-1588b0b647d1b6d2503309e9deaaec1b3f13f281%2Faws-grax-managed.drawio.svg?alt=media)

### AWS (Self-managed)

For a self-managed deployment on your own domain, put an Application Load Balancer with AWS WAF in front of the app and send egress through a regional NAT gateway. Both span every availability zone you use.

![](https://609800358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F65JiuVU9UKdqlui90FHW%2Fuploads%2Fgit-blob-9e9997c0d61b919145f3d2fae912321915e0676c%2Faws-self-managed.drawio.svg?alt=media)

### Azure (GRAX-managed)

A GRAX-managed Azure deployment follows the same pattern as AWS: no load balancer, no inbound access, and a secure endpoint that the app connects out to.

![](https://609800358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F65JiuVU9UKdqlui90FHW%2Fuploads%2Fgit-blob-8abfb2aae33f34303b05d654b59afd745f0d3a7c%2Fazure-grax-managed.drawio.svg?alt=media)

### Heroku (GRAX-managed)

On Heroku, the Heroku router serves the app on a `*.herokuapp.com` address or your own domain. There's no secure endpoint.

![](https://609800358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F65JiuVU9UKdqlui90FHW%2Fuploads%2Fgit-blob-7d45042bb6ffeec2660169e38e94f694ce14c83d%2Fheroku-grax-managed.drawio.svg?alt=media)