> For the complete documentation index, see [llms.txt](https://documentation.grax.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.grax.com/technology/overview/readme.md).

# Architecture

GRAX is a single-tenant backend service that depends on compute, a PostgreSQL database, blob storage, and network connectivity, whether it runs in your cloud account or in GRAX's.

![](https://609800358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F65JiuVU9UKdqlui90FHW%2Fuploads%2Fgit-blob-faa2d64c7775675e7c17306c03b5ce3e620c3a2b%2Farchitecture.drawio.svg?alt=media)

## Components

| Component               | Role                                                            | Requirements                                                                                      |
| ----------------------- | --------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| Compute                 | Runs the GRAX Application; stateless and replaceable            | [Compute](/technology/requirements/technical-requirements.md#compute)                             |
| PostgreSQL              | Application metadata                                            | [PostgreSQL](/technology/requirements/technical-requirements.md#postgresql)                       |
| Blob storage            | Backed-up Salesforce data, metadata, and files                  | [Blob Storage](/technology/overview/blob-storage.md)                                              |
| Ingress                 | Users and Salesforce reach the app                              | [Application URL](/technology/requirements/network-requirements.md#application-url)               |
| Network security        | Ingress and egress filtering, such as a firewall or VPC gateway | [Recommended Additions](/technology/requirements/technical-requirements.md#recommended-additions) |
| Egress to `hq.grax.com` | Updates, licensing, telemetry                                   | [Network Requirements](/technology/requirements/network-requirements.md)                          |

{% hint style="warning" %}
Operating outside the requirements linked above causes data integrity issues, data loss, contractual problems, and service outages. In particular:

* Only one GRAX Application may be running for a given license.
* Only one GRAX Application may be talking to the storage bucket and the database.
* Storage bucket performance must be on par with documented S3 performance metrics.
* Egress to `hq.grax.com` must be available at all times, and the GRAX Application must remain online to receive updates. See [Staying Online](/technology/operate/updates-and-availability.md#staying-online).
  {% endhint %}

## Reference Architectures

Diagrams show current defaults, which are subject to change; sizes and plans can be changed when you deploy.

### AWS (GRAX-managed)

A GRAX-managed AWS deployment has no load balancer and no inbound access. Users and Salesforce reach the app through its secure endpoint, which the app connects out to.

![](https://609800358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F65JiuVU9UKdqlui90FHW%2Fuploads%2Fgit-blob-a52f97ecf0d3ffe1339c727d68ac4b95d1f0551a%2Faws-grax-managed.drawio.svg?alt=media)

### AWS (Self-managed)

For a self-managed deployment on your own domain, put an Application Load Balancer with AWS WAF in front of the app and send egress through a regional NAT gateway. Both span every availability zone you use.

![](https://609800358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F65JiuVU9UKdqlui90FHW%2Fuploads%2Fgit-blob-a43a57fdd853698a58320b55dd6e22865e793537%2Faws-self-managed.drawio.svg?alt=media)

### Azure (GRAX-managed)

A GRAX-managed Azure deployment follows the same pattern as AWS: no load balancer, no inbound access, and a secure endpoint that the app connects out to.

![](https://609800358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F65JiuVU9UKdqlui90FHW%2Fuploads%2Fgit-blob-5209b76fa7ca061d3e3e0dea7dc4d065a3f973e2%2Fazure-grax-managed.drawio.svg?alt=media)

### Heroku (GRAX-managed)

On Heroku, the Heroku router serves the app on a `*.herokuapp.com` address or your own domain. There's no secure endpoint.

![](https://609800358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F65JiuVU9UKdqlui90FHW%2Fuploads%2Fgit-blob-ea6c2ef2f7717decfa3462af502a001e3125ebbe%2Fheroku-grax-managed.drawio.svg?alt=media)