> ## Documentation Index > Fetch the complete documentation index at: https://docs.threataware.com/llms.txt > Use this file to discover all available pages before exploring further. # Architecture > How Protect is built — cloud, isolation, integration patterns, data flow ## High-level shape ThreatAware Protect is a multi-tenant SaaS hosted on **AWS**, with logical isolation between customer tenants, encrypted-at-rest data per tenant, and a fully managed update / operations model. | | Connects out to | Over | For | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------- | -------------------------------------------------------------- | | **ThreatAware Protect** (AWS, ISO 27001 + Cyber Essentials) | Customer vendor consoles (CrowdStrike, Intune, etc.) and on-prem tools via PowerShell Relay | HTTPS 443, TLS 1.2+ | Read-only credentialed inventory sync | | **ThreatAware Protect** | Customer users (browser, Reporting, API clients, Power Automate flows) | HTTPS, TLS 1.2+ | Authenticated UI / API access via SSO, roles, and data filters | Protect itself only initiates outbound HTTPS to vendor APIs. No inbound ports are exposed in your environment — the PowerShell Relay model lets Protect reach on-prem tools by having the relay dial out. ## Tenant model | Concept | Implementation | | ------------- | -------------------------------------------------------------------------------- | | **Tenant** | One Protect environment per customer; unique subdomain (Cloud ID) | | **Isolation** | Logical isolation at the data plane; per-tenant encryption keys via AWS KMS | | **Compute** | Shared multi-tenant compute with per-request tenant context | | **Database** | Per-tenant data partitioning; cross-tenant queries blocked at the platform level | | **Storage** | Per-tenant object-storage prefixes; encrypted-at-rest | ## Data flow 1. **Sync** (every hour, per integration) 2. **Vendor API → Protect ingest** 3. **Normalize** → canonical schema 4. **Match & dedupe** (timeline algorithm) 5. **Enrich** — location, tags via Logic Engine 6. **Compute Vitals** per device/integration 7. **Update Issues** — open/close based on state changes 8. **Action Center triggers** — Continuous Actions re-evaluate 9. **Automation fires** — email / ticket / webhook 10. **UI / API serves updated state** Step 1 happens continuously, parallel per integration. Each step is independent and idempotent — failures recover cleanly on the next sync. ## Compute architecture | Component | Role | | ------------------------- | --------------------------------------------------- | | **API gateway** | Auth, rate limiting, request routing | | **App layer** | Stateless API + UI servers, autoscaling | | **Sync workers** | Per-integration ingest jobs; queue-based | | **Vitals computer** | Recomputes states after sync; per-device parallel | | **Action engine** | Watches device state for trigger matches | | **Automation dispatcher** | Outbound calls to email / ticket systems / webhooks | | **Studio runtime** | Renders Studio app code with tenant-scoped data | All compute is stateless — data lives in the database and object storage; restarts are zero-downtime. ## Integration patterns | Pattern | Used by | | -------------------------- | ------------------------------------------------------------------------------- | | **Cloud OAuth** | Entra ID, Intune, Microsoft Defender ATP, Microsoft 365 | | **Cloud API key / Bearer** | CrowdStrike, Qualys, JAMF Pro Cloud, ZScaler | | **Basic auth** | Some on-prem tools | | **PowerShell Relay** | OnPrem AD, System Center Configuration Manager (SCCM), on-prem PDQ / Lansweeper | | **SAML/SCIM** | Single Sign-On (SSO) + auto-provisioning (where supported) | The [PowerShell Relay](/powershell-relay) is the key innovation for on-prem: outbound HTTPS only, no inbound firewall rules. ## Cross-tool correlation engine This is Protect's signature component. Inputs: * Every integration's per-device payload, with timestamps * Device matching signals (serial, hostname, MAC, user, IP, timeline) * Tag rules (Logic Engine) Outputs: * Single unified device records (deduplication) * Per-device Vital states per integration * Function-stage detection: stale-in-tool-but-active-overall = broken The algorithm is patented and tuned for environments up to 100,000+ devices. ## High availability | Layer | HA approach | | ------------------ | --------------------------------------------------------------------------- | | **App servers** | Multi-AZ; autoscaling | | **Database** | Multi-AZ with hot-standby; daily snapshots | | **Object storage** | S3 with cross-region replication | | **Sync workers** | Queue-based; failed jobs retry with backoff | | **Status** | Visible at [https://status.threataware.com](https://status.threataware.com) | ## Update model Protect is a fully managed SaaS: * Continuous deployment of fixes * Backward-compatible API guarantees * Per-tenant feature flags for staged rollouts * Customer-facing changelog at the version chip You don't install or upgrade anything. The PowerShell Relay updates itself when the schedule task next runs. ## Network egress For on-prem integrations using the PowerShell Relay, outbound HTTPS 443 from the relay server. Required egress IPs / FQDNs are listed under **AWS Account / IP Whitelist Info** on the [Settings → Integrations](/settings/integrations) page. ## See also Top-level security posture Compliance frameworks Integration types and patterns