Enterprise Architecture
How Wytness handles your data, what your firewall needs to allow, and how Business and Enterprise deployments compare.
Platform Architecture
On Starter and Growth, the entire platform runs in Wytness-hosted storage. On Business and Enterprise, the append-only Azure Blob archive of your audit events lands in your own cloud subscription via Bring-Your-Own-Storage (BYOS); you can choose to enable Azure Blob immutability_policy on your bucket. Enterprise additionally includes a dedicated customer success manager, custom contract terms, and the customer-audit support pack.
Network & Firewall Requirements
The SDK makes a single outbound HTTPS call. No inbound connections to your agent runtime or private network, no VPN, no peering required. With BYOS on Business and Enterprise, Wytness additionally connects out to the storage endpoints you nominate — those endpoints must be internet-reachable and accept connections from Wytness.
| Direction | Protocol | Destination | Port | Purpose |
|---|---|---|---|---|
| Your network → Wytness | HTTPS (TLS 1.2+) | api.wytness.ai | 443 | SDK event ingestion |
| Wytness → your Blob endpoint (BYOS) | HTTPS (TLS 1.2+) | <account>.blob.core.windows.net | 443 | Audit archive writes + reads |
| Wytness → your ClickHouse (BYOS) | HTTPS on 8443/443; plain HTTP on other ports | Your ClickHouse endpoint | 8443 recommended | Event inserts + dashboard queries |
| FQDN | Purpose | SDK needs access? |
|---|---|---|
| api.wytness.ai | API (ingest, query, auth) | Yes |
| app.wytness.ai | Customer dashboard | No (browser only) |
| www.wytness.ai | Marketing site & docs | No |
Data Flow
Your AI agent performs a tool call, API request, or decision. The SDK captures identity, action, data hashes, and outcome.
The hash chain link is computed locally and the canonical event is signed with your Ed25519 envelope key (private key never leaves your environment). Declared PII fields are pseudonymised before the event leaves.
SDK sends the signed event via HTTPS with API key authentication. The API verifies the envelope signature, then writes to the analytics store and the append-only archive in the same request.
The analytics store holds a live queryable copy for hot query. The archive holds an append-only 7-year copy (long-term retention with a soft-delete recovery window) used for replay, audits, and integrity rebuilds.
The anomaly engine continuously scans for behavioural drift. Integrity checks reconcile the live store against the archive and surface any mismatch.
Dashboard provides event search, session replay, agent monitoring, chain verification, and anomaly alerts. Compliance teams export and review.
Encryption
| Layer | Method | Detail |
|---|---|---|
| Edge protection | Cloudflare | API proxied — WAF, DDoS protection, rate limiting, CDN. Included in all managed tiers. |
| In transit | TLS 1.2+ | All endpoints. Origin certificate on API, cloud-managed certificates on web apps. |
| At rest | AES-256 | All stored data encrypted with platform-managed keys. BYOS archives (Business and Enterprise) follow your own storage account's encryption configuration. |
| Event integrity | Ed25519 | Customer-held private key. Per-org key registration. |
| Hash chain | SHA-256 | Each event references previous event's hash. |
| PII protection | HMAC-SHA256 | Optional pseudonymization with customer-held key. |
Deployment Models
| Aspect | Starter / Growth | Business | Enterprise |
|---|---|---|---|
| Infrastructure | Wytness managed platform (per-org isolation) | Wytness managed platform (per-org isolation, BYOS storage) | Wytness managed platform (per-org isolation, BYOS storage) |
| Data storage | Wytness-hosted | Your Azure Blob in your tenancy (BYOS) | Your Azure Blob in your tenancy (BYOS standard) |
| Data residency | Australia East (Sydney) | Your storage region (BYOS)Wytness platform stays in Australia East; BYOS controls where your raw audit data lands. | Your storage region (BYOS)Sovereign compute regions on the roadmap. |
| Network | Public TLS | Public TLS | Public TLSPrivate endpoints on the roadmap. |
| Signing key | Customer-held | Customer-held | Customer-held |
| Backups | Wytness-managed | Wytness-managed | Wytness-managed |
| Updates | Automatic | Automatic | AutomaticManaged canary rollouts on the roadmap. |
| SLA | 99.5% (Starter) / 99.9% (Growth) | 99.9% | Custom — defined per order form |
On the roadmap
These Enterprise-tier capabilities are scoped but not yet built. They are sales-led conversations today — talk to us about timeline and scope before signing if any of these are blocking requirements.
- Private endpoints — PrivateLink / Private Endpoint into the ingest API for customers who cannot allow public-internet egress to
api.wytness.ai. - Sovereign compute regions — a Wytness platform deployment in EU, US East, or another sovereign region (today the platform runs in Australia East regardless of where your BYOS storage sits).
- Managed canary rollouts — per-customer scheduling of platform updates so regulated change- management windows can govern when new platform versions reach your tenant (today all customers receive automatic rollouts).