Architectural freedom.
Operational certainty.
Almagos is a Managed Open Source Platform for Agentic Commerce. Build using the open source technologies you choose, deploy into your own cloud, and let Almagos manage the platform lifecycle.
System Architecture
The system is physically decoupled. Control logic remains with Almagos, while all compute, data, and execution remain securely inside your environment boundaries.
Managed by Almagos
Owned and operated by Customer
FIG 1.0 — Architecture boundary separating management logic from data execution.
Architectural Principles
Managed Open Source
Leverage the innovation of open source without the operational burden. We provide day-two operations, patching, and scaling for open source engines.
Bring Your Own Cloud
We deploy directly into your AWS, GCP, or Azure accounts. You maintain complete control over infrastructure, networking, and data sovereignty.
Absolute Decoupling
The Control Plane and Data Plane communicate exclusively over mTLS. If the Control Plane becomes unreachable, your Data Plane continues to serve traffic.
Separation of Concerns
A clear demarcation line between management and execution ensures absolute data privacy and prevents vendor lock-in at the infrastructure layer.
Almagos Control Plane
A globally distributed system that orchestrates platform state, manages security credentials, and aggregates telemetry. It never processes customer transactions.
- LocationAlmagos Cloud
- ConnectionOutbound-only mTLS
- Data AccessNone (Zero Trust)
- ScalingFully Managed
Customer Data Plane
The dedicated Kubernetes environment running inside your VPC. It executes commerce engines, houses databases, and processes all API requests.
- LocationCustomer VPC
- ComputeCustomer Kubernetes
- Data Ownership100% Customer
- ComplianceInherits Customer Stance
Execution Workflow
State changes are declarative, version-controlled, and autonomously orchestrated.
GitOps Push
Engineers push configuration changes to a connected Git repository.
Control Plane
Almagos intercepts, validates, and compiles the desired platform state.
Deployment
Updates are synchronized to the Customer Data Plane via secure tunnel.
Monitoring
Telemetry agents stream health data back for automated anomaly detection.
Lifecycle
Continuous patching and scaling occur without human intervention.
Shared Responsibility Matrix
Security and operations are a shared endeavor. We define responsibilities at the infrastructure, application, and data layers to eliminate ambiguity.
| Domain | Customer | Almagos | Shared |
|---|---|---|---|
| Infrastructure & Networking | |||
| Cloud Account & Billing | [ X ] | [ — ] | [ — ] |
| VPC Subnets & Routing | [ X ] | [ — ] | [ — ] |
| Control Plane Hosting | [ — ] | [ X ] | [ — ] |
| Platform Operations | |||
| Kubernetes Version Upgrades | [ — ] | [ — ] | [ X ] |
| Open Source Engine Patching | [ — ] | [ X ] | [ — ] |
| Cluster Autoscaling | [ — ] | [ X ] | [ — ] |
| Security & Data | |||
| Customer Data & PII | [ X ] | [ — ] | [ — ] |
| mTLS Identity Provisioning | [ — ] | [ X ] | [ — ] |
| Commerce Application Logic | [ X ] | [ — ] | [ — ] |
Frequently Asked Questions
What happens if the Control Plane goes offline?
Because the Data Plane operates inside your VPC, your commerce applications continue to run, serve traffic, and process transactions uninterrupted. The Control Plane is only required for configuration changes, scaling events, and deployments.
Which cloud providers do you support for BYOC?
We currently support native deployments to AWS (EKS), Google Cloud Platform (GKE), and Microsoft Azure (AKS). Bare metal and hybrid cloud deployments are supported via enterprise agreements.
Does Almagos have access to our customer data?
No. By design, Almagos operators cannot access your VPC, databases, or object storage. The Control Plane only receives anonymized operational telemetry (CPU usage, memory, error rates) required to manage the platform lifecycle.
Can we install custom Kubernetes controllers?
Yes. Because you own the underlying cluster, you maintain cluster-admin privileges. However, Almagos defines specific namespaces for managed components. You are free to run supplementary workloads alongside the Almagos Data Plane.