Platform architecture · for sponsoring organizations
The architecture
behind Atlis Health.
A walkthrough of how Atlis Health is built — the components, the way they scale, and the boundaries that protect each organization's data.
Built on AWS. Multi-tenant by default. Single-tenant on request.
At a glance
Production-grade AWS, end to end.
Every layer is a managed AWS service — no servers to patch, no clusters to babysit, no manual scaling.
- Region
- us-east-2 · Ohio
- Compute
- Lambda · serverless
- Database
- Aurora · serverless v2
- Auth
- Cognito · JWT
- 01 Multi-tenant by design — every organization is its own isolated world.
- 02 Auto-scaling at every layer — compute, database, and CDN scale on demand.
- 03 Defense-in-depth security — JWT, RLS, IAM, and Secrets Manager working together.
- 04 Single-tenant available — dedicated stacks for organizations that need them.
The stack
Six layers, all managed by AWS.
Infrastructure is declared in AWS CDK and provisioned with one command — every environment is reproducible.
Tenancy model
Each organization is its own world.
A world is a private container with its own members, personas, conversations, knowledge, and audit log. Worlds never see each other's data.
Owner, admin, member
Each user belongs to one or more worlds with explicit roles. Domain-routed sign-in maps employees automatically to the right organization.
Per-world context
Every persona's memory, documents, and conversation history live inside the world that produced them — never shared across organizations.
Roles & playbooks
Atlis personas are catalog-defined and per-world enabled. Each organization can tune which personas are available to its people.
Per-world metering
Token use, voice minutes, and AI cost are metered per turn and rolled up per world — finance has a clean line of sight into spend.
Database
Aurora Serverless v2 scales the database itself.
A managed PostgreSQL 15 cluster that grows and shrinks with load — no scheduled maintenance, no capacity planning meetings.
0.5 → 256 ACUs
Capacity is measured in Aurora Capacity Units and adjusted in increments of 0.5 ACU in roughly a second. Idle clusters shrink; busy ones grow without operator action.
Up to 15 read replicas
Read traffic can be spread across replicas in additional Availability Zones. Replica lag is typically tens of milliseconds.
Auto-growing to 128 TB
Aurora storage is decoupled from compute and grows in 10 GB increments automatically — no resize windows, no downtime.
Multi-AZ failover
Six-way replication across three Availability Zones. Failover to a healthy replica typically completes in under 30 seconds, transparent to the application.
Point-in-time restore
Continuous backup to S3 with second-level point-in-time restore for the configured retention window — measured in days, not snapshots.
Performance Insights
Per-query load and waits are exposed in CloudWatch and Performance Insights — slow queries surface before users notice them.
Compute & edge
Stateless handlers behind a global edge.
Every API route is a Lambda function that scales to traffic in milliseconds. Static assets ride CloudFront so the first byte is always close to the user.
On-demand concurrency
Each request gets a fresh, isolated execution environment. The default account ceiling is 1,000 concurrent invocations and is raised on request — there is no fleet to provision.
SSE chat & voice
Lambda Function URLs stream tokens and TTS audio directly to the browser via Server-Sent Events — no WebSocket gateway, no long-lived sockets to manage.
CloudFront via Amplify
The frontend ships through Amplify's CDN with edge caching, automatic TLS, HTTP/2, and security headers configured in amplify.yml.
Background workers
Heavy work — conversation summarization, usage aggregation, trial expiry — runs in dedicated Lambdas on schedules or async invocations, never on the request path.
gen2-engine tool loop
A shared Node.js engine handles model selection, prompt directives, parallel tool execution, and per-turn token metering — versioned and pinned per release.
CDK + Amplify CI
Infrastructure is one CDK stack; the frontend is a continuous deploy from the main branch. A new region or new tenant is a configuration change, not a project.
Security
Defense in depth, not a single wall.
Authentication, authorization, isolation, and audit are independent layers — a flaw in any one of them is contained by the others.
world_id into the token claims. Lambdas never accept a world id from the request body — only from the verified JWT.WHERE world_id = $1. Membership and role are checked before any sensitive operation — admins, owners, and members each have a different capability set.app.world_id. A bug in application code is contained by the database.For large organizations
When shared infrastructure isn't enough.
For enterprises with strict compliance, residency, or contractual requirements, the entire Atlis stack can be deployed as a dedicated single-tenant environment.
Shared infrastructure, isolated data.
- One Aurora cluster, partitioned by RLS and explicit
world_idfilters. - Shared Lambda fleet, shared API Gateway, shared Cognito user pool.
- Best operational economics — fastest to provision a new organization.
- Suitable for the vast majority of customers.
A dedicated stack, just for you.
- Dedicated Aurora cluster in your own VPC, with its own backups and replicas.
- Dedicated Cognito user pool, dedicated API Gateway, dedicated Lambdas.
- Custom domain, custom KMS keys, region of your choice — including data-residency regions.
- Contractual SLAs, custom retention windows, and your own audit-log destination.
Single-tenant deployments share the same codebase as the multi-tenant platform — every release ships to both. There is no "enterprise fork."
In summary
An architecture that grows with your organization.
- Managed AWS services from edge to data — nothing to operate.
- Aurora Serverless v2, Lambda, and CloudFront scale on demand.
- Identity, authorization, isolation, and audit as independent layers.
- Single-tenant deployments available when shared isn't enough.
Talk to the Atlis team about a single-tenant deployment, a security review, or a deeper architecture session.