Your agent telemetry. Your AWS deployment.
BYOC runs the whole of axonpush inside your own AWS account, the same build we run ourselves. Not a stripped-down subset, not a different codebase.
Licences are issued case by case, and a key binds to the first AWS account that uses it.
An installer, not a deployment project from scratch
No source tree and nothing built on your machine. The installer downloads a signed release bundle of prebuilt artifacts and deploys it with the AWS CDK, recording the version you are running against your licence. A valid licence and AWS credentials are required, plus the AWS CLI, Node and Go; no Docker, no container registry. AWS usage charges apply.
$ curl -fsSL https://get.axonpush.xyz/install.sh | sh
✓ aws account 4•••••••2109 · eu-west-1
✓ licence activated and bound
✓ fetched the signed release bundle
✓ deployed · 0 ec2 · 0 vpc · 0 nat · 0 docker
✓ database self-bootstrapped
✓ https://axonpush.acme.internalNo application servers or analytics cluster to manage.
Lambda, Aurora DSQL, S3, SQS and EventBridge. No VPC, no NAT, no Redis, no EC2 accruing CVEs, no database instance to size or patch. AWS storage, requests and configured services still incur charges; serverless does not mean a zero-cost deployment.
The same build we run, from the same source, version-pinned. Semantic trace-content intelligence is optional. Enabling it can send configured content to a model provider. Review consent, redaction, provider settings and budgets against your data requirements.
curl -fsSL https://get.axonpush.xyz/install.sh | shdeploy into your accountcurl -fsSL https://get.axonpush.xyz/install.sh | shre-run to update in place
Built on Aurora DSQL.
The relational half of axonpush runs on Amazon Aurora DSQL: identity, organizations, API keys and the audit log. It is Postgres, but serverless and active-active, reached over a public IAM-authenticated endpoint, so there is no cluster to size, no failover to rehearse, and nothing to patch.
It is the reason BYOC is one command with no database to operate. The durable store, Aurora DSQL, holds every event in one table, with large payloads spilled to S3; both are serverless and AWS-managed, so in your own account there is no database instance to provision. AWS usage and storage charges still apply.
| Serverless Postgres | the relational store, with no instance to size, patch, or fail over |
|---|---|
| Reached over IAM | a public, IAM-authenticated endpoint, so there is no VPC or NAT gateway to run |
| Usage-based compute | AWS storage and service charges still apply |
| Active-active | multi-writer and self-healing; no failover to plan or rehearse |
| In your account | the relational store is deployed in your AWS account |
Inspect the licence heartbeat.
Once an hour, your deployment sends eleven fields: version, git SHA, region, account id, whether analytics is on, two event counters, an event count and table size from the database's own metadata, and one word of health. That is the licence heartbeat, not a list of every possible outbound data flow.
No payloads, no span attributes, no trace content, no prompts, no model output, no names, no credentials. Your instance renders the exact JSON at /license/telemetry-preview before it sends it. Optional model-provider analysis and support diagnostics are separate data flows to review before enabling them.
{
"version": "2026.8.3",
"gitSha": "81ed3e3",
"region": "eu-west-1",
"awsAccountId": "410000002109",
"deploymentMode": "selfhost",
"analyticsEnabled": true,
"eventsThisPeriod": 1284551,
"eventsSinceLastBeat": 4127,
"tableItemCount": 9930418,
"tableSizeBytes": 41203847168,
"health": "ok"
}What breaks if we go away.
Each check-in returns an Ed25519-signed entitlement valid for fourteen days. Block control.axonpush.xyz at your firewall and the deployment keeps running until it expires. There is no cross-account role and nothing inbound; everything is pulled by your instance on its own schedule.
| 7 days before expiry | A warning banner. Ingest unaffected. |
|---|---|
| 5 days past it | Grace period. Ingest still unaffected. |
| After that | Ingest and changes refused with a 402. |
| Throughout | Reads never block. Dashboard, history and exports keep working. |
| On renewal | Ingest resumes. Nothing to restore. |
No SOC 2 yet.
We would rather say that plainly than imply a certification we do not have. When one exists it will be dated here. Every control listed is already running.
| Scoped API keys | bound to org, app, environment and optionally one channel; a leak is bounded |
|---|---|
| Encryption | in transit on every hop and at rest, under AWS-managed keys |
| Tenant isolation | enforced at the query layer, not left to application code |
| Audit log | immutable: actor, IP, timestamp and delta on every org-level action |
| RBAC | owner, admin and user, with ownership transfer as a product action |
Questions procurement asks
Can you reach into our account?
- No. There is no cross-account role and nothing inbound; everything is pulled by your instance on its own schedule. Support diagnostics are a directive your instance chooses to build and upload, redacted, recorded in your own audit log.
Do we need Docker and a source tree?
- No, neither. Nothing is built on your machine and there is no container registry. The installer downloads a signed release bundle of prebuilt Lambda artifacts and deploys it with the AWS CDK; the version you are running is recorded against your licence. You need the AWS CLI, Node and Go on the machine you run it from.
How is a licence issued?
- Case by case, not self-serve. A key binds to the first AWS account that uses it and a second is refused outright. Tell us the constraint that rules out hosted, residency, procurement, an internal policy, because it usually changes what we recommend.
Run it where your data already lives.
Licences are issued case by case. Tell us the constraint that rules out hosted and we will come back to you.