Platform services

Console, Access Manager, Streaming Hub, Multi-tenancy, and Observability: the services that serve every Lerian product, what each one owns, and what you keep.

Console, Access Manager, Streaming Hub, Multi-tenancy, and Observability are platform services. They serve every product and are not products themselves.

In BYOC you deploy them into your own cloud or data center alongside the products. In Lerian Cloud, Lerian operates them for you.

The five services

---

Lerian Console

One web interface for the products that ship a Console module: Midaz and its plugins, Reporter, Flowker, and Tracer. Matcher ships its own web application.

Access Manager

Authentication and authorization for every protected Lerian product: tokens, users, groups, applications, and MFA. Each product enforces access at its own routes, and Access Manager decides.

Streaming Hub

Delivers platform events to destinations you own: webhook, pull cursor, SQS, RabbitMQ, and EventBridge. It consumes the internal stream and never produces onto it.

Multi-tenancy

One deployment serves independent tenants. Each product derives tenant context according to its own authentication contract. Storage isolation is per service: a dedicated database, or a shared database with one schema per tenant.

Observability

Products export traces, metrics, and logs over OpenTelemetry to the collector you deploy in your cluster.

How the services sit around the products

---

The diagram shows five interactions.

1. Your application sends a bearer token to a product route. The product asks Access Manager whether that subject may perform the route’s action, then admits or rejects it.
2. Lerian Console reads and writes access data through Access Manager, and operates each product module.
3. Products publish domain events onto the internal stream. Streaming Hub matches them against your subscriptions and delivers each match.
4. Products push traces, metrics, and logs over OTLP to the collector address you set.
5. Your identity provider, when you run one, plugs into Access Manager as an upstream provider.

Services and products

---

Service	Midaz	Matcher	Flowker	Lender	Reporter	Streaming Hub	Brazil rails
Access Manager	protected routes	bearer token on protected routes	workflow and webhook routes	protected routes, public jurisdiction reads	resource and action per route	the control plane	bearer token on protected routes, default differs per rail
Console	Midaz Module, with the plugins the Plugins screen shows	own web application	module	—	module	—	Pix Indirect (BTG), Payments, and, when enabled, Bank Transfer (TED JD)
Streaming Hub	fact topics	fact topics	—	fact topics	—	—	Consignado fact topics
Multi-tenancy	organizations, ledgers, accounts, transactions	reconciliation resources	per-tenant database connections	tenant from the validated identity	data sources and reports	Tenant Manager supplies the roster	Lerian CCS tenant profile
Observability	ledger workloads	endpoint and resource labels	observability guide	telemetry toggle and endpoint	OTLP push	OTLP export	endpoint and resource labels

What you bring and what Lerian ships

---

You bring:

• Cloud infrastructure and Kubernetes clusters.
• Database administration and backups.
• Network security, container patching, and secrets management.
• Your monitoring pipelines and the collector that receives telemetry.
• The destinations Streaming Hub delivers to.
• Your identity provider. It connects to Access Manager as an upstream provider and does not replace the identity backend.

Lerian ships:

• Helm charts for supported products and infrastructure components, through an OCI-compatible registry.
• Terraform examples for the base infrastructure Midaz needs on AWS, GCP, or Azure.
• The Lifecycle dashboard for Enterprise BYOC.
• Access Manager and Lerian Console, as Enterprise features.

The Midaz chart lets you disable a bundled Valkey, PostgreSQL, MongoDB, or RabbitMQ and use an external service instead.

Adopt one service at a time

---

1. Access Manager

   Get the Auth and Identity services running with their PostgreSQL and Valkey dependencies. Then turn enforcement on per product. Install first, validate, then enable.

2. Lerian Console

   Point the Console at Access Manager. Its user and application screens read and write that data.

3. Streaming Hub

   Deploy the dedicated streaming-hub-helm chart, separate from any product chart. The control plane authenticates every route with an Access Manager token.

4. Observability

   Deploy a collector in your Kubernetes cluster. Then configure the product workloads that support it to send telemetry to it.

Multi-tenancy is not a step in that order. You enable it per product, and Tenant Manager registers each tenant service.

Deploy and operate

---

Helm charts

Install and upgrade every published chart through the same workflow.

Lifecycle Management

Orchestrate deployments in your own infrastructure and track versions.

Licensing

How Lerian licenses Enterprise products and plugins, and what a license check returns.

Terraform examples

Create the network, DNS, database, and Kubernetes base Midaz needs on AWS, GCP, or Azure.

Build with Narya

---

Narya runs coding agents behind one HTTP API. One long-lived host on your machine owns the sessions, the store and the model connections. Lerian ships a terminal client and a one-shot command on top of it, and you can write your own client against the same contract.

Narya

What Narya is, how you run it, and how it fits a pipeline.

The host API

One contract for every client: socket, event stream, envelopes.

Where to go next

---

Deployment models · Multi-tenancy · What is Access Manager? · What is Lerian Console? · Streaming Hub quick start