Platform services

Console, Access Manager, Streaming Hub, Multi-tenancy, and Observability: the services that serve every Lerian product, what each one owns, and what you keep.

Console, Access Manager, Streaming Hub, Multi-tenancy, and Observability are platform services. They are not products themselves.

In BYOC, Console, Access Manager, Streaming Hub, and Observability run in your own cloud or data center, alongside the products. In Lerian Cloud, Lerian operates all five for you.

​

The five services

---

Lerian Console

One web interface for the products that ship a Console module.

Access Manager

Authentication and authorization for protected Lerian products: tokens, users, groups, applications, and MFA.

Streaming Hub

Delivers platform events to destinations you own: webhook, pull cursor, SQS, RabbitMQ, and EventBridge. It consumes the internal stream and never produces onto it.

Multi-tenancy

One deployment serves independent tenants. Each product derives tenant context according to its own authentication contract.

Observability

Products export traces, metrics, and logs over OpenTelemetry to a collector.

​

How the services sit around the products

---

The diagram shows five interactions.

1. Your application sends a bearer token to a product route that Access Manager protects. The product asks Access Manager whether that subject may perform the route’s action, then admits or rejects it.
2. Lerian Console reads and writes access data through Access Manager, and operates each product module.
3. Streaming Hub matches events on the internal stream against your subscriptions and delivers each match.
4. Products push traces, metrics, and logs over OTLP to the collector address you set.
5. Your identity provider, when you run one, plugs into Access Manager as an upstream provider.

​

Services and products

---

Service	Midaz	Tracer	Matcher	Flowker	Lender	Reporter	Streaming Hub	Brazil Rails and Interfaces
Access Manager	protected routes	protected routes	bearer token on protected routes	protected routes	protected routes, public jurisdiction reads	resource and action per route	the control plane	bearer token on protected routes, default differs per rail
Console	Midaz Module, with the plugins the Plugins screen shows	module	module	module	module	module	module	Pix Indirect (BTG), Payments, and, when enabled, Bank Transfer (TED JD)
Streaming Hub	fact topics	fact topics	fact topics	workflow trigger	fact topics	—	—	per rail
Multi-tenancy	organizations, ledgers, accounts, transactions	per-tenant database connections	reconciliation resources	per-tenant database connections	tenant from the validated identity	data sources and reports	subscriptions isolated by tenant	per rail
Observability	OTLP export	OTLP export	OTLP export	OTLP export	telemetry toggle and endpoint	OTLP push	OTLP export	OTLP export

​

What you bring and what Lerian ships

---

You bring:

• Cloud infrastructure and Kubernetes clusters.
• Database administration and backups.
• Network security, container patching, and secrets management.
• Your monitoring pipelines and the collector that receives telemetry.
• The destinations Streaming Hub delivers to.
• Your identity provider. It connects to Access Manager as an upstream provider and does not replace the identity backend.

Lerian ships:

• Helm charts for supported products and infrastructure components, through an OCI-compatible registry.
• Terraform examples for the base infrastructure Midaz needs on AWS, GCP, or Azure.
• Lifecycle Management for BYOC: an agent in your cluster, through which Lerian installs and upgrades products.
• Access Manager and Lerian Console.

​

Adopt one service at a time

---

1. Access Manager

   Get the Auth and Identity services running with Caradhras, PostgreSQL, and Valkey. Then turn enforcement on per product. Install first, validate, then enable.

2. Lerian Console

   Point the Console at Access Manager. Its user and application screens read and write that data.

3. Streaming Hub

   In BYOC, Lerian installs and upgrades Streaming Hub in your cluster through Lifecycle Management. Its API routes require an Access Manager token.

4. Observability

   Deploy a collector in your Kubernetes cluster. Then configure the product workloads that support it to send telemetry to it.

Multi-tenancy is not a step in that order. Lerian Cloud provides it.

​

Deploy and operate

---

Helm charts

Install and upgrade the published charts.

Lifecycle Management

Lerian installs and upgrades products in your cluster through an agent that you install.

Licensing

How a Lerian product validates its license key, and what each result allows.

Terraform examples

Create the network, DNS, database, and Kubernetes base Midaz needs on AWS, GCP, or Azure.

​

Where to go next

---

Deployment models · Multi-tenancy · What is Access Manager? · What is Lerian Console? · Streaming Hub quick start