Control plane and data plane, cleanly separated.

FabriCloud Control Plane

The management layer. It compiles policy, plans and reconciles deployments, brokers identity, exposes every API and aggregates telemetry — operating only on metadata, configuration and control signals. Run it as a managed service or self-host it in your own tenant; in neither case does it store or process your data. A continuous reconciliation loop drives each data plane toward its declared desired state.

• Managed or self-hosted
• Metadata & config only — never data
• Desired-state reconciliation
• Multi-data-plane fleet management
• Stateless, horizontally scalable
• Signed, auditable control channel

FabriCloud Data Plane

The runtime that lives inside your environment. It hosts the connectors, the query and compute engines, the catalog indexes and the local policy-enforcement points, executing compiled policy and work specifications against data in place. One control plane can govern many data planes — per region, per business unit, per sensitivity tier — each fully isolated.

• Runs in your cloud / VPC / on-prem
• Single-tenant per deployment
• Local policy-enforcement points
• Holds data & indexes in your env
• Many data planes per control plane
• Operates through control-plane outages

FabriCloud Policy

Governance is declarative and centralized. You express access, masking, residency, retention, classification and quality rules as version-controlled policy; the control plane compiles them and distributes enforcement to every data plane, where they are evaluated at query time, at the source. Policies are testable, auditable and promoted through environments like application code.

• Policy-as-code, stored in git
• Access · masking · residency · retention
• Query-time enforcement at source
• Classification- & tag-driven rules
• Dry-run & impact simulation
• Environment promotion & rollback

FabriCloud Identity

FabriCloud federates to your identity provider rather than becoming a parallel one. Users and groups arrive through SSO and SCIM; entitlements are expressed as role- and attribute-based rules evaluated at query time, down to row, column and cell. Service and agent identities are first-class, issued short-lived, narrowly scoped credentials with full session logging.

• SAML / OIDC single sign-on
• SCIM user & group provisioning
• RBAC + ABAC
• Row, column & cell security
• Dynamic data masking
• Short-lived service & agent identities

FabriCloud Gateway

FabriCloud is MCP-first: every governed dataset, connector and tool is exposed to AI agents as native Model Context Protocol tools, so agents discover and invoke them with access enforced at the source. The same surface is available as a uniform GraphQL and REST API with typed SDKs — the web console is just another client.

• MCP-first — native tools for agents
• GraphQL + REST
• Typed SDKs (Python, TS, Go, Java)
• Webhooks & event streams
• Versioned, backward-compatible
• Scoped, revocable tokens

FabriCloud Observability

Every layer emits metrics, traces, logs and data-quality signals, tied together by lineage from source column to consumer. Operational telemetry exports to your monitoring stack; access and policy events stream to your SIEM as an immutable audit trail. Built-in dashboards cover freshness, cost, query performance and every policy decision made.

• Metrics / traces / logs (OTel)
• Column-level lineage
• Immutable, exportable audit log
• SIEM streaming
• Data-quality & freshness SLOs
• Cost & usage attribution

FabriCloud Deploy

Standing up FabriCloud is a templated, repeatable operation. Terraform modules and Helm charts provision a hardened data plane into your account with compliant defaults; cloud-marketplace listings handle billing and entitlement. Everything is GitOps-friendly, so environments are reproducible, reviewable and upgradeable — no snowflake servers.

• Terraform modules
• Helm charts
• AWS / Azure / GCP marketplaces
• On-prem & air-gapped installer
• Hardened, compliant defaults
• GitOps & automated upgrades

FabriCloud Compute

A scheduler that places query, transformation, ML-feature and agent workloads onto compute in your own account, scaling pools up and down with demand. Workloads are isolated from one another, pushed down to where the data sits to avoid movement, and can target heterogeneous compute — CPU pools, GPU pools, serverless, or your existing warehouse engines.

• Elastic autoscaling
• Per-workload isolation (namespaces)
• Pushdown to source engines
• CPU / GPU / serverless targets
• Spot- & reserved-capacity aware
• Queue priorities & quotas

FabriCloud Connect

Native, bi-directional connectors that read and write data in place — no raw data is copied into a proprietary store. Each connector understands the source’s schema, partitioning, change feed and access model, so FabriCloud can index, govern and query without lift-and-shift. Connectors run inside the data plane and authenticate with your own credentials.

• Read & write in place
• Change data capture (CDC)
• Schema discovery & drift handling
• Open table formats (Iceberg / Delta / Hudi)
• Pushdown predicates & partitions
• Credentials stay in your env

FabriCloud Graph

The engine behind the Knowledge Fabric. It resolves entities across sources, builds and stores the relationship graph, and maintains the searchable catalog and lineage — all as indexes held inside the data plane. It turns connected data into context that analytics, search and agents can query directly, without moving anything out.

• Entity resolution & matching
• Relationship / knowledge graph
• Searchable catalog & metadata
• Column-level lineage
• Vector & semantic indexes
• Indexes stay in your env

FabriCloud Network

The data plane runs entirely within your network perimeter with no public ingress to data. Control traffic and data traffic are separated, and the only outbound path is a signed, outbound-initiated control channel — there are no inbound ports on your data. Private connectivity options keep everything off the public internet.

• No public ingress to data
• Outbound-only control channel
• VPC peering / PrivateLink / PSC
• Egress allow-lists
• Private DNS resolution
• Air-gapped mode