The careful, boring engineering behind Rig

Rig Cloud runs on AWS in London (eu-west-2) across three availability zones, with disaster-recovery copies in Ireland (eu-west-1). An organisation policy blocks every other region. It uses six separate AWS accounts (management, security, backup, tooling, production, staging). Apps run on ECS Fargate in private subnets behind an Application Load Balancer with AWS WAF. Data lives in RDS PostgreSQL 18 (Multi-AZ for the core database), ElastiCache Valkey, EFS and S3, all encrypted with KMS and TLS. The database can be restored to any point in the last 35 days; daily backups are copied to a locked vault in Ireland, and monthly backups are kept a year. GuardDuty, Security Hub (AWS Foundational Best Practices and CIS benchmarks) and Inspector watch the accounts. Every change goes through CodePipeline, automated checks and a manual approval before production.

https://userig.app/infrastructure

NewSnag is coming: client feedback for web agencies. Join the waitlist
ChangelogStatus
Download
How Rig is built

How Rig Cloud is built and protectedThe Rig production stack

Where Rig Cloud runs, how your data is protected and backed up, and how every change is checked before it reaches you. Switch to Geek mode for the technical detail.AWS, two regions, six accounts, all defined as infrastructure as code (CDK). Every detail on this page is taken from that code.

rig / cloud · prodlive

Rig Cloud, at a glance$ rig-infra describe --env prod

  • Runs in Londonregion eu-west-2 (London)
  • Spread over 3 separate data centresazs eu-west-2a · 2b · 2c
  • A second copy of your data in Irelanddr eu-west-1 (Ireland) · backup + restore
  • Locked to those two places onlyscp deny non-global actions outside 2 regions
  • Encrypted everywhere, at rest and in transitkms per-env CMKs · rotation on · TLS end to end
  • Backups nobody can delete early, us includedvault-lock 35–400 d · deletes denied to all principals
  • 2countries, London and IrelandAWS regions, SCP-locked
  • 3data centres in Londonavailability zones
  • 6separate locked roomsAWS accounts in one org
  • 35days we can rewind todays PITR + DR copies
  • 365days of monthly backupsdays monthly AWS Backup
  • 0open security findingsopen Aikido findings (137/140 fixed)
Where it lives

Runs in London. Backed up in Ireland.eu-west-2 primary, eu-west-1 DR

Dublin, Irelandeu-west-1Your backup countryDR: backups, S3 CRR, ECR, secrets
London, UKeu-west-2Where Rig runsprimary · 3 AZs

Rig Cloud runs in Amazon’s London data centres. Not one building: three separate ones, miles apart, each with its own power and network. If one has a bad day, the other two carry on.

Every night, and continuously for the database, copies of your data travel to a second country, Ireland, into a vault in a completely separate account.

And there’s a rule over the whole lot: nothing can be switched on anywhere else. Not by accident, not by us in a hurry. Your data lives in London and Ireland, full stop.

  • Primary eu-west-2, 3 AZs. VPC with public / app (NAT egress only) / isolated data subnet tiers.
  • Region lock org SCP denies every non-global action outside eu-west-2 and eu-west-1.
  • DR data eu-west-1: RDS automated-backup replication (35 d, DR CMK), AWS Backup copy to a locked vault in a dedicated backup account, S3 cross-region replication, ECR replication, Secrets Manager replicas.
Follow a request

What happens when you press a buttonRequest path, edge to vault

Five stops, each with its own job and its own lock.Single ingress via ALB (HTTPS) and a mesh NLB (Headscale join, DERP, STUN). Nothing else accepts internet traffic.

  1. 01

    Youclient

    The Mac app, your browser or your iPhonemacOS · web · iOS over HTTPS

  2. 02

    The front doorALB + AWS WAF

    Checks every visitor and turns away known bad onesACM TLS · IP reputation · common rules · bad inputs · 300 req/5 min on /api/auth

  3. 03

    Rig’s appsECS Fargate

    Running twice over, spread across the three data centresGraviton ARM64 · 11 services, 14 tasks · private subnets, no public IPs

  4. 04

    Your dataRDS · Valkey · EFS · S3

    Kept in two data centres at once, always encryptedPostgres 18.6 Multi-AZ · Valkey 8 Multi-AZ + failover · all KMS

  5. 05

    The vaultAWS Backup → eu-west-1

    Backups in Ireland that can’t be deleted early, even by usVault Lock 35–400 d · separate backup account · deny-delete policy

Six locked rooms

If one room is broken into, the others stay shutMulti-account org, blast radius by design

Rig isn’t one big Amazon account. It’s six, each with one job, so a mistake or a break-in in one can’t spread to the rest.AWS Organizations with separate management, security, backup, tooling and environment accounts. Guardrails apply org-wide as one SCP.

  • Production

    Where Rig actually runs. Nothing else lives here.VPC, ECS, RDS, Valkey, EFS, S3, ALB/NLB, WAF

  • Security

    Keeps the record of everything that happens, locked for a year.CloudTrail archive (Object Lock, compliance, 1 y) · GuardDuty / Security Hub / Inspector delegated admin

  • Backup

    The vault in Ireland. Only backups go in; nothing comes out early.eu-west-1 vaults · Vault Lock · deny-delete

  • Tooling

    Builds Rig and stores the finished parts, checked for flaws.CodePipeline · CodeBuild · ECR (immutable tags, Inspector scans, replicated to DR)

  • Management

    Sets the house rules and the spending limits. Runs nothing.Organizations · SCP guardrails · org trail · budgets + anomaly alerts

  • Staging

    A spare room for testing. Empty for now, to keep costs down.account kept; stacks torn down 24 Oct 2026

Layers, not a wall

Five layers between the internet and your dataDefence in depth

Each layer assumes the one outside it might fail. That’s the point.Each control is in code and enforced by tests or cdk-nag; findings without a written reason fail the synth.

01At the doorEdge

Every visit is encrypted, checked against lists of known attackers, and slowed down if it hammers the sign-in page.TLS (ACM, ELB recommended policy) · AWS WAF managed rule groups · rate-based rule on /api/auth · HTTP→HTTPS 301

02In the buildingNetwork

Rig’s apps sit in private rooms with no front door to the internet. The database sits deeper still, with no way out at all.Private app subnets (NAT egress only) · isolated data subnets · SG-to-SG rules only, no CIDRs · Route 53 Resolver DNS Firewall · VPC Flow Logs

03Who can do whatIdentity

Each part of Rig gets only the keys it needs. People sign in with two-factor. Some actions are simply forbidden for everyone.Per-service task roles · no long-lived keys · Identity Center + MFA · SCP: no root, no IAM users/access keys, can’t disable logging

04The data itselfData

Encrypted when it’s stored and when it moves, even between our own machines. Database passwords change every 30 days.KMS CMKs with rotation (RDS, PI, Valkey, EFS, S3, Secrets, Logs, SNS) · TLS forced on RDS, Valkey, EFS · 30-day secret rotation

05Someone always watchingDetection

Automatic guards look for anything odd, check us against industry security standards, and email us the moment something looks wrong.GuardDuty (S3, RDS login, ECS runtime) · Security Hub: AWS FSBP v1.0.0 + CIS v3.0.0 · Inspector on every image · Config 730 d

Your datacustomer data

And the things that matter most never reach us readable: your Continuity backups and secrets are locked on your Mac before they leave. More on that in Security.Client-side: Continuity backups are AES-256-GCM encrypted on the Mac before upload; vault values use a per-Mac key. We hold ciphertext only. Details on /security.

Rewind

How far back we can goRetention, by tier

If something goes wrong, we can put things back the way they were. Here’s how far back each kind of copy reaches.A failed, aborted or expired backup or copy job pages us by email. Vault Lock becomes immutable 7 days after creation.

A week7 dSnapshots of the fast cacheValkey daily snapshots
Five weeks35 dRewind the database to any second, plus nightly copies in IrelandRDS PITR · DR replication · daily AWS Backup + DR copy
A year365 dA full backup on the 1st of every monthmonthly AWS Backup, cold after 30 d
The lock≤400 dHow long the Ireland vault can hold things, untouchableVault Lock max retention (min 35 d)
Shipping

How a change reaches youCommit to prod

No one pushes a change straight to the live system. Every change takes the same path, every time.CodePipeline + CodeBuild in the tooling account; 11 image pipelines, 3 secret-free PR check projects, a self-mutating infra pipeline.

  1. 1WrittenPR → betaA change is made and reviewedCodeConnections, no GitHub Actions
  2. 2CheckedCodeBuildRobots test it, including 27 safety rules for the infrastructuretypecheck · 27 guardrail tests · cdk synth + cdk-nag
  3. 3Built and scannedECRPackaged, stamped with an unchangeable label, checked for known flawstag = full commit SHA, immutable · Inspector enhanced scan
  4. 4A human says yesApproveProdNothing reaches you until a person approves itmanual approval in rig-infra (CDK Pipelines)
  5. 5Rolled out gentlyECS rollingNew versions replace old ones a bit at a time, and undo themselves if they stumblemin healthy 100% · circuit breaker + auto-rollback
Eyes on it

We hear about problems before you doObservability

  • Health checks every 15 secondsALB health checks · 15 s · 2 to pass

    An unwell app is taken out of rotation automatically.Unhealthy targets drained; per-service unhealthy-target alarms.

  • Alarms on everythingCloudWatch alarms → SNS → email

    Busy databases, struggling apps, unusual traffic, failed jobs: each one emails us, and emails again when it’s fixed.RDS/Valkey CPU+memory, ALB 5xx, per-service CPU/mem > 90%, NAT and relay egress, mesh join/relay health, cron failures. OK actions on.

  • Crash reports, kept in EuropeSentry (EU ingest)

    When something breaks, we see the error, not your personal details.api, web, mesh-control; scrubber strips cookies and auth before send.

  • Spending limitsBudgets + Cost Anomaly Detection

    If the bill does anything strange, we know that day. Free credits don’t hide it.Monthly + daily budgets, anomaly alerts from $20, credits excluded so spend is real.

The small print

What we haven’t done yetKnown gaps

We’d rather tell you than have you find out.

  • Ireland keeps your data, but Rig itself doesn’t run there yet. If London went down entirely, we’d bring Rig up in Ireland from those copies. A ready-to-go Ireland is being built now.DR is backup-and-restore today; eu-west-1 standby is in progress. RPO/RTO not yet set or drilled.
  • Our public status page is switched off while we replace the monitor behind it.status + Uptime Kuma at 0 tasks since 24 Oct 2026, pending replacement.
  • A couple of smaller pieces run in one data centre, not three, and would pause briefly if it failed.tools DB is single-AZ (accepts ~10–20 min AZ-loss downtime); mesh-control is a single task (Headscale is single-writer).

Want the long version?Want the rest?

Security explains exactly what leaves your Mac. Partners thanks the companies whose help built all this./security covers client-side crypto, MCP approvals, Mesh and subprocessors. Found something? help@userig.tech, subject Security.

Read SecurityMeet our partners