Architecture and core concepts

How VerOps is put together

Understanding the moving parts makes everything else click. VerOps has four layers:

1. Agents (where you have private resources) — small programs you run: an APM agent inside your app, synthetic/network agents inside your network, a machine agent on a host, and a Kubernetes agent in your cluster. Agents originate telemetry and run checks.
2. Ingest — telemetry flows in over open protocols (OTLP for traces/metrics, a RUM beacon for browser data) to the VerOps ingest endpoint.
3. Storage and processing — high-cardinality telemetry (traces, RUM, metrics) lives in a fast columnar store (ClickHouse); configuration, workbooks, alerts, docs and tenant data live in a relational store. Everything is multi-tenant and isolated per organization.
4. Experience — the web app at app.verops.io: dashboards, the Workbooks designer, alerting, war rooms, and this documentation.

Core concepts and vocabulary

• Organization (tenant) — your isolated workspace. All data is scoped to it.
• Service — a named application/component that emits traces (e.g. checkout-api).
• Agent — a connector that emits telemetry or runs checks. Cloud agents are VerOps-managed; private agents you host.
• Ingest / API key — credentials that authorize telemetry and API calls. Keep them secret; rotate if exposed.
• Workbook — a versioned, runnable workflow (DAG) of monitoring/automation steps.
• Alert rule — a condition that, when met, produces an alert routed by severity.
• SLO — a target for a user-facing reliability metric, tracked against an error budget.

Security model in brief

• Per-organization isolation across storage and query.
• Role-based access control (RBAC): reusable roles bundle granular permissions and gate what each member can see and do. See Access Control.
• Private agents connect outbound to VerOps; you never have to open inbound ports.