Architecture

How t2e turns telemetry into evidence — from collector to dashboard.

System Overview

t2e is composed of three main components that work together to continuously ingest, process, and present compliance evidence from your infrastructure telemetry.

Collector Go · Helm

Backend API FastAPI · PostgreSQL

Dashboard Next.js · React

Collector

A lightweight Go daemon deployed via Helm into your Kubernetes cluster. It connects to multiple telemetry sources and forwards normalized events to the backend.

Sources: Kubernetes API watch, OTLP gRPC endpoint, GitHub webhook server, AI model telemetry

Permissions: Read-only ClusterRole — never writes to your cluster

Output: Batched JSON events sent to POST /v1/ingest/batch

Security: Events are hashed (SHA-256) before transmission; no raw secrets collected

Backend API

A multi-tenant FastAPI application that ingests events, runs risk rules, maps evidence to controls, generates reports, and manages organizations.

Database: PostgreSQL 16 with row-level security for tenant isolation

Queue: Redis + ARQ for async evidence processing and report generation

Normalizer: Source-specific normalizers for k8s, otel, github, ai event types

Risk Engine: YAML-defined rules auto-generate risk findings from telemetry

Reports: Jinja2 templates generate Markdown reports with control citations

Risk Engine

The risk engine evaluates incoming telemetry against YAML-defined rules. Rules specify conditions, severity levels, and control mappings.

# rules/kubernetes.yaml
rules:
  - id: K8S-001
    name: "Privileged container running"
    severity: HIGH
    condition: payload.securityContext.privileged == true
    controls:
      - soc2:CC6.1
      - iso27001:A.8.9
      - pci_dss:2.2.1

Rules are evaluated during event normalization. Matches create risk records and link evidence to the specified controls.

Evidence Chain

Every piece of evidence is cryptographically verified:

Ingest

Event received, SHA-256 hash computed

Normalize

Source-specific normalizer extracts evidence payload

Map

Evidence linked to compliance controls via YAML mappings

Store

Append-only evidence vault with hash chain verification