For architects

A platform you can sign off. On your cluster, with your identity and your rules.

Flow is one connecting layer for systems, AI Colleagues and people. It runs on Kubernetes with PostgreSQL, connects to your identity provider and keeps every step traceable. Here you read what is inside, how to set it up and how to govern it.

Book an architecture session See the reference architectures

Kubernetesstandard Kubernetes with ingress-nginx and cert-manager

PostgreSQL 17one database per environment

OpenID Connectyour own identity provider, groups → roles

EU-first AIMistral by default, your own model too

DTAPdevelop, test, acceptance, production

Hardened imagesnon-root, read-only, CVE scan on every release

What is inside

One platform, clearly divided.

The portal is the control plane: accounts, organisations, sign-in, environments and releases. Every environment is a Flow of its own with its own database. Custom code runs in a sandbox without network; browser automation in a container of its own that cannot reach your internal network.

The logical architecture. Every environment (develop, test, acceptance, production) is separate: its own pod, its own database, its own address and certificate.

StudioAn IDE in the browser: explorer, tabs, inspector and ⌘K. Modules group everything that belongs to one process.

WorkflowsTriggers, rules, loops, approvals, HTTP, tables, knowledge bases, custom Python in the sandbox and browser steps (RPA). Every run can be replayed step by step.

AI ColleaguesAgents in a ‘box’: budget in tokens, tool calls and time; personal data masked before the model sees it; write actions off by default; test cases before publishing.

API gatewayPublish workflows and tables as REST, SOAP or MCP, with OpenAPI 3.1. Sign-in with API key, OAuth2, JWT from your IdP, Basic or HMAC; limits per consumer.

Knowledge basesDocuments and tables searchable for AI Colleagues, with embeddings computed locally or at Mistral (EU).

ConnectionsMicrosoft 365 (mail, calendar, Teams, SharePoint), Slack, email, WhatsApp Business, any REST API and MCP servers. Secrets encrypted, never in a log.

Home & dashboardsA home of its own for colleagues per audience, with dashboards, chat and feedback.

Build with AIThe AI Architect and your own AI apps (Claude Desktop, ChatGPT) build through MCP, with your rights and only in development and test environments.

Reference architectures

Flow in Azure, AWS or OpenShift.

Flow uses standard Kubernetes only: Deployments, Services, Ingress, Secrets and NetworkPolicies. That is why it lands in every cloud the same way, with the building blocks you already know.

Flow (per environment)part of the platform or your cloudroadmap

Reference design: this is how Flow lands in this cloud. Today Flow runs in production on managed Kubernetes in the EU; we set up your cloud together.

Postgres runs in the cluster on Azure Disk; a managed Azure Database for PostgreSQL is supported by Flow itself, the Helm chart is still getting that option.
Secrets live in a Kubernetes Secret today; Azure Key Vault by reference is on the roadmap (E12).

Set it up

From cluster to first process.

Your platform team installs Flow with one Helm chart. After that the portal starts every environment itself; nothing to install per environment.

Cluster and namespace

A Kubernetes cluster with an ingress controller and cert-manager. We provide the namespace with Pod Security labels.

Images and secrets

Mirror our hardened images into your registry and prepare the secrets in one Kubernetes Secret (or let Helm create them).

Install with Helm

One command. The portal then starts every environment itself: a pod, a service, an ingress and a database of its own.

Connect identity

Connect your identity provider through OpenID Connect and map groups to roles. Whoever leaves the group loses the role at the next sign-in.

Choose the AI model

Per environment: Mistral (EU), Anthropic or an OpenAI-compatible endpoint, with your own keys. AI Colleagues can be restricted to EU models.

Environments and the first process

Create development, test, acceptance and production, connect your systems and build the first process, by talking to the AI Architect if you like.

# values.yaml: the essentials
domain: flow.uwbedrijf.nl
image: {registry: uwregistry.azurecr.io, repo: inntelligence/flow, tag: "0.7.24"}
ingress: {className: nginx, clusterIssuer: letsencrypt-prod}
postgres: {storage: 20Gi, storageClassName: managed-premium}
secrets: {existingSecret: flow-platform-secrets}
sandbox: {replicas: 2, runtimeClassName: gvisor}   # gVisor when your cluster has it

# install
kubectl apply -f namespace.yml
helm upgrade --install flow-platform ./flow-platform -n inntelligence -f values.yaml

Govern

Control without the brakes.

Governance lives in the platform itself, not in a document beside it.

Develop, test, accept, production

Every environment is a Flow of its own with its own database. Building happens only in development; test, acceptance and production are read-only and receive a release through promotion.

Roles, teams and SSO groups

Eight standard roles and custom roles, about forty permissions. Roles come directly, through a team or through a group in your identity provider.

Access as a proposal

An AI app never creates keys, roles or share links itself. It makes a proposal; a person approves it, with their own rights.

Version control and restore

Every change is a version. Compare two versions and restore in one step. Secrets, runs and logs never travel in a version.

Audit and security overview

Sign-ins, changes and refusals are in the audit log. The security overview shows what is open or weak, with severity and explanation.

Data classification and retention

Public, internal, confidential, personal, special. Sensitive data never goes open without sign-in and a scope; logs and runs are cleared after a configurable period.

Security

Built secure, shipped secure.

Every release of Flow is fully tested and scanned before it ships.

Portal, Flow and sandbox on Docker Hardened Images: no shell, non-root (uid 65532), read-only file system, all capabilities dropped.
On every release: pip-audit, npm audit and a Trivy scan of every image; a known HIGH or CRITICAL with a fix stops the release.
Every release first passes the full test run: backends, end-to-end tests and every guide as a test.
Secrets stored encrypted and write-only through the API; never to an AI model or a log.
Outbound calls over http(s) only and by default never to private or internal addresses.
Custom code in a sandbox without network, with limits on CPU, memory and time; gVisor when your cluster has it.

Who does what

Clear responsibilities.

Part	InnTelligence	Your organisation
Application and images	InnTelligence: build, test, CVE scan, ship per release	—
Kubernetes cluster	advice on size and set-up	your platform team: cluster, patches, nodes
Ingress, DNS and certificates	ingress and certificate configuration in the chart	your DNS records and (optionally) WAF
Database	PostgreSQL 17 in the cluster, one database per environment	storage (StorageClass) and volume backups
Logs and monitoring	logs on stdout and health endpoints	collection in your monitoring
Identity	OIDC connection and role mapping	your identity provider and groups
AI models	choice per environment, guardrails and budgets	your contract and keys with the model provider

The result

What your organisation gets back.

One connecting layerYour systems, AI Colleagues and people in one place, instead of loose scripts and tools.

AI with guardrailsBudgets, masking and approval where you want it; every step on the record.

No lock-inYour cluster, your database (standard PostgreSQL with SQL views), your identity provider and your model choice. Modules export as a file.

Faster from request to running processBuild by talking, in development; through test and acceptance to production.

Provably secureEvery release fully tested and scanned; images without a shell, non-root and read-only.

At your paceStart with one process and one team; scale per environment and per module.

Roadmap

What is coming.

Planned and not yet available; we build it test-first and say so here when it lands.

E12Your key vaultSecrets by reference from Azure Key Vault, AWS Secrets Manager or Flow’s own vault.

E13EventsKafka, Azure Event Hubs and AWS SQS/SNS, plus an event bus of its own on Postgres; asynchronous processing with inbox and outbox.

E14More data sourcesYour own databases beside Postgres, read with push-down and row policies.

E15Modules on their own workersA module runs, scales and fails on its own.

Architecture session

Hold it against your landscape.

In a one-hour session we hold Flow against your cloud, identity, network and governance requirements, and sketch together how it lands.