Cloud & on-prem

Runs in your account, on the services you already trust

Postgres by default, ClickHouse for the event table when volume calls for it, and the object store and secret manager of your cloud. Each is selected by configuration, not code changes.

What is stored where

Two kinds of data, two kinds of store

Only one table grows with traffic. Everything else is small.

DataWhereGrowth
Events (pageviews, clicks, forms, errors, vitals, custom)Postgres clickiq.event, partitioned by month; or ClickHouse at large volumeThe only high-volume table: about 0.9 KB per event with indexes (measured: 271k events in 246 MB)
Sessions and peoplePostgresAbout one session per 25–50 events; people roughly equal to distinct visitors
Session replayYour object store, gzipped; an index row in Postgres50–300 KB per recorded session, never in the database
Report PDFs and snapshotsObject storeKilobytes each
Dashboards, reports, segments, signals, agent runs, AI cachePostgresNegligible
Identity, audit, connectionsPostgres (platform tables)Negligible
By cloud

The service mapping

The same product on each cloud's managed services. Store and secret references are a URL scheme in one environment variable.

PostgresObject store (replay, PDFs)Events at large scaleSecrets
AWSRDS for PostgreSQL (small/mid); Aurora PostgreSQL (mid/large, read replicas); RDS Proxy as the poolerS3 (s3://); lifecycle to Glacier for replays older than 90 daysClickHouse Cloud on AWS, or self-managed on EC2/EKSSecrets Manager (aws-sm://)
AzureDatabase for PostgreSQL Flexible Server (zone-redundant HA, read replicas)Blob Storage (az://); cool and archive tiersClickHouse Cloud on Azure, or self-managed on AKSKey Vault (azure-kv://); Managed Identity
Google CloudCloud SQL for PostgreSQL (small/mid); AlloyDB (mid/large, the longest Postgres-only runway)Cloud Storage (gs://); Nearline/Coldline for old replaysClickHouse Cloud on GCP, or self-managed on GKESecret Manager (gcp-sm://)
OCIOCI Database with PostgreSQLObject Storage (oci://)Self-managed ClickHouse on Compute or OKE (no managed ClickHouse)OCI Vault (oci-vault://)
On-premises / air-gappedPostgres 16 (Patroni for HA)MinIO or Ceph (s3+http://)ClickHouse open sourceVault, file or environment
Postgres first

Why Postgres is the default, and how far it goes

Every current deployment fits a small managed Postgres. Monthly partitions, a retention round that drops whole partitions, a trimmed set of indexes and an optional read replica are already in the product.

TrafficEvents / month13 months retainedFits
Internal app, demo, small site0.1–2 M1–25 GBOne small Postgres (2 vCPU / 8 GB)
Mid-size product or ecommerce site2–30 M25–350 GBPostgres with monthly partitions and a read replica (4–8 vCPU / 32 GB)
Large site, many tenants30–300 M0.3–3.5 TBPostgres up to about 100 M a month; beyond that, ClickHouse for events
Very large multi-tenant> 300 MMulti-TBClickHouse for events; Postgres for sessions, people and content

Starting points for the small tier: AWS db.t4g.medium or db.m7g.large with 100 GB gp3; Azure Standard_D2ds_v5; GCP db-custom-2-8192 or AlloyDB 2 vCPU; OCI 2 OCPU. All with automated backups, encryption at rest, TLS required and a private subnet.

ClickHouse at scale

One query module, two dialects

Moving the event table to ClickHouse changes a configuration value, not the product.

Moving events to ClickHouse: dual-write, backfill, switch the store; Postgres keeps sessions, people and content 1Dual-writeIngest writes to Postgres asnow and also to ClickHouse; afailure never fails therequest.2BackfillHistory copied with thebackfill script; replacedrows converge at merge time.3SwitchSet the event store toclickhouse; the sameQuerySpec now compiles toClickHouse SQL.4Tenancy keptEvery statement must carrythe organisation predicate orit is refused; a read-onlyuser for the console.Moving events to ClickHouse: dual-write, backfill, switch the store; Postgres keeps sessions, people and content 1Dual-writeIngest writes to Postgres as nowand also to ClickHouse; a failurenever fails the request.2BackfillHistory copied with the backfillscript; replaced rows converge atmerge time.3SwitchSet the event store to clickhouse;the same QuerySpec now compiles toClickHouse SQL.4Tenancy keptEvery statement must carry theorganisation predicate or it isrefused; a read-only user for theconsole.
In the demo, a person-trait breakdown (users by manager) went from 957 ms on Postgres to 54 ms on ClickHouse. ClickHouse is managed on AWS, Azure and GCP (ClickHouse Cloud) and self-hosted anywhere.
Data residency

One deployment per region

Residency

Database and bucket per region; the console is region-agnostic. A Postgres is never shared across regions.

Secrets as references

Database and ClickHouse passwords are resolved from your secret manager at start; nothing sensitive sits in configuration files.

Your model, or none

Bedrock (default), Azure OpenAI, Vertex, OCI or an OpenAI-compatible endpoint in your account. Or no model at all: every AI feature has a rules path.

Backups

Managed automated backups with point-in-time recovery; bucket versioning or cross-region replication for replays where required.

Retention and erasure

Per-project retention enforced daily by dropping or trimming partitions; erasure of a person removes every id, session, event and replay object.

A pilot on one VM

Postgres, the API and the console on one machine from the compose file, then move each piece to a managed service.

Plan a deployment in your account

Tell us the cloud, the region and the traffic; we will size the database and storage with you.

Scope a deployment