Level 2 — Containers
The Container view zooms inside the Noxys system and shows the deployable units (processes, browser extensions, databases, sidecars) and their runtime relationships. A "container" here is anything that runs — not a Docker image specifically.
Diagram
Containers
Customer endpoint
| Container | Tech | Responsibility |
|---|---|---|
Browser Extension (noxys-extension) | TypeScript, Manifest V3 service worker | Detects AI platform usage, runs Tier 1 regex Risk Signal detection (<10 ms, <5 MB), enforces cached policies offline, computes SHA-256 of prompts, never sends raw text by default. |
VS Code Extension (noxys-vscode) | TypeScript | IDE-side detection for code assistants (Copilot, Cursor) — same data-minimisation contract as the browser extension. |
Noxys SaaS — EU sovereign cloud
| Container | Tech | Responsibility |
|---|---|---|
Console (noxys-console) | Next.js 15, React 19 | Admin SaaS UI — tenants, users, policies, AI service catalog, alerts, audit log viewer, reporting. |
API (noxys-api) | Go (Fiber) | Authoritative control plane: policy evaluation, default-deny logic, audit ingestion, tenant isolation, AI service catalog, webhook delivery. See Level 3. |
Presidio Sidecar (noxys-presidio) | Python, Microsoft Presidio | Tier 2 detection — structured PII / Risk Signal recognition on hashed + tokenised payloads only. |
AI Forge (noxys-ai-forge) | Python, SLM runtime | Tier 3 detection — async semantic Risk Signal classification using a small language model. Queue-driven. |
PDF Renderer (noxys-pdf-renderer) | Node + Chromium | Produces DPIA exports, transparency reports, signed audit packages. |
| PostgreSQL | Postgres 16 | Primary store — tenants, policies, users, audit metadata. Per-tenant row-level security. |
| Redis | Redis 7 | Sessions, rate limits, async job queue. |
| S3-compatible Object Store | Scaleway Object Storage | Generated reports, audit archives, customer-uploaded artefacts. |
| Observability | OpenTelemetry → Grafana + Loki + Tempo + Prometheus | Metrics, logs, traces. Customer-facing transparency derived from this stack. |
Key flows
- Inline detection — Extension → API → (Presidio) → policy verdict (allow / coach / block) → back to extension. Target P95 < 200 ms.
- Async deep detection — API queues a job → AI Forge → updates audit row → optional alert via Console + SIEM webhook.
- Admin policy edit — Admin → Console → API → Postgres → policy snapshot pushed to extensions on next heartbeat.
- Audit export to SIEM — API streams events to syslog / HEC / webhook in near-real-time.
Deployment notes
- All containers run in the EU (sovereignty contract).
- API and Console are stateless; horizontal scale-out via VPS autoscaling group (see
noxys-infra). - Postgres and Redis are managed (Scaleway / OVH) with point-in-time recovery.
- Object storage is encrypted at rest with customer-scoped KMS keys (per ADR-019).