Skip to content
LakeSentry LakeSentry LakeSentry Docs

LakeSentry Architecture — SaaS and Databricks App Deployments

LakeSentry is available in two deployment models: a hosted SaaS at lakesentry.io, and a Databricks App that runs inside your own Databricks account. Both run the same application — a web app, an API, and a job queue that runs the data pipeline. They differ in where that application runs, where your data is stored, and how it reaches your system tables.

SaaSDatabricks App
Where it runsLakeSentry-hosted server on AzureInside your Databricks account, as a Databricks App
Tenant databasePostgreSQL, dedicated to your tenantLakebase, in your Databricks account
Sign-inLakeSentry accounts, magic links, or SSOYour Databricks identity
Data extractionDirect connection or the Data CollectorA SQL warehouse in your account

SaaS

Section titled “SaaS”
LakeSentry SaaS architecture Users reach a request proxy on the LakeSentry server, which routes to a per-customer tenant container (web app, API, job queue, database) or to the admin portal. The tenant API pulls data from a Databricks SQL warehouse, or receives data pushed by the Data Collector running in the customer's workspace. LakeSentry server lakesentry.io · Azure VM Users Requests Request proxy Caddy Tenant container Tenant Web SPA React + TypeScript Tenant API Go Job queue River Tenant DB PostgreSQL Admin portal Admin API + Web SPA Go + React Admin DB PostgreSQL Provisions tenant containers Databricks workspace System tables SQL warehouse Extract Data Collector Python · External Connector Pull (direct) Push Other external services Stripe, SMTP, …
LakeSentry SaaS: each customer gets a dedicated tenant container on the LakeSentry server.

Components

Section titled “Components”
  • Request proxy (Caddy) — The entry point for all traffic to lakesentry.io. It routes each request to the right tenant container, or to the admin portal.
  • Tenant container — Your own LakeSentry instance. Every customer gets a dedicated container with its own application and database, so no application process or database is shared between tenants. It holds:
    • Tenant Web SPA (React + TypeScript) — The LakeSentry web app you use in the browser.
    • Tenant API (Go) — Serves the web app and receives extracted Databricks data, whether pulled over a direct connection or pushed by the Data Collector.
    • Job queue (River) — Runs background work outside the request path: scheduled extraction, transforms, attribution, metrics, and insight detection.
    • Tenant DB (PostgreSQL) — Stores your raw, ledger, metrics, and insight data. Only your tenant container connects to it.
  • Admin portal (Go + React) — Manages tenants and provisions a tenant container for each new customer. It keeps its own Admin DB (PostgreSQL), separate from any tenant data.
  • Databricks workspace — The source of your cost and usage data: Unity Catalog system tables, queried through a SQL warehouse.
  • Data Collector (Python) — Optional. With the External Connector, a Python job runs in your Databricks workspace, reads the system tables, and pushes the data to LakeSentry over HTTPS. Use it when LakeSentry shouldn’t connect to your workspace directly. See Collector Deployment.
  • Other external services — Supporting services such as Stripe for billing and SMTP for email delivery.

Databricks App

Section titled “Databricks App”
LakeSentry Databricks App architecture Everything runs inside the customer's Databricks account. Users reach the LakeSentry Databricks App through its request proxy, which routes to the tenant (web app, API, job queue) or the admin service. The tenant extracts system tables through a SQL warehouse and stores data in a Lakebase database, which a Genie space reads. The tenant API connects to Genie through MCP. Your Databricks account LakeSentry Databricks App Users Requests Request proxy Caddy Tenant Tenant Web SPA React + TypeScript Tenant API Go Job queue River Admin Admin API + Web SPA Go + React System tables SQL warehouse Extract data Tenant DB Lakebase Genie Space MCP for Genie
LakeSentry Databricks App: the application and its data stay inside your Databricks account.

Components

Section titled “Components”
  • Users — Open LakeSentry from your Databricks account. Databricks handles authentication, so LakeSentry’s own password, magic-link, and SSO sign-in don’t apply.
  • LakeSentry Databricks App — The same application as the SaaS, packaged as a Databricks App:
    • Request proxy (Caddy) — Routes requests to the tenant or to the admin service.
    • Tenant — The web app, API, and job queue, with the same roles as in the SaaS. A Databricks App serves a single tenant: your account.
    • Admin (Go + React) — The admin API and web app for the app instance.
  • System tables and SQL warehouse — The tenant extracts system table data through a SQL warehouse in your account. No Data Collector is needed, because the app already runs next to your data.
  • Tenant DB (Lakebase) — The tenant database runs on Lakebase, Databricks’ managed PostgreSQL, so LakeSentry’s data stays in your Databricks account.
  • Genie Space — A Databricks AI/BI Genie space built on the tenant database, for natural-language questions about your LakeSentry data.
  • MCP for Genie — The Model Context Protocol (MCP) server that the Tenant API uses to query the Genie space.