Internal Developer Platform  ·  View 11 of 21  ·  Data

Storage Zones by Ownership

Four bands, drawn by what a loss would cost rather than by technology.

Editable source SVG draw.io All views
Truth — owned by product teams, never by the platform Team repositories Catalog Descriptors RPO 0 · Git Deployment Intent Infrastructure Intent Platform-owned truth — losing this loses knowledge nothing can rebuild Provisioning Terraform State RPO 0 · RTO 1 h State Locks Evidence Audit Events immutable · 7 years Exception Register Supply chain Signed Images ACR · 400 d if shipped Attestations Policy Bundles signed · OCI Projections — rebuildable from truth and the runtime Catalog Component Records RTO 4 h Relations 9,000 edges Insight DORA and Adoption 3 years daily Deploy History 400 days Cost Facts daily export Ephemeral — deliberately not backed up Working data Pipeline Logs 180 days Bundle Cache last known good Portal Session State RPO 24 h rebuilds cached at the edge Internal Developer Platform — Storage Zones by Ownership Data store batch event / async Zones are drawn by what a loss would cost, not by technology. Only the second band has an RPO of zero; the third can be rebuilt, and the fourth is allowed to disappear. v 1.0 · owner Platform Architecture · date 2026-09

Decisions

  • Only the second band has RPO 0: provisioning state, audit evidence and the supply chain are the things nothing can reconstruct (ADR-02, ADR-16).
  • The catalog is explicitly a projection with a four-hour RTO, because it can be rebuilt from repository descriptors and the runtime (ADR-09).
  • The fourth band is allowed to disappear, and saying so in the architecture is what stops it acquiring a backup policy nobody needs.

Assumptions

  • Audit 7 years, deploy history 400 days, pipeline logs 180 days, catalog history 2 years, DORA metrics 3 years (stated assumptions).
  • Images retained 90 days, or 400 days once deployed to production.

Risks

  • Terraform state is the single most dangerous object in the estate: losing it loses the platform's knowledge of what it created, and corrupting it can destroy live resources.
  • Hence locking, versioned backups, and a restore exercised twice a year rather than assumed (ADR-16).
◀  Data Flow All views Core Data Model  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 21 views · 16 architecture decision records11-storage-zones