Architecture
The control plane is ours. The data plane is yours.
Migratrix is a cloud application talking to an Executor you deploy next to your databases. Schema work, execution, drift snapshots, conversion runs, and replicas run on that Executor. The platform stores operational metadata, not your rows and not your connection secrets.
Network
How traffic actually flows
| Path | Direction and purpose |
|---|---|
| Executor → Migratrix | Outbound SignalR over TLS, authenticated with a workspace Executor key. This is how the Executor registers and receives work. No inbound port on your side is required for this path. |
| Platform → Executor | The browser talks to the Executor's public URL over SignalR for live schema, query, and execution. That URL can be an internal address, a custom domain, or {org}.agents.migratrix.com. |
| Executor → your databases | Stays inside your network. TLS to the database when the engine supports it. Credentials never enter the orchestrator database. |
Trust boundary
What never leaves the Executor host
Database credentials
Encrypted at rest on the Executor machine. Rotation is supported without taking the platform down. Optional JIT credentials can come from your own secret manager.
Customer rows
Not copied to Migratrix servers. Transient results used to render Explorer or a diff are processed and discarded.
What the cloud keeps
Users, roles, pipeline definitions, change-script metadata, audit events, Git linkage, and your licence.
Identity
Email and password, SAML SSO, TOTP MFA, and directory import from Google Workspace or Microsoft Entra. GitHub and GitLab OAuth is for repositories, not as the product login.
Deploy where the databases are
One Executor per network segment is the usual shape. Engine plugins install on the Executor, so Databricks ODBC or similar host requirements stay on that machine.
Scoped Executor tokens
Tokens are tied to organisation, workspace, and environment. Executor actions are logged with correlation identifiers in the same audit story as human actions.
Executor host
What it takes to run the Executor
| Surface | Default and meaning |
|---|---|
| Bind address | http://0.0.0.0:4002 where the Executor listens on the machine. |
| Public URL | http://localhost:4002 out of the box. Browsers and the platform use this. Production must be HTTPS if the app is HTTPS. |
| Health | The platform checks that the Executor is reachable and reports it in the workspace, so a host that is down is visible before someone waits on a run. |
| Install | A single command on Linux or Windows, with Docker and Homebrew as alternatives. Your own TLS certificate can be uploaded on the same screen. |
| Engine plugins | Engine support is added on the Executor itself and can be removed again. Installs can be signature-verified, and a change script for an engine that is not installed is refused with a message that says exactly that. |
| Safety settings | Protection against dropped columns and indexes, how much data a rollback may preserve, and connection limits are set once by whoever runs the Executor. They apply to everything that runs through it, rather than being a checkbox on each script. |