Skip to main content

Your own data plane

A workspace can run from infrastructure it operates. With a data plane active, the workspace's whole schema — runs, spans, agents, memory (episodic, semantic, graph), evals — lives in your Postgres; cache, working memory and live run events in your Redis; payloads in your bucket. Waxell keeps only the platform plane: your workspace registration, users, API keys, and billing. Rotate your credentials and Waxell's access ends; the data was never ours.

Data plane is enabled per platform. If wax plane status answers not enabled on this platform, ask us to turn it on for your workspace.

Connect​

wax plane connect --postgres-env MY_PG_URL --redis-env MY_REDIS_URL
wax plane verify
wax plane activate

The same flow exists in the app under Settings → Data Plane.

  • Connection strings are stored encrypted and are never shown again — the API returns only the redacted form (user:***@host).
  • Addresses must be public. Waxell refuses private, loopback, link-local and internal names — your stores must live outside Waxell's network (your VPC, your account), reachable over TLS.
  • verify connects, checks the Postgres version, creates the schema, checks pgvector (semantic memory needs it), runs a write probe, and reports each step by name.

What your Postgres needs​

  • A role that can create schemas and tables — Waxell manages its own schema (<workspace schema> plus three placeholder tables in public) and keeps it current on every platform deploy.
  • pgvector available (CREATE EXTENSION vector) for semantic memory.
  • Network access from Waxell's egress, TLS on.

A workspace with data already​

activate refuses to strand data. Copy first:

wax plane migrate     # bulk copy, delta catch-up, count verification
wax plane activate

The copy runs in the background; the settings page shows live progress. Every step is idempotent — re-running is safe. Rows updated during the copy window keep their pre-copy content; the window closes at activation.

Day to day​

Everything is unchanged for agents and users — the same tools, the same pages, the same APIs; the data simply lives with you. wax plane status shows where each store lives. wax plane disable routes back to the platform (data already in your stores stays there until you copy it back or re-activate).

Semantic memory's embeddings follow the workspace's provider choice (see Semantic memory embeddings) — with a data plane, the facts, the vectors and the model can all be yours.

Object storage​

Payloads (capture archives, audit exports, attachments) go to your bucket: AWS S3, or any S3-compatible service through an endpoint URL — MinIO, Cloudflare R2, Google Cloud Storage's S3 interoperability, Backblaze B2.

wax secrets set BUCKET_CREDS '{"access_key_id": "…", "secret_access_key": "…"}'
wax plane connect --bucket my-waxell-payloads --bucket-region us-east-1 \
  --bucket-endpoint https://<account>.r2.cloudflarestorage.com --bucket-secret BUCKET_CREDS

Leave --bucket-secret off to use the store's own IAM role or default credential chain. verify writes, reads and deletes a probe object.