Integration requirements
What your team needs before going live with Definite.
Hosted deployment
Definite's hosted control plane runs in AWS: the Vault API and the stateless agent runtime run as private services behind TLS, with per-tenant Postgres isolation, a secret manager for all credentials, and object storage for ledger checkpoint witnessing. The agent runtime accepts requests only from Vault — it is never exposed to browsers or customer networks. Releases promote through blue-green deployment.
Single-tenant VPC and self-hosted deployment options exist for institutions with residency or isolation requirements, including Canadian data residency. Talk to Definite about the deployment profile before contracting.
What you provide
| Field | Type | Required | Description |
|---|---|---|---|
| Vault URL | Endpoint | Yes | Your tenant's API base URL, used by SDKs and REST integrations. |
| Tenant API key | Secret | Yes | Created in Settings → API Keys. Store it in your secret manager; it is shown once. |
| Read-only source credentials | Secret | Per source | Read-only API users, SFTP/S3 drop access, or warehouse service accounts. Submitted write-only through the console's connection flow. |
| Egress allowlist | Network | If restricted | Allow HTTPS from your services to the Vault URL. All traffic is TLS. |
| Destination credentials | Secret | Optional | Splunk/Datadog/Elastic/S3 for SIEM export; Kafka/SNS/SQS/PubSub/Event Hubs for decision streams; webhook endpoints. |
Definite never accepts write credentials for your systems. If a credential you submit has write scope, replace it with a read-only one.
Source expectations
- File drops (SFTP or S3) should arrive on an agreed schedule; runs bind to the resulting immutable snapshots, and missing inputs alert rather than silently passing — affected checks resolve to
CANNOT_VERIFY. - API and warehouse connections are polled read-only; credentials are stored in the tenant secret store and are write-only through the API (
secret-intents). - Uploads go directly to managed object storage with versioning; Vault never proxies file bytes.
Identity
- Console users authenticate with email and password plus optional per-user TOTP 2FA.
- Enterprise tenants can enable SAML SSO (email-domain discovery) and SCIM provisioning; membership remains the authorization source of truth.
Operational contacts
Agree with Definite on the run schedule and morning readiness deadline for scheduled workflows, the alert destinations (email, Slack) for missing inputs and failed runs, and who on your side holds the admin and owner roles that can approve reviews and authorize final exports.