Search documentation

Documentation sections

## Get started

[Start here](/docs)[Source and release](/docs/source)[Local quickstart](/docs/local)

## Run

[GitLab deployment](/docs/installation)[First review](/docs/review)

## Understand

[Architecture](/docs/architecture)[Storage and index](/docs/data)[Tenants and policies](/docs/access)[Integrations](/docs/integrations)

## Operate

[Operations](/docs/operations)[Acceptance](/docs/acceptance)

# Where the data lives.

Source files, search vectors and review records are different data sets.

What happens to your code

### From code to a finding

- 

GitLabMR · SHA

Read the selected revision

- 

IdentityTenant · ACL

Check current access

- 

ContextPackDiff · files · rules

Pin source and policy versions

- 

Review modelAPI / CLI

Send the approved context

- 

DraftPostgreSQL

Save the finding before publishing

A model receives selected material. The team controls publication and merge.

### Three kinds of stored data

- 

Source filesSHA · blob · hash

Private read-only snapshots

- 

QdrantVectors · metadata

A separate index for each tenant

- 

PostgreSQLContextPack · review

Separate databases and service logins

Qdrant stores retrieval vectors and metadata. Source files stay in snapshots; selected context and review records stay in PostgreSQL.

### One tenant, its own data owners

- 

IdentityUser → tenant → role

Trusted identity, checked per request

- 

Private servicesControl · Connector · Worker · Context

Service token and exact tenant scope

- 

Separate ownersPostgreSQL · files · Qdrant

Separate logins, paths, volumes and keys

Repository scope is enforced by the API. Repositories inside one service share its SQL role; a compromised process is a separate threat boundary.

Product architecture. Validate your deployment separately.

## PostgreSQL by owner

| Owner | Stored records  |
| --- | --- |

| Identity | Users, organizations, memberships and sessions  |

| Control | Versioned rules, queue, runs and drafts  |

| Connector | Inbox, feedback and publication/action receipts  |

| Worker | Attempts and model result records  |

| Context | Source jobs, manifests, index generations and immutable ContextPacks  |

| ContextForge | Gateway state in its own database and owner  |

## How context is assembled

The Connector reads the exact repository revision. Read-only source snapshots carry SHA, blob and content hashes. The indexer records an index generation; Qdrant holds vectors and search metadata. Retrieved fragments are checked against source and current ACL before entering a ContextPack.

## What a ContextPack fixes

```sh
tenant / repository / SHA
selected diff + verified fragments
ACL + policy + retrieval revisions
content digest
```

The pack is saved in Context PostgreSQL and bound to a review run. Source-ready alone does not mean the index is ready. An embedding model builds vectors; a review model reads the selected context and produces findings.

## Secrets and deletion

GitLab and model credentials belong to their services and are kept in private files. Access revocation blocks future reads; it does not automatically erase source snapshots, indexes, audit history or backups. Define deletion and backup retention separately.

[PreviousArchitecture](/docs/architecture)[NextTenants and policies](/docs/access)

## On this page

[PostgreSQL by owner](#databases)[How context is assembled](#index)[What a ContextPack fixes](#pack)[Secrets and deletion](#retention)[Markdown ↗](/docs/data.md)