Brainbase - Agent Platform

Before you start. Create-resource permissions, a public Route 53 zone, Bedrock and SES production access for unrestricted email. us-east-1 only.

Deploy. Subscribe; create a stack from the linked template: DomainName, HostedZoneId, AlarmEmail, optional AppAllowedCidrs (allowed IPv4 ranges) and FirstUserEmail. ~15 min. Creates app., api., llm., supabase., hooks. records plus one per integration, and SES sender/DKIM. FirstUserEmail adds an account; public signup stays closed. Open https://app .<DomainName> and request a magic link once SES is ready. Confirm SNS alarm/feedback emails; monitor bounces/complaints. SES sandbox recipient restrictions still apply.

What the template creates and why. A VPC with public/private subnets; ALB/ACM; 15 Fargate services; one m7g.large with PostgreSQL on encrypted EBS; nine install Lambdas; ECR/CodeBuild image clone; two S3 buckets; secrets, logs, alarms.

IAM roles and their purpose. Scoped task roles: app/billing use aws-marketplace:MeterUsage, billing also aws-marketplace:SearchAgreements; LLM gateway calls Bedrock; scheduler/app manage MicroVMs; storage uses its bucket. Execution roles pull images/read secrets; Lambda/CodeBuild access created resources and the registry. No role has administrative access.

Keys and secrets. Install generates credentials in Secrets Manager (bb-appliance/supabase-shared, bb-appliance/app-shared); none is hard-coded or sent to Brainbase. Rotate with affected services, then redeploy.

Encryption. EBS, S3 and Secrets Manager use AWS-managed KMS at rest; public endpoints use ACM TLS; internal traffic stays in the VPC.

Backup and recovery. PostgreSQL has dedicated EBS with nightly snapshots (7 kept). Restore: create a volume from a snapshot, replace the database instance's data-volume mapping, restart; ask support for details. Stack deletion retains the volume, snapshots and both secrets; delete when done.

Health monitoring. Alarms email AlarmEmail. Check ECS for running = desired and https://api .<DomainName>/healthz.

Quotas. Check Fargate vCPU, Lambda concurrency and Bedrock throughput. Check applied Lambda Max allocated MicroVM memory (L-CD1C0CC4) in us-east-1: 8 GB per RUNNING or SUSPENDED VM plus headroom. New accounts may allow only one VM. Request needed increases in Service Quotas before agent use; contact AWS Support if rejected.

Costs. Pay AWS for one m7g.large, 15 Fargate tasks, a NAT gateway, an ALB, EBS/S3 storage, Bedrock tokens and sandbox compute as used; pay Brainbase for listed dimensions. Included services cost no extra.

External dependencies and data flows. At install, the stack downloads crane from github.com and pulls Marketplace-registry images. Brainbase runs three external services, is responsible for their availability/security, and the product is withdrawn from AWS Marketplace if they are discontinued: workflows (workflows.workforce.brainbaselabs.com), the GitHub connector (brainbase-github-connectors.onrender.com) and connector agent streaming (kafka-llm-service.onrender.com). That data transits Brainbase only while in use. Optional integrations (Pipedream, Portkey, Twilio, LiveKit, Deepgram, Resend) stay off until credentialed; that data then flows to the provider under your terms. Slack differs: SLACK_ENABLED plus placeholder credentials only boot the connector; no data flows until you install a real Slack app. No key is issued for analytics host us.i.posthog.com, so no analytics are sent. OAuth issuer app.brainbaselabs.com is a token claim only; no traffic goes to it. With the shipped configuration, everything not named in this section stays in your account.

Upgrade. Update the stack with the new template URL: the schema ledger applies pending migrations, images update, the data volume survives. On a schema-step failure, --disable-rollback keeps the database.

Support. help@brainbaselabs.com , 9am-7pm PT, Monday-Friday.