Cloud architecture designed for security-conscious engineering teams
CodePilot AI is planned on managed AWS services, chosen so the platform can scale with your repositories and stay observable and auditable.
Planned architecture
The building blocks
Eleven AWS services work in four layers. Each has one job, which keeps the system easier to secure, monitor and change.
Amazon CloudFront
Fast, cached delivery of the web app and static assets.
AWS WAF
Filters malicious requests before they reach the application.
Amazon ECS Fargate
Runs the web app, API and AI orchestration as containers, with no servers to manage.
AWS Lambda
Event-driven jobs that fetch, parse and index repositories.
Amazon Bedrock
Foundation models for answers, reviews, documentation and embeddings.
Amazon RDS for PostgreSQL
Relational store for workspaces, repositories and metadata.
pgvector
PostgreSQL extension for similarity search over code embeddings.
Amazon S3
Repository snapshots, generated documents and exports.
AWS Secrets Manager
Keeps credentials and keys out of code and configuration files.
Amazon CloudWatch
Logs, metrics and alarms for every component.
AWS CloudTrail
Audit trail of API and account activity.
What each service does
Managed services keep operational work low, so the team can spend its time on the quality of answers.
| Service | Category | Role in CodePilot AI |
|---|---|---|
| Amazon Bedrock | Foundation models | Generates answers, reviews and documentation, and creates embeddings for code chunks. Managed access to models without hosting them. |
| Amazon S3 | Object storage | Holds repository snapshots, generated documents and export files, with encryption and lifecycle rules. |
| Amazon ECS Fargate | Containers | Runs the web application, API and AI orchestration services without managing servers. |
| Amazon RDS for PostgreSQL | Relational database | Stores workspaces, repositories, users, review results and metadata. |
| pgvector | Vector search | Adds vector similarity search to PostgreSQL, so code embeddings live beside the data they describe. |
| AWS Lambda | Event-driven compute | Runs ingestion, parsing, chunking and indexing jobs when a repository is connected or updated. |
| Amazon CloudFront | Content delivery | Serves the web application and static assets quickly, with TLS at the edge. |
| AWS WAF | Web application firewall | Blocks common attacks and abusive traffic before it reaches the application. |
| AWS Secrets Manager | Secrets | Stores database credentials and repository tokens, with rotation and access control. |
| Amazon CloudWatch | Observability | Collects logs and metrics, and raises alarms for errors and latency. |
| AWS CloudTrail | Audit logging | Records API activity across the AWS account for review and investigation. |
Two flows that matter
Indexing a repository and answering a question use the same components in different orders.
Repository ingestion
- A repository is connected and a snapshot is stored in Amazon S3.
- An S3 event starts an AWS Lambda function.
- Lambda unpacks the snapshot, parses files and splits them into chunks.
- Chunks are embedded with a model on Amazon Bedrock.
- Embeddings and metadata are written to PostgreSQL with pgvector.
Answering a question
- The request reaches Amazon CloudFront and is screened by AWS WAF.
- The application on Amazon ECS Fargate authenticates the user and checks repository access.
- The question is embedded and matched against pgvector for the most relevant code.
- Retrieved context is sent to a model on Amazon Bedrock to draft the answer.
- The answer is returned with citations, and logs and metrics go to Amazon CloudWatch.
Security and governance
Source code is among a company's most sensitive assets. The architecture starts from that assumption.
Least privilege
Services get only the permissions they need, and secrets never live in code or images.
Traceable activity
Account and API activity is recorded, so unusual access can be investigated.
Layered protection
Traffic is filtered at the edge, encrypted in transit and encrypted at rest.
Separated data
Customer data is kept apart by workspace, with access checked on every request.
A grounded approach to AI
Large language models are strong at explaining code and weak at admitting what they do not know. CodePilot AI is designed to compensate.
Retrieval before generation
Models only see code that was retrieved for the question, and are instructed to answer from it. If retrieval finds nothing relevant, the answer says so.
Citations are required
Answers, reviews and documents carry references to files and lines, so a reader can verify each claim in seconds.
Measured with your code
During the pilot we build evaluation questions from your repositories and track accuracy over time, instead of relying on generic benchmarks.
Where the platform is heading
CodePilot AI is at the proof-of-concept stage. The roadmap is shaped by what pilot teams need.
Proof of concept
Managed environment, core Q&A, code review and documentation on pilot repositories.
Pilot
Evaluation sets from pilot teams, more languages, Git provider integrations and usage insights.
Production
Dedicated deployment options, single sign-on, extended audit controls and service-level commitments.
Talk to us about your architecture requirements
Tell us about your security, data residency and integration needs, and we will show how CodePilot AI can meet them.