DevOps & Integration Guide

Enterprise Integration Architecture

Technical reference for system architects evaluating CareIntegrity.AI for government-scale deployment. Covers data source connectivity, identity management, persistence, CI/CD, and multi-cloud infrastructure patterns.

System Architects DevOps Engineers Solution Architects Security Architects Integration Leads
Architecture Data Sources Cloud Storage Identity & SSO Persistence AI/ML Pipeline CI/CD Security Monitoring
System Architecture
Multi-Cloud Reference Architecture

CareIntegrity.AI is designed as a cloud-agnostic platform that integrates with existing government infrastructure. It can deploy on AWS, Azure, GCP, or on-premises -- connecting to any combination of data sources and identity providers.

High-Level Integration Architecture

Snowflake
Data Warehouse
Oracle DB
Claims
Azure SQL
Providers
RDS / Redshift
Analytics
Data Ingestion Layer (Batch + Real-time)
CareIntegrity.AI
8 Detection Engines
Output APIs + Event Streaming
Risk Scores
Alerts
Reports
Webhooks

Deployment Options

  • AWS ECS/EKS with RDS, S3, SageMaker
  • Azure AKS with Azure SQL, Blob, Azure ML
  • GCP GKE with Cloud SQL, GCS, Vertex AI
  • On-premises Docker/Kubernetes behind government firewall
  • Hybrid: compute on-prem, data in cloud (or vice versa)

Infrastructure Requirements

Compute4+ vCPU, 16GB RAM (min), 8+ vCPU recommended
Storage100GB SSD for application, scalable object storage for data
NetworkVPC/VNet with private subnets, NAT gateway
DatabasePostgreSQL 14+ or any supported RDBMS
Python3.9+ with scientific computing packages
Node.js18+ for frontend build
Data Integration
Connecting to Government Data Sources

CareIntegrity.AI connects to any data source that holds NDIS claims, provider registrations, participant records, or workforce data. No data migration required -- connect to existing systems.

Snowflake Snowflake

Native Snowflake connector with warehouse management.

  • ODBC/JDBC and Python connector
  • Multi-cluster warehouse support
  • Time Travel for historical analysis
  • Secure Data Sharing between orgs
  • Role-based access with key-pair auth
# snowflake connection
SNOWFLAKE_ACCOUNT=org.au-east-1
SNOWFLAKE_WAREHOUSE=COMPUTE_WH
SNOWFLAKE_DATABASE=NDIS_PROD
SNOWFLAKE_SCHEMA=CLAIMS
SNOWFLAKE_AUTH=keypair

AWS AWS

Full AWS ecosystem integration.

  • RDS (PostgreSQL, MySQL, Oracle) via IAM auth
  • Redshift for analytics warehouse
  • S3 for invoice storage and ML models
  • SageMaker for model training/serving
  • Secrets Manager for credential rotation
  • CloudWatch for monitoring
  • VPC peering for private connectivity

Azure Azure

Native Azure service integration.

  • Azure SQL Database / Managed Instance
  • Azure Data Lake Storage Gen2
  • Azure Blob Storage for documents
  • Azure Machine Learning endpoints
  • Azure Key Vault for secrets
  • Azure Monitor and Log Analytics
  • VNet integration with service endpoints

Oracle Oracle

Enterprise Oracle database connectivity.

  • Oracle Database 12c+ via cx_Oracle / python-oracledb
  • Oracle Autonomous Database (cloud)
  • Oracle Cloud Infrastructure (OCI) integration
  • TNS connection with wallet authentication
  • Real Application Clusters (RAC) support
  • Oracle Data Guard for DR scenarios
# oracle connection
ORACLE_DSN=ndis-claims.oraclecloud.com:1521/CLAIMS_PDB
ORACLE_AUTH=wallet
ORACLE_WALLET_DIR=/opt/oracle/wallet

Generic Sources

Connect to any data source via standard protocols.

  • PostgreSQL, MySQL, SQL Server via SQLAlchemy
  • REST APIs with OAuth2, API Key, or mTLS
  • SFTP for batch file ingestion
  • Apache Kafka / AWS Kinesis for streaming
  • CSV/Parquet file import from any storage
  • GraphQL endpoints
  • SOAP/XML web services (legacy)
Data stays in place. CareIntegrity.AI reads from source systems via secure connectors. No bulk data migration or ETL pipeline changes required. The system can operate in read-only mode against production databases with minimal query overhead.
Object Storage
Cloud Storage for Documents, Models & Archives

Storage Architecture

AWS S3
Invoices, PDFs
→
CareIntegrity.AI
Processing
←
Azure Blob
Provider Docs
S3 - Models
↔
ML Pipeline
↔
ADLS Gen2

AWS S3 AWS

  • Server-side encryption (SSE-S3, SSE-KMS)
  • Bucket policies and IAM roles
  • S3 Select for in-place querying
  • Lifecycle rules for archival to Glacier
  • Cross-region replication for DR
  • Pre-signed URLs for secure access

Azure Storage Azure

  • Blob Storage (hot, cool, archive tiers)
  • Data Lake Gen2 with hierarchical namespace
  • Azure AD RBAC on containers
  • Managed identity authentication
  • Immutable storage for compliance
  • Azure CDN for global distribution

GCS & Others GCP

  • Google Cloud Storage with uniform access
  • MinIO for on-premises S3-compatible storage
  • Ceph for distributed object storage
  • NetApp StorageGRID for enterprise
  • Any S3-compatible API supported
Identity Management
Active Directory, SSO & Federation

CareIntegrity.AI integrates with enterprise identity providers for single sign-on, role mapping, and centralised user lifecycle management. No separate user database required in production.

Identity Federation Architecture

Azure AD
Primary IdP
→
SAML 2.0 / OIDC
→
CareIntegrity.AI
JWT Sessions
On-Prem AD
LDAP/LDAPS
→
AD Connect / ADFS
→
CareIntegrity.AI

Azure Active Directory Azure AD

Primary integration path for Australian government.

  • SAML 2.0 SSO with automatic role mapping
  • OpenID Connect (OIDC) for modern auth
  • Azure AD groups mapped to CareIntegrity roles
  • Conditional Access policies honoured
  • Multi-factor authentication (MFA) enforced
  • Azure AD B2B for cross-org collaboration
  • Privileged Identity Management (PIM) for admin access
# Azure AD SAML configuration
SAML_ENTITY_ID=https://careintegrity.ai
SAML_SSO_URL=https://login.microsoftonline.com/{tenant}/saml2
SAML_CERT=/etc/ssl/azure-ad-cert.pem
ROLE_MAPPING=
  AzureAD_FraudTeam  -> fraud_officer
  AzureAD_Investigators -> investigator
  AzureAD_Inspectors -> inspector
  AzureAD_Analysts -> analyst
  AzureAD_Admins -> admin

Other Identity Providers

Compatible with any standards-based IdP.

  • On-premises Active Directory via LDAP/LDAPS
  • AD FS (Active Directory Federation Services)
  • Okta (SAML 2.0 and OIDC)
  • Auth0 / Ping Identity / ForgeRock
  • AWS IAM Identity Center (SSO)
  • Google Workspace SAML
  • Keycloak (open-source, self-hosted)
  • Government-specific: myGovID, Digital Identity
Role-Based Access Control (RBAC): CareIntegrity.AI ships with 6 pre-defined roles (Admin, Fraud Officer, Investigator, Inspector, Analyst, Viewer) with 35+ granular permissions. These map directly to Active Directory groups for zero-touch provisioning and deprovisioning.

User Lifecycle Management

CapabilityImplementationStandard
ProvisioningSCIM 2.0 auto-provisioning from Azure AD / OktaRFC 7643/7644
DeprovisioningAutomatic disable on AD group removalSCIM 2.0
Role SyncAD group membership mapped to app roles every 5 minSAML Assertions
MFADelegated to IdP (Azure AD, Okta) -- not managed in-appFIDO2 / TOTP
Session ManagementJWT tokens with configurable TTL, revocation via IdPRFC 7519
Audit TrailAll auth events logged with user, IP, action, timestampISO 27001
Data Persistence
Application Database & State Management

CareIntegrity.AI requires a persistence layer for application state, computed risk scores, audit logs, and investigation records. This is separate from the source data systems it reads from.

Primary Database Options

  • PostgreSQL 14+ (recommended -- open source, JSONB, GIS)
  • AWS RDS PostgreSQL / Aurora
  • Azure Database for PostgreSQL Flexible Server
  • Google Cloud SQL for PostgreSQL
  • Oracle Database 19c+ (enterprise)
  • SQL Server 2019+ (Azure integration)

What Gets Persisted

  • Computed risk scores and alert history
  • Investigation records and case notes
  • Penalty and enforcement records
  • Watchlist entries and tip-offs
  • Audit logs (all user actions)
  • Custom rule definitions
  • Fine code configurations
  • User preferences and settings

Cache & Session Layer

LayerTechnologyPurpose
Application CacheRedis / ElastiCache / Azure CacheGraph computation results, embeddings, baselines
Session StoreRedis / DynamoDB / Table StorageJWT session metadata, CSRF tokens
Message QueueRabbitMQ / SQS / Azure Service BusAsync claim processing, alert delivery
Search IndexElasticsearch / OpenSearchFull-text search across entities and claims
Stateless application tier. CareIntegrity.AI application servers are stateless -- all state lives in the database and cache layers. This enables horizontal scaling and zero-downtime deployments.
AI/ML Pipeline
Model Training, Serving & Integration

ML Pipeline Architecture

Training Data
Snowflake/S3
→
SageMaker / Azure ML
Training
→
Model Registry
S3 / MLflow
→
Inference API
Real-time scoring

Model Training Platforms

  • AWS SageMaker (managed training and endpoints)
  • Azure Machine Learning (experiments and deployments)
  • Google Vertex AI (AutoML and custom training)
  • Databricks MLflow (experiment tracking)
  • Local training for sensitive government data
  • Federated learning for cross-agency models

Supported Model Formats

  • scikit-learn (joblib/pickle)
  • XGBoost / LightGBM native format
  • PyTorch (.pt) for GNN models
  • TensorFlow / Keras SavedModel
  • ONNX for cross-platform inference
  • Custom Python models with standard interface
DevOps
CI/CD, Infrastructure as Code & Deployment

CI/CD Pipeline

  • GitHub Actions / Azure DevOps / GitLab CI
  • Automated testing (unit, integration, E2E)
  • Docker image build and registry push
  • Helm chart deployment to Kubernetes
  • Database migration management (Alembic)
  • Blue-green / canary deployment strategies
  • Automated rollback on health check failure

Infrastructure as Code

  • Terraform modules for AWS / Azure / GCP
  • Helm charts for Kubernetes deployment
  • Docker Compose for development/staging
  • Ansible playbooks for on-premises
  • CloudFormation templates (AWS-specific)
  • ARM templates / Bicep (Azure-specific)

Container Architecture

# docker-compose.yml (production)
services:
  api:
    image: careintegrity/api:latest
    replicas: 3
    resources: 4 vCPU, 8GB RAM
  worker:
    image: careintegrity/worker:latest
    replicas: 2
    resources: 8 vCPU, 16GB RAM (GPU optional)
  redis:
    image: redis:7-alpine
  postgres:
    image: postgres:16
    volumes: persistent
Security
Government-Grade Security Architecture

Network Security

  • VPC / VNet isolation with private subnets
  • WAF (Web Application Firewall)
  • DDoS protection (Shield / Azure DDoS)
  • TLS 1.3 for all connections
  • mTLS for service-to-service
  • Network ACLs and security groups

Data Security

  • AES-256 encryption at rest
  • TLS 1.3 encryption in transit
  • Field-level encryption for PII
  • Key management (KMS / Key Vault)
  • Data masking for non-production
  • Automated PII detection and redaction

Compliance

  • SOC 2 Type II ready architecture
  • ISO 27001 aligned controls
  • Australian Privacy Principles (APP)
  • IRAP assessment ready
  • NIST 800-53 control mapping
  • Essential Eight alignment
PROTECTED-level capable. Architecture supports Australian Government PROTECTED classification when deployed within an accredited hosting environment with appropriate security controls, network segmentation, and personnel clearances.
Observability
Monitoring, Logging & Alerting

Monitoring Stack

  • Prometheus + Grafana dashboards
  • AWS CloudWatch / Azure Monitor
  • Application Performance Monitoring (APM)
  • Custom engine health metrics
  • Real-time claim processing throughput
  • Alert latency and false positive tracking

Logging & Audit

  • Structured JSON logging (ELK / Splunk)
  • Full audit trail of all user actions
  • SIEM integration (Splunk, QRadar, Sentinel)
  • Log retention configurable (365+ days)
  • Tamper-evident audit logs
  • SOC/NOC dashboard integration

SLA Targets

MetricTargetMeasurement
Availability99.9% uptimeSynthetic monitoring + health endpoints
Claim Processing< 500ms per claimP95 latency from ingestion to risk score
Alert Generation< 5 min from anomalyTime from data arrival to alert dispatch
API Response< 200ms P95All REST endpoints under normal load
Recovery Time (RTO)< 1 hourFull system recovery from backup
Recovery Point (RPO)< 15 minutesMaximum data loss on failure

Ready to Evaluate?

See the platform in action or request a technical architecture workshop for your deployment scenario.

Access Live Demo Request Architecture Workshop
Demo: admin / NDISAdmin2025!