NewUninterrupted releases: gradual rollouts and instant rollback

One push.
Every cloud you own.

Lakefront ships your services into your own Azure, AWS and GCP accounts, and moves them between regions and providers the moment one goes down. Your data, your bill, your exit.

Lakefront · acme
Platform
Services
Status
Recovery
Previews
Deploy
Clouds
Secrets
Databases
Domains
acme / Services acme/checkout Deploy
Checkout8 services · 2 clouds
checkout-apiwebeastusLive
checkout-webstaticeastusLive
ledger-workerworkerus-east-1Deploying
invoice-renderfunctionus-east-1Live
nightly-reconcilecronwesteuropeLive
search-indexerworkereu-west-1Live
webhooks-apiwebeastusLive
thumbnailerfunctionus-east-1Live

Deploys into the cloud accounts you already own

A deploy platform that owns nothing. Lakefront gives your team a Heroku-grade push-to-deploy workflow inside your own cloud accounts, with the governance a platform team actually needs.

One definition

Describe a service once. It compiles to each provider’s native primitives. No Kubernetes to babysit, no YAML to memorize.

Every cloud you own

Azure, AWS and GCP behind one control plane, one permission model, and one audit trail.

Built to survive

Warm standbys in another region or another cloud, promoted automatically and rehearsed with drills.

Push to main.
That’s the deploy.

Connect a repo and every push builds an immutable image in your own registry, runs your tests, and rolls out behind a health check. The pipeline is already wired. You never author it.

Learn more
checkout-api · Lakefront
Platform
Services
Status
Recovery
Previews
Deploy
Clouds
Secrets
Databases
Domains
acme / Services / checkout-apiLivecheckout.acme.com
OverviewMetricsLogsDomainsSettings Azure · eastusweb
Requests · 24h
1.84M
P95
68ms
Replicas
6
Errors
0.02%
Cost · mtd
$612
Revisionsgradual · drain 30s
00428f3c1a2Reduce ETA jitter100%Serving
0041c19d004Handle GPS dropouts0%Rollback to
0040a77be31Optimize map tiles0%Rollback to
00394e0cc82Clean up deprecated APIs0%Rollback to
lakefront.service.ts
// One definition. It compiles to each cloud's native primitives. export default service({ name: 'checkout-api', source: repo('acme/checkout'), workload: 'web', // worker · cron · static · function cloud: 'azure', // or aws regions: ['eastus', 'westeurope'], scale: { min: 1, max: 10 }, release: { strategy: 'gradual', drain: 30 }, });

AI agents,
with real credentials.

Agents register through auth.md, act on behalf of a member, and are capped to a closed scope set, so they can ship a service but never widen their own access. Routed through Claude first, with an OpenAI fallback.

Learn more
Lakefront · acme
Platform
Services
Clouds
Secrets
Organization
Access
Agents
Automation
acme / Settings / Agents / deploy-botActiveon behalf of jordan@acme.com
Ship checkout-api to westeurope, keep eastus as the primary, and hold the rollout if p95 crosses 400 ms.
Claude Opus 4 scopes
Worked for 14s
Read checkout-api spec: web workload, Azure, 1–10 replicas.
Added westeurope as a warm standby and wired the p95 guard to the existing alert rule.
Refused to widen the deploy role: connections:write is outside its scopes.
Deploy checkout-api · 2 regions+18 −4Awaiting approval
Settings · Automation
Model chain

Claude first, OpenAI on failure. Every call records which provider served it.

1Claude OpusPrimary reasoning
2Claude HaikuClassification
3OpenAI GPTFallback
4OpenAI GPT miniFallback classify
Claude Code− ⤢ ✕
promote the staging build of checkout-api to production
checkout-api · build #418 added to context
Worked for 22s
Verified the image digest matches the staging release.
Rolled out revision 0042 behind a health check.
Cursor− ⤢ ✕
why did last night's nightly-reconcile cron fail?
nightly-reconcile · 3 runs added to context
Worked for 9s
Found a 502 from the ledger API at 02:14 UTC.
Opened an alert rule for consecutive cron failures.
GitHub Actions− ⤢ ✕
rotate every database credential older than 60 days
4 secrets · 2 clouds added to context
Worked for 1m 40s
Generated new credentials and swapped them in place.
Revoked the old versions once traffic drained.
Your own script− ⤢ ✕
draft a public update for the eastus latency incident
INC-31 · 12 signals added to context
Worked for 6s
Drafted a customer-safe note.
Redacted 3 internal details before publishing.

Watch it,
and survive it.

Requests, latency, CPU and memory read straight out of your cloud. No agent to install, no second bill. When a region stops answering, traffic is already somewhere else.

Learn more
Recovery · checkout-api
Tier 2 · multi-regionProtectedRTO 90s · RPO 0
eastusprimary6 replicas · 100% trafficHealthy
westeuropestandby2 replicas · warmHealthy
us-east-1cross-cloud2 replicas · warmHealthy
Last drill14 days ago
02:14:03 primary eastus unreachable · 3 consecutive probes
02:14:11 promoting westeurope → primary
02:15:22 DNS cut over · 79s total
✓ failed over with zero dropped requests
checkout-api · Metrics
checkout-api1h24h7d
Requests
1.84M
Error rate
0.02%
P95
68ms
Replicas
6
Requests2xx
00:0012:00now
Latencyp95
00:0012:00now
p95 above 400ms for 5 minutesSlack · #checkout-oncallArmed

One set of permissions.
Every provider.

Grant a person or an agent access once and Lakefront maps it to the right IAM roles in each cloud. Access is brokered per request and expires on its own. No long-lived key exists for anyone to steal.

Learn more
Access · my access
Eligible roles
Production deployerAcme Productionmax 4h · needs approvalActivate
Secrets operatoracme-prodexpires in 41mActive
Auditone trail, every cloud
JDjordan activated Secrets operator41m ago
AMamina deployed checkout-api to eastus2h ago
CCclaude-code read logs for ledger-worker3h ago
Revoke a grant and it disappears from every provider at once.
Clouds
Connected accounts
Acme Production
subscription · 3 regions
Connected
acme-prod
cross-account role · us-east-1
Connected
Connect a project
workload identity federation
Connect
Brokered per request and expiring on its own. No long-lived key is ever stored.

Databases, buckets
and secrets.

Provision Postgres, SQL Server and object storage into your own account, priced live before you commit. Credentials land in your Key Vault and rotate themselves without dropping a connection.

Learn more
Databases · new
Provision a database
PostgreSQL 17SQL Server 2022
Cloud
Azure · eastus
Compute
D2ds_v5 · 2 vCPU
Storage
128 GiB
High availability
zone-redundant
Compute
$142
Storage
$18
Est. / month
$160
Credentials are written into your Key Vault. Lakefront never stores a copy it could read.
Secrets
checkout-apiauto-rotate
DATABASE_URL
v14 · rotated 2d ago
Current
STRIPE_SECRET_KEY
v9 · rotates in 12d
Current
REDIS_PASSWORD
v22 · rotating now
Swapping
04:00:02 generate REDIS_PASSWORD v23
04:00:09 swap · both versions valid
04:01:14 revoke v22 · no failed connections
Storage · acme-invoices
acme-invoicesBlob · eastus
Objects
184k
Size
412 GiB
Est. / month
$9.40
2026/08/INV-88214.pdf182 KB
2026/08/INV-88215.pdf176 KB
2026/08/manifest.json4 KB
Browsed with a short-lived signed URL, minted per click and never stored.
Domains · checkout.acme.com
checkout.acme.comVerified
A
checkout
20.51.14.8
Front Door
CNAME
www
checkout.acme.com
alias
TXT
_lakefront
lf-verify=8f3c…
ownership
TLS issuedRoute 53Azure DNSwildcard previews

Tell customers
before they ask.

A public status page, an incident workspace, and updates drafted from the real signals, with the internals redacted before anything is published. Cost lands in the same place, straight from your own bill.

Learn more
Incidents · INC-31
Elevated latency in eastusMonitoring
We identified elevated response times affecting a subset of checkout requests in North America. Traffic has been shifted and latency is back to normal. We are monitoring.
Drafted from 12 signals3 details redactedPost publicly
status.acme.com
Checkout99.98% · 90d
Payments APIdegraded · 14m
Dashboard99.99% · 90d
Costs
This monthzero markup
Azure
$1,284
AWS
$742
Forecast
$2,190
Aug 1Aug 14
checkout-apiContainer Apps$612
ledger-workerFargate$388
checkout-dbFlexible Server$284

Everything else it does

A platform team’s backlog, already shipped.

Git-push deploys

Connect a repo. Every push builds an immutable image, runs your tests and rolls out behind a health check.

A URL per pull request

Every branch gets a real environment, torn down the moment the PR closes.

Monorepos, understood

Lakefront scans the repo, proposes each service it finds, and notices when you add one nobody deployed.

Web, worker, cron, static, function

Five workload kinds, each compiled to the right native primitive on each cloud.

Uninterrupted releases

Overlapping and gradual rollouts, connection draining, lifecycle hooks and instant rollback to any past revision.

Managed databases

PostgreSQL and SQL Server provisioned in your account, priced live before you commit.

Managed object storage

Blob and S3 buckets with usage-based pricing and an in-app browser over short-lived signed URLs.

Secrets that rotate themselves

A Key Vault per environment with generate-swap-revoke rotation and zero failed connections.

Domains and DNS

Buy a domain in-app or bring your own. Records written and verified for you, TLS included.

Live metrics and alerts

Requests, latency, CPU and memory read straight from your cloud. No agent, no ingestion, no second bill.

Runtime logs

Tail any service in the browser, across both providers, with the same console.

Multi-region failover

Warm standbys in another region, or another cloud, promoted automatically and rehearsed with drills.

Status pages and incidents

A public page, an incident workspace, and AI-drafted updates that redact the internals before they ship.

Just-in-time access

Azure-PIM-style eligible roles with approval, expiry, and one audit trail across every cloud.

Agent-native by protocol

Agents register through auth.md, act on behalf of a member, and can never exceed that member’s permissions.

Cost, before and after

Deploy-time estimates and month-to-date spend, straight from your own bill with zero markup.

Build and runtime caches

Dependency and framework caches in your registry, plus a shared runtime cache so replicas agree.

Notifications where you work

Deploy, alert and incident events routed to Slack and email.

Scheduled work

Cron services with the same build, secrets and rollback story as everything else.

Enterprise accounts

A contract layer above organizations, with pooled entitlements and an admin boundary that holds.

“Your data never leaves the account you already pay for.”
Zero-access by designEncryption keys stay in your KMS. We cannot read your data.
“Switch us off and everything keeps running.”
A control plane, not a hostContainers and your registry. No proprietary runtime to unwind.

Your cloud. Our deploy button.

Free while you build. You only ever pay your own cloud.