Faro Lighthouse · Technical overview
How Lighthouse works
A metadata-driven data foundation, deployed in your own cloud tenant. Sources, loads, history and access rules are described in configuration; a generic engine does the rest. Your team writes only the business logic, in plain SQL.
Architecture
From source systems to answers, in layers
Data moves through a layered (medallion) architecture. Every step is generated from metadata, so adding a source or an object does not mean writing a new pipeline.
Metadata-driven
We automate the plumbing. You keep the business logic.
Each source object is described once: how to load it, how to detect changes, how to keep history. A generic merge engine handles the rest, detecting changed rows by hash and applying slowly changing dimensions (SCD type 0, 1 or 2) as configured.
| Step | Configuration | Code |
|---|---|---|
| Ingest to Bronze | load type, keys, watermark, history (SCD), schedule | generic engine |
| Bronze to Silver | which objects, validation rules | generic template |
| Silver to Gold | history type, default rows | your business logic in SQL |
| Access | permissions, row filters, masking | generic engine |
{
"source": "erp_finance",
"object": "dbo.Invoices",
"load": "incremental",
"watermark": "ModifiedAt",
"keys": ["InvoiceId"],
"history": "scd2",
"schedule": "daily"
}Security & governance
Who sees what is a file, not a click in a console
- Permissions as configuration. Group, privilege and environment per entry - for data, schemas, compute, jobs and files.
- Masking by sensitivity tag. Tag a column as restricted and it is masked, with no per-column code.
- Row-level security. Generic rules for every table first, client-specific rules on top.
- Reconciled daily. Actual access is brought back to the configured state every day, so manual exceptions do not survive.
- Audited. Every change to access, row filters and masking is logged. An auditor gets a file with history, not a console export.
- group: finance-analysts
privilege: SELECT
schema: gold.finance
environment: prod
- column: customers.tax_id
tags:
sensitivity: restricted # maskedCloud-agnostic
Any major cloud. Always your tenant.
Lighthouse is cloud-agnostic: it runs on Microsoft Azure, AWS and Google Cloud, inside your own cloud tenant. Your data never leaves your company, and you keep the platforms you already pay for.
Microsoft Azure
Deployment & operations
Repeatable, reviewable, yours to run
Everything as code
Infrastructure, pipelines, jobs and access rules live in a repository and are deployed through CI/CD. Every change is reviewed and versioned.
Identical environments
Development, test and production come from the same definitions. Configuration can differ per environment, the engine does not.
Live in months
A working foundation in as little as 3 months - in a strictly regulated financial environment, with a team new to the cloud.
Lower running cost
Generic components replace hand-built pipelines, so there is less to maintain. One client cut platform cost from $11,000 to $1,700 a month.
Handover or managed
We deploy and hand over to your team, support it, or run it as a managed service - your choice.
Built by seniors
The team that built Lighthouse deploys it: core team together since 2017, 15 years in data on average. Meet the founders.
Integrations
Connects to the systems you already use
Databases, business applications, warehouses, files and REST APIs - without changes to your source systems.
Why not just Fabric, Databricks or Snowflake?
On your platform, not instead of it
Microsoft Fabric, Databricks and Snowflake are excellent engines. On their own they are not a data foundation: someone still has to design the layers, build the pipelines, define the KPIs and secure the access. Lighthouse is that foundation.
See it running
Bring your technical questions
We show Lighthouse on a working demo environment and walk your team through the architecture, configuration and security model.
