Core Concepts

Organizations

An organization is your team's workspace. It owns streams, connectors, policies, packs, and members. Each org has a unique slug used in URLs (e.g. eventstream.wtf/acme-corp). Orgs are created after wallet connect and can have multiple members with role-based access (owner, admin, member, viewer).

Org Buckets

Each org can connect an S3-compatible storage bucket (Storj) for cold archival. Events that exceed your hot retention window are automatically archived to your bucket. This means your historical data lives on infrastructure you control.

Streams

A stream is a named channel of events within your organization. Each pack creates its own stream, or you can create custom streams.

Events

Events are the atomic unit of EventStream. Each event has a source, action, subject, class (audit/workflow/kpi/trace/noise), and importance level.

Packs

Packs are curated bundles that come with pre-configured sources, classification rules, and default policies. There are four built-in packs: Finance & Treasury, Sales & Partnerships, Ops & Delivery, and Security & Governance.

Policies

Policies control what happens to events: **store** (full write), **rollup** (aggregate counter), **sample** (probabilistic store), or **drop** (discard). Policies are evaluated in priority order.

Connectors

Connectors bridge external services to EventStream. They operate in three modes: webhook push (service sends events to us), polling pull (we periodically fetch events), or inline action (triggered by other events). All connectors are managed through Composio.