Stategraph

Stategraph is infrastructure as code software for Terraform and OpenTofu teams, pairing pull request automation with state kept in PostgreSQL. Open source core.

Stategraph removes the single state lock that makes Terraform teams queue changes, split state files and wait on slow plans. It keeps Terraform state as a dependency graph in PostgreSQL, so a plan reads only the part a change reaches. Stategraph is made by Terrateam B.V., a bootstrapped and independent company registered in Amsterdam. Its orchestration engine began in 2021 as Terrateam, went open source under MPL-2.0 in 2024 and now runs as Stategraph Orchestration. Orchestration plans every pull request on GitHub or GitLab and posts the plan, the cost change, the policy checks and the approvals in the review. The apply runs on merge or on a comment, layer by layer in dependency order. Apply requirements set who signs off in each environment, and Gatekeeper opens a named gate when a Checkov, Conftest, OPA or custom check fails. Drift detection runs plans on a schedule, and Infracost adds the cost of each change. Infrastructure as a Database brings resource-level locks, conflicts settled at commit, multi-state transactions, SQL over every resource and blast radius across states. The product suits platform and infrastructure teams running Terraform or OpenTofu in monorepos, multi-environment setups or regulated industries. Infrastructure as a Database is built for teams whose large states make plans slow and applies queue, and it works with or without Orchestration. A small team can let Stategraph Cloud host the orchestration. An organisation with stricter rules can self-host Orchestration and run Infrastructure as a Database in its own infrastructure, air-gapped if needed. The open-source edition suits engineers who want to run the engine themselves. Each infrastructure change begins as a pull request, where reviewers read the plan comment and see which approvals production still needs before merging. Runs execute on the team's own GitHub Actions or GitLab CI runners, and private runners reach APIs and databases inside a private network. Credentials for AWS, Azure and Google Cloud come from static keys or OIDC. Engineers ask questions of their estate with stategraph query and check what a change touches with stategraph blast-radius. Gap analysis compares an AWS or GCP account with its states and writes the import blocks for anything no state manages yet.