arbitor
Sign in Book a demo
How it works Features Pricing Blog Docs Sign in Book a demo
v2.5 Managed SaaS · self-host on Business+

Lock the resource,
not the whole state.

Sign up and point your backend config at arbitor — no servers to run, no state backend to operate. Plans run lock-free and applies lock only the resources they touch, so two engineers working in the same state never wait on each other. Need to keep state in your own network? Self-host on Business+.

Start free Read the docs
Drop-in for Terraform · OpenTofu BSL · Managed SaaS or self-host
Parallel plan + apply — multiple engineers, same state, disjoint resources, no conflicts
arbitor.blackmesa.com/states/ams → accepting connections
alice@blackmesa
feature/xen-crystal-insertion
aws_lb.api applying…
aws_lb_listener.https applying…
aws_target_group.api applying…
aws_security_group.web applying…
bob@blackmesa
hotfix/resonance-cascade
aws_rds.primary applying…
aws_rds_param_group applying…
aws_security_group.db applying…
aws_db_subnet_group.main applying…
Both plans accepted. No lock contention.
no waiting
Two engineers. Disjoint resources. Both succeed.
Drop-in replacement

The same Terraform you already use.

Point your backend config at arbitor and you're done. No rewrites, no migration tool, no downtime. Same commands, faster results.

BEFORE
# main.tf
backend "s3" {
bucket = "tfstate"
dynamodb_table = "tflock"
}
AFTER
# main.tf
backend "http" {
address = "https://arbitor.internal/state"
}
One config change. No state rewrite.
IMPORT EXISTING STATE
arbitor states import -n NAME FILE # from a local file
arbitor states import -n NAME --pull # from terraform state pull
arbitor states import -n NAME --s3 s3://... # from S3
Bring existing tfstate files. No starting from scratch.
~/infrastructure — arbitor
$ arbitor plan
Reading state from postgres://state.internal/arbitor
Refreshing 3 changed resources only
 
Plan: 2 to add, 1 to change, 0 to destroy.
+ aws_lb_listener.api_https
+ aws_target_group.api
~ aws_lb.api
 
Plan complete.
$ arbitor apply
Acquiring resource locks (3)... done
Applying alongside 1 concurrent operation
Apply complete. Resources: 2 added, 1 changed, 0 destroyed.
How it works

Sign up, point your backend at arbitor, and apply.

Replace S3 + DynamoDB with arbitor. Run it as Managed SaaS with nothing to operate, or self-host it in your own network on Business+. Either way, engineers and CI/CD pipelines apply in parallel — applies lock only the resources they touch.

Three engineers push commits to a shared repository on different branches. Each branch's CI/CD pipeline runs `arbitor plan + apply`, all converging on one shared state in Arbitor, which writes through to its PostgreSQL — managed for you on SaaS, or your own when self-hosted. A Repository node on the far left fans out three labeled branches — feat/api, feat/db, and fix/auth — to Engineer A, B, and C. Each engineer's branch triggers its own CI/CD pipeline running `arbitor plan + apply`. All three pipelines converge on a central Arbitor state-backend card, which writes through to a PostgreSQL on the right — managed for you on SaaS, or your own when self-hosted. The animation cycles through a brief idle pause, simultaneous bursts of activity from each lane, Arbitor acknowledging the concurrent arrival, and a single state packet flowing on to PostgreSQL where an arrival ring pulses as it lands. Repository main Engineer A feat/api CI / CD A arbitor plan + apply Engineer B feat/db CI / CD B arbitor plan + apply Engineer C fix/auth CI / CD C arbitor plan + apply ARBITOR State backend drop-in for S3 + DynamoDB state PostgreSQL state store
Managed SaaS
The default. Nothing to run — we operate the database for you.
Self-hosted
On Business+, run arbitor in your own network against your PostgreSQL.
Same engine
Parallel, resource-level applies whichever way you deploy.
Deployment

Run it where it has to run.

Start on Managed SaaS in minutes — zero infrastructure to run. Need a dedicated stack? Private Cloud (Startup+) isolates you at every layer. Can't put state on someone else's servers at all? Self-host on Business+. Three shapes, so the answer is always yes.

INQUORI CLOUD app.arbitor.dev
Managed SaaS
The fastest way to start. Create your account at account.arbitor.dev and point your backend config at the arbitor app — no servers to run, no database to operate. Available on every tier, from the free Community plan up through Business. Start in minutes.
Start on Managed SaaS
CLOUD REGION YOURS
Private Cloud
Startup tier and up (+50%): a dedicated single-tenant stack on dedicated hardware. Pick the region, or bring your own cloud account. Nothing is co-mingled with another customer at any layer.
Private Cloud
YOUR NETWORK ARBITOR
Self-hosted Coming soon
Business tier and up: run the arbitor server inside your own perimeter. State and infrastructure metadata stay in a PostgreSQL you operate. The only outbound traffic is a small periodic license check — no inbound access to your network required. Air-gapped license available on Enterprise.
Self-hosting guide
What you get

Everything Terraform should be.

Six capabilities your current state backend can't give you. No new tools to learn — same Terraform, faster, safer.

Plans in seconds
Only changed resources refresh. Skip the 247 you didn't touch.
Parallel plan + apply
Two engineers, a shared state, disjoint resources, both succeed. Same-resource conflicts surface immediately.
Upstream protection
Other engineers' work stays scoped. Out-of-scope changes blocked.
Visual dependency map
See blast radius before you apply. Understand what touches what.
Self-hosted
The arbitor server runs in your network. State stored in PostgreSQL you own.
Resource-level locking
Lock individual resources, not entire states. Fine-grained control.
The platform

Built for teams, not just for state.

Arbitor isn't only a state backend. It comes with a web UI, change history, checkouts, and admin controls — so multi-engineer teams can see what's happening and stay out of each other's way.

arbitor.internal/states
prod-us-east-1 / resources
admin: locked
  • aws_lb.api idle
  • aws_target_group.api idle
  • aws_rds.primary @alice · feat/db-migration · 4 resources held
  • aws_security_group.web idle
Know who you collided with.
Override events surface the user, branch, and commit SHA that touched your resources. Your next plan tells you what changed.
Hold what you're working on.
Checkouts reserve resources for hours, not minutes. Branch-aware, so git worktrees just work.
Admin controls when you need them.
Lock down an entire state during incidents. Write-protect individual resources to prevent regressions.
Live state, no refreshing.
The dashboard reflects state writes as they land. No polling, no stale views.
Start free on Managed SaaS

Replace your state backend in 60 seconds.

Create your account at account.arbitor.dev and point your backend config at arbitor — zero infrastructure to run. No credit card. No catch. Need to self-host? That's available on Business+.