Architecture

Four planes, and what crosses between them

  ─────────────────────────────────────────── PUBLIC INTERNET ──────────

    Browser                     API client                  Upstream
    (Terminal,                  (issued key)                data sources
     Atropos, site)                                         (55 public feeds)
        │                            │                            │
        │ TLS 1.3                    │ TLS 1.3                    │ TLS,
        ▼                            ▼                            │ outbound only
  ══════════════════════════ CLOUDFLARE EDGE ═══════════════════════════
                                                                  │
    Pages ─── static HTML, no execution                            │
    Workers ─ the API. Stateless. Rate-limited. Key check. ◄───────┘
        │       Licence filter. Responses cached by class.
        │
        ├── KV .............. cache, cursors, counters   (reconstructible)
        ├── R2 .............. bulk extracts, scene cache (reconstructible)
        ├── Durable Objects . coordination locks         (reconstructible)
        ├── Workers AI ...... extraction + embeddings    (stays in Cloudflare)
        └── Hyperdrive ...... pooled DB connections
                │
                │ TLS only, from Cloudflare's address ranges only
                │ two connections: owner role (public record)
                │                  vaethra_runtime (customer plane, NOBYPASSRLS)
                ▼
  ═══════════════════ SUPABASE — AWS us-east-2 ═════════════════════════

    PostgreSQL 17  ── the durable record and the customer plane
      • Row-level security on 92 of 92 tables; forced on the customer plane
      • Public role: execute permission on 0 of 201 functions
      • Customer rows reached only through SECURITY DEFINER functions
      • pgvector (HNSW), pg_trgm, pg_cron
      • Listener: TLS enforced; network restricted to Cloudflare (11 October 2026)
  ──────────────────────────────────────────────────────────────────────
  

Three properties of this design answer most of the questions that follow.

• Connections to upstream sources are outbound only. No provider connects to us. We fetch on a schedule, and the request carries nothing beyond a Vaethra user-agent string.
• A request never waits on an upstream provider. Reads are answered from our own store, so a provider outage affects freshness rather than availability, and is shown on the public sources panel.
• The customer plane's connection cannot bypass row-level security. It connects as a role with no table privileges of its own, and reaches a customer's rows only by a transaction-scoped SET ROLE after the organisation is known. The public record is served on a second connection that holds the owner role; that record is public, and the database refuses both connections from anywhere but Cloudflare's address ranges and without TLS. The credentials live in Hyperdrive's configuration, not in the application's secrets.

Production, preview and local, and what each can reach

There is no shared staging environment holding a copy of production data. This is deliberate: a staging copy is a second copy of the data under weaker controls, and is a common source of exposure. Changes are validated by an automated suite against fixtures, then deployed as an immutable version that can be rolled back in about a minute. See development.

Every flow, and what it contains

Inference runs inside Cloudflare and text does not leave it

• Two models, both on Cloudflare Workers AI, which executes within Cloudflare's own network: @cf/meta/llama-3.1-8b-instruct-fast for text extraction and relationship assessment, and @cf/baai/bge-base-en-v1.5 for embeddings.
• No external model provider is called. There is no request to OpenAI, Anthropic or any other model API on any code path.
• What is sent: headline and summary text from public sources, and entity names.
• What is never sent: customer data of any kind.
• Nothing is used for training. Inference runs against hosted open-weight models. There is no fine-tuning and no training corpus built from data we hold.
• Model output is labelled as model output wherever it appears. An extracted relationship carries its evidence tier and remains distinguishable from a recorded fact.

Every outbound dependency, and whether it sits on the request path

Web fonts are served from our own origin rather than from a third-party font service, so no visitor's IP address is disclosed to one. The Content-Security-Policy on every page of this site, the API, the Terminal and Atropos enumerates the permitted origins and the browser blocks anything else; you can read it in the response headers of this page.

The current position, and what the enterprise workspace adds

Vaethra's record is a single public-source dataset, identical for every reader, and the product holds no customer content. There is therefore no cross-tenant exposure risk: your operational data is not in the system.

The enterprise workspace at workspace.vaethra.com is the product that changes this, and it is now partly built. It introduces authentication, role-based access and per-customer data isolation. What exists is deliberately narrower than that list suggests: private assets can be held, published in a redacted form and withdrawn; a customer can keep a private dependency map of their own facilities and suppliers, import and export it, and trace a public disruption through it; roles are enforced, and privileged actions are recorded. Member invitation and acceptance exist and are audited; bulk data exports, alerts and integrations in the workspace are not built, and single sign-on and SCIM are not built.

Isolation is enforced by the database, not by application code: customer rows live in a schema whose tables all carry forced row-level security, reached through a role that cannot bypass it, and a missing predicate yields no rows rather than another organisation's. The negative cases — a session naming a foreign organisation, an unscoped session, a suspended organisation, a key referencing another organisation's service account — are tested rather than asserted. No customer data is held today.

The customer records that do exist today — sign-in addresses, API key digests, usage and contact details — are stored in the customer-plane schema of the same database, under forced row-level security, and reachable only through a role that cannot bypass it.

What is reachable from where

Cloudflare's DDoS protection and its managed web-application-firewall ruleset sit in front of all of it, and the API applies its own per-caller rate limits behind them. Bot management beyond that ruleset is deliberately not enabled: on this plan it would challenge legitimate API clients as readily as abusive ones.