Architecture

Built like infrastructure.

One codebase, one image, three entrypoints — plus an isolated agent runtime and a memory service. Every boundary exists for a reason: isolation, metering, or a dependency conflict we refuse to paper over.

The boxes

Six lanes, one system.

01Desktop clientA native sync client — path-addressed uploads, delta sync by monotonic cursor, tombstoned deletes.
02API front doorUploads, retrieval, shares, the assistant endpoint, the MCP server, billing webhooks, web UI and console. Tenant identity is injected from the verified credential and re-checked against the database every request.
03Worker pipelineCPU-pinned: ingest, classification, entity extraction, thumbnails, webhook dispatch, anomaly scans, digest and insight passes. Jobs live in Postgres with lease reclaim — a worker restart loses nothing.
04Agent runtimeThe agent platform runs in its own container, reached over HTTP. The isolation is permanent by design: the runtime pins an older MCP library than the rest of the platform, and one image can't hold both.
05MemoryA memory service scoped per tenant and per department — the assistant's recall and capture never crosses a wall.
06Storage & recordsOne object-storage bucket per workspace — hard isolation by naming — while PostgreSQL is the database of record for the control plane and the document engine keeps its own document store.
The seams

Where systems meet,
we test hardest.

Every past failure lived between components, not inside them. So the checks that gate this architecture run against the live, composed stack — boxes agreeing on tenant and bucket, walls holding in both directions, queues surviving restarts.

Isolation is enforced, not promised

One bucket per workspace; the department wall re-checked on every read surface; adversarial tests try to cross the wall and must fail.

Every model call passes one gate

A single counting client meters all model usage with a declared purpose — classification, summaries, extraction, answers, compiles — into the usage ledger.

Failures don't cascade

A workflow firing never fails the upload that triggered it; a webhook retry never blocks ingest; a dead worker is reclaimed by lease, not by luck.

External surface

Small, typed, deliberate.

For your apps

A versioned REST API: upload slots, retrieval, shares, sync deltas. Desktop JWTs with rotating refresh tokens; the console uses signed sessions.

For your AI tools

An MCP server over streamable HTTP with read + ingest tools only. Personal access tokens, hashed at rest, capped per user — tenant identity comes from the token, never the request.

For your systems

Timestamped HMAC webhooks with bounded retries and a delivery log — private-network targets refused by default, with explicit opt-in.

Trust, but verify.

The trust model explains what the architecture enforces — and what humans always decide.

Read the trust model Browse the features Read the research