Application architecture diagram
Architectural interpretation
The application uses a browser-delivered client and a managed backend. Cloudflare serves an immutable static release; it does not host the operational database or application-owned server. The browser contains presentation, workflow orchestration, and early validation, but it remains an untrusted execution environment. Every request that reaches protected data is re-evaluated by the managed identity, database-policy, storage-policy, or trusted-operation boundary.
The backend separates identity, relational data, object storage, realtime delivery, and privileged execution. Ordinary browser traffic uses the signed user session and the public client context. Operations that require provider credentials, cross-record transactions, administrator privileges, scheduled execution, or verified callbacks execute in the trusted serverless boundary.
Component responsibilities
| Layer | Responsibility |
|---|---|
| Browser application | User interface, route gating, tenant-aware workflows, validation, and calls to managed services |
| Cloudflare Pages | Static application build delivery over Cloudflare's edge network |
| Supabase Auth | Authentication, session issuance, refresh, and identity lifecycle |
| Data API and approved database operations | Controlled access to application data through grants, row-level security, and reviewed routines |
| PostgreSQL | System of record for customer, policy, workflow, audit, and finance information |
| Realtime | Subscription-driven updates for selected operational state |
| Serverless functions | Privileged workflows, webhooks, scheduled processing, and provider integrations |
| Object storage | Customer documents, policy evidence, generated material, and operational files |
| Monitoring | Errors, traces, security-relevant events, and selected diagnostic telemetry |
Request and control path
| Step | Processing boundary | Enforced decision | Result |
|---|---|---|---|
| 1 | Cloudflare edge | TLS termination, release selection, cache behavior, and configured edge policy | Versioned application assets are returned to the browser |
| 2 | Browser application | Route selection, field validation, workflow-state checks, and session presence | A structured service request is constructed; no authoritative access decision is made here |
| 3 | Managed gateway | Service routing, token parsing, and request admission | The request reaches Auth, Data API, Storage, Realtime, or a trusted function |
| 4 | Identity and policy plane | Session validity, account eligibility, grants, tenant scope, hierarchy, ownership, and row policy | The request is allowed, denied, or reduced to the permitted record set |
| 5 | Transaction boundary | Constraints, transaction logic, workflow invariants, and audit attribution | State changes commit atomically or fail without a partial accepted result |
| 6 | Provider boundary | Server-held credential use, outbound request validation, and callback verification | External effects are correlated with internal business state |
| 7 | Observability boundary | Error capture, trace correlation, provider logs, and incident triage | Diagnostic evidence is available without becoming an authorization source |
Current resilience status by failure domain
This table describes controls observed in the current implementation. It is not a target-state
design. Available identifies a confirmed operating control. Partially available identifies a
confirmed control with a material recovery or test gap. Not available identifies an absent control
or absent verification evidence.
| Failure domain | Status | Confirmed present | Not confirmed or not available | Current operational effect |
|---|---|---|---|---|
| Static release | Partially available | Cloudflare keeps versioned frontend deployments and a frontend release does not write operational backend data | A retained rollback exercise and approved rollback authority are not available | A prior deployment can be selected after a defective release; measured recovery time is unknown |
| Browser session | Partially available | Invalid sessions clear local application identity and return the user to authentication | Global revocation, inactivity limit, maximum duration, concurrent-session rule, and lost-device test are not available | The current browser session fails closed; other active sessions remain governed by provider token state |
| Managed API and database | Partially available | Failed service requests return errors and transaction boundaries prevent a successful partial database commit | A managed-service outage exercise, approved retry matrix, and measured reconciliation procedure are not available | Reads and writes stop during outage; automatic retry safety is confirmed only for explicitly idempotent operations |
| Trusted server operation | Partially available | Trusted operations return explicit failures and selected workflows retain correlation evidence | One complete retry, idempotency, compensation, and operator-reconciliation standard is not available across all operations | The affected workflow stops or remains pending; recovery behavior depends on the individual operation |
| External business provider | Partially available | Selected callbacks use signature validation and duplicate-event protection; provider state is stored for selected workflows | A complete provider-by-provider degraded-mode and reconciliation test is not available | The primary application remains reachable while the provider-dependent business action fails or remains pending |
| Monitoring provider | Partially available | Application monitoring and managed-platform logs exist; business transactions do not use telemetry as their authorization or commit source | Alert-delivery testing, unified retention, and documented monitoring-outage operation are not available | Core processing continues during monitoring loss, but detection and investigation coverage is reduced |
Trust-boundary control status
| Boundary | Status | Confirmed present | Not confirmed or not available |
|---|---|---|---|
| Public host to operational backend | Available | The public host serves the static web application; operational data remains in the managed backend | No material gap identified for this separation |
| Browser to protected data | Available | Database grants, row-level security, storage policies, and trusted-operation checks enforce access independently of navigation visibility | Complete negative authorization coverage is tracked separately in the remediation register |
| Privileged server operation | Partially available | Selected operations validate signed identity, tenant, role, input, and object scope before elevated processing | The managed security advisor reports exposed privileged operations without one complete grant and actor-validation review |
| Provider callback | Partially available | Selected payment and integration callbacks use a provider signature or shared-secret check | One verified callback-control inventory and replay test set is not available |
| Public object access | Partially available | Storage ownership metadata and access policies exist | One approved inventory of intentionally public objects, business classification, retention, and periodic review is not available |
Principal runtime sequence
- An authorised user loads the static application over HTTPS.
- The application restores or creates an authentication session.
- The browser requests data or an approved operation using the user session.
- Backend grants, row-level security, routine checks, and storage policies evaluate access.
- Trusted server functions contact external providers only for approved workflows.
- Configured monitoring receives diagnostic and security-relevant telemetry.
Evidence status
| Evidence area | Status | Recorded conclusion |
|---|---|---|
| Application and managed-backend architecture | Available | Component boundaries and principal request paths are supported by implementation review and read-only service inventory |
| Cloudflare delivery architecture | Available | Cloudflare Pages is the confirmed frontend delivery platform |
| Cloudflare security configuration | Not available | Active WAF, rate-limit, bot, header, TLS, and cache configuration has not been inspected |
| Provider contractual controls | Not available | Contracting entity, region, retention, audit rights, and notification terms require commercial evidence |
| Backup recoverability | Not available | Provider entitlement exists; a retained end-to-end restore exercise does not |
| Penetration testing | Partially available | Internal non-invasive assessments exist; independent authorised testing does not |
| Complete access-control correctness | Partially available | Row-level security and selected operation checks exist; complete negative coverage and privileged-operation review do not |