Cloud and hosting provider details
| Provider | Production role | Provider-operated boundary | FinTrack responsibility |
|---|---|---|---|
| Cloudflare Pages | Builds, deploys, and serves the web application through Cloudflare's global network | Edge delivery, platform availability, TLS and baseline DDoS protection | Release approval, domain and security configuration, headers, access, monitoring, and rollback decisions |
| Supabase | Managed PostgreSQL, authentication, APIs, object storage, realtime, serverless workflows, scheduling, backups, and platform logs | Infrastructure, operating system, managed services, database availability, backups, and platform monitoring | Schema, data, identities, grants, row-level policies, secrets, application logic, retention, and recovery validation |
| Sentry | Application error, performance, replay, and release observability | Telemetry platform operation and availability | Data minimisation, masking, retention, alert routing, and incident response |
Deployment model
The browser receives a static release from Cloudflare and calls Supabase services over TLS. Trusted backend workflows call approved business providers. There is no application-owned virtual machine or directly managed database host in the reviewed topology.
Service boundary detail
| Boundary | Publicly reachable surface | Stateful data | Administrative surface | Isolation mechanism |
|---|---|---|---|---|
| Cloudflare delivery | Versioned static routes and assets over HTTPS | Deployment metadata and provider logs; no application system of record | Cloudflare account and project administration | Provider account roles, deployment separation, immutable releases, and edge configuration |
| Browser runtime | The application origin and approved browser-direct destinations | Session material, transient form state, and user-authorised downloads on the endpoint | Customer-controlled browser and device | Same-origin policy, TLS, application validation, endpoint controls, and backend revalidation |
| Supabase gateway | Managed Auth, Data, Storage, Realtime, and Function endpoints | Routes requests to managed stateful services | Supabase organization and project administration | Signed sessions, grants, row policies, storage policies, and trusted execution boundaries |
| PostgreSQL | Reached through managed services or restricted administration | Customer, policy, workflow, audit, configuration, and finance records | Provider database administration and approved operational access | Database roles, schema grants, row-level security, constraints, transactions, and audited change control |
| Object storage | Policy-controlled object API | Customer, vehicle, quote, policy, and operational objects plus metadata | Provider storage administration | Bucket and object policies, ownership metadata, purpose restrictions, and authenticated access |
| Sentry | Provider ingestion endpoints and administration UI | Configured diagnostic events, traces, replay samples, and release metadata | Monitoring account administration | Project credentials, role-based access, data scrubbing, sampling, retention, and alert configuration |
FinTrack administrators configure releases, provider access, domains, security controls, data policies, retention, backups, and alert routing. Cloudflare and Supabase operate the underlying infrastructure and managed services. Customer administrators control which personnel can use the application and remain responsible for endpoint security and timely user-lifecycle requests.
Provider-control evidence set
| Evidence object | What it establishes |
|---|---|
| Cloudflare deployment history | The production alias, immutable releases, build result, operator, and rollback source |
| Cloudflare access and security export | Named administrators, role boundaries, MFA posture, active edge rules, headers, rate controls, and security events |
| Supabase service inventory | Enabled managed services, project plan, region, runtime components, and current deployment state |
| Supabase access export | Organization/project membership, roles, MFA posture, service credentials, and recent privileged changes |
| Database and storage inventory | Managed data domains, row-security coverage, object-storage boundaries, backup entitlement, and recovery dependencies |
| Sentry project settings | Data scrubbing, replay masking, sampling, retention, alert routes, member access, and release association |
| Contract and assurance records | Contracting entity, service tier, region, incident terms, processor terms, assurance reports, and support channel |
| Recovery exercise | The selected recovery point, operator, elapsed time, validation, reconciliation, and achieved RPO/RTO |
Capacity and service change
Managed-service scaling does not remove application responsibility. Schema design, query behavior, realtime subscriptions, function duration, storage growth, browser bundle size, provider quotas, and log volume are monitored against service limits. A plan, region, runtime, or material provider change requires compatibility review, recovery impact analysis, data-processing review, controlled rollout, and rollback or exit planning before production reliance.
Evidence and limitations
- Cloudflare Pages and Supabase usage are established from the application architecture and managed-service inventory.
- The Supabase project is on a Pro subscription according to the supplied account context.
- Exact regions, data-residency commitments, service tiers, account-role assignments, WAF configuration, and contract terms require account or contract evidence before reliance.
- Provider capability is not presented as proof that every optional control is enabled.