Architecture

Architecture

Services

• React + Vite provides the public site, workspace, and Admin Console.
• Node/Express API handles authentication, state, application records, billing, updates, and the frontend API boundary.
• Python/FastAPI service generates Strategic Reports and forecasts through a LangGraph workflow.
• PostgreSQL stores relational business records, sessions, audit logs, and one Strategic Report per application.
• MongoDB stores editable, scoped JSON configuration and workspace state.
• Caddy terminates TLS and proxies browser traffic to the private services.

Browser
  | HTTPS
  v
Caddy ──> Node API ──> PostgreSQL
  |           |             ^
  |           └────────> MongoDB
  └────> Python AI ────> PostgreSQL / MongoDB / configured model provider

Data ownership

PostgreSQL is the source of truth for users, workspaces, companies, funding programs, applications, reports, sessions, and audit logs. MongoDB's dynamic_state collection stores allowlisted configuration by platform, workspace, or user scope. Browser local storage is a cache/offline fallback, not the security boundary.

The external applications.app_id is a unique 16-character public identifier; internal relationships use the numeric application ID. strategic_reports has a unique application relationship, so regeneration updates the application's one report rather than creating duplicates.

Strategic Report flow

application app_id
  -> load company + funding program from PostgreSQL
  -> load enabled sections, layouts, and assigned agents from MongoDB
  -> LangGraph normalization, analysis, outline, and section generation
  -> calculate 36 monthly forecast periods
  -> save graph trace and final result in PostgreSQL

In production, the Python service validates the Node-issued HttpOnly session cookie and checks workspace access before it loads an application. The runtime environment selects the Test or Live database on the server; request headers cannot change that boundary.